Orders → Abandoned checkouts fills up with names that look real, emails that look real, and carts that never become orders. This is what those checkouts look like from the data, on every store running CartWatch.
In the 90 days ending 13 October 2026, CartWatch scored about 2.3 million checkouts on 304 stores and flagged 2.1 million of them as bots. That is 93% of the checkouts, and it is not the rate for Shopify as a whole. Stores install CartWatch because the abandoned checkout list already looks wrong, so a quiet store will come in far lower. How the bots behave is the part that applies everywhere.
Every number below comes in two versions, because a few farms produce most of the raw volume:
- All bot checkouts counts every flagged checkout. The biggest farms set this number.
- Typical store is the median store among the 207 stores with at least 20 flagged checkouts we could read. One campaign cannot move it.
Not flagged is the comparison group: checkouts that were scored and stayed under the line. A score under the line is not proof the buyer was a real shopper, but as a group they behave like shoppers.
The pattern at a typical store
- No browsing session. 99.7% of bot checkouts arrived with no recorded storefront visit.
- Straight to the cart. About two-thirds entered through a cart URL, a
/cart/add.jscall or a cart permalink, instead of a product page. - Filled in seconds. 98% had their contact details filled within seconds of the checkout being created. Among non-flagged checkouts, 1%.
- One cheap item. 100% were a single-line cart. Where the cart was in US dollars, 90% were under $15.
- No order. The typical store’s bot checkouts completed 0 orders. Non-flagged checkouts completed 75%.
That is the pattern behind fake abandoned checkouts. It is also why captcha, IP and country blockers, and Shopify’s Human or bot session filter keep missing them. Those tools watch a storefront visit. These scripts rarely make one.
They skip the storefront
Where the checkout started, by the first page Shopify recorded for it:
| Entry point | All bot checkouts | Not flagged |
|---|---|---|
Direct /cart/add.js call | 51% | 0.1% |
Cart permalink (/cart/{id}:1) | 16% | 0.6% |
| No page recorded | 26% | 9% |
| Home page | 4% | 26% |
| Product or collection page | 1% | 50% |
Half of all bot checkouts started with a direct call to the cart endpoint, and another sixth with a permalink. Shoppers start on a product, a collection, or the home page. At the typical store, 65% of bot checkouts came in through one of the cart routes.
The browsing session tells the same story with a caveat. 99% of bot checkouts had no recorded storefront visit at all. But about half of non-flagged checkouts also arrived without one, so a missing session on its own proves nothing. What separates the bots is everything else that comes with it.
Bots also use the address your edge rules cannot see. On stores that have a custom domain, about two-thirds of all bot checkouts were created on the store’s .myshopify.com address. Under 1% of non-flagged checkouts were. It is concentrated: on 68 of 194 stores, most bot checkouts came in that way, while the typical store saw almost none. Cloudflare in front of your domain never sees those requests.
They fill the form in seconds
A person reads the shipping options, types an address, and pauses. A script does not.
| All bot checkouts | Typical store | Not flagged | |
|---|---|---|---|
| Contact details filled within seconds | 98% | 98% | 1% |
You cannot see this in the Shopify admin. Abandoned checkouts shows a name, an email, and a timestamp. It does not show that the email arrived a few seconds after the checkout was created.
They take one cheap item
| All bot checkouts | Typical store | Not flagged | |
|---|---|---|---|
| One item in the cart | 99.9% | 100% | 51% |
| USD cart under $5 | 60% | 2% | 4% |
| USD cart under $15 | 89% | 90% | 18% |
| USD cart over $50 | 1.5% | 0% | 54% |
The biggest farms go for the cheapest thing in the store, which is why 60% of all bot carts are under $5. At the typical store the bot cart is a $5 to $15 item. Shoppers’ carts are the other way around: more than half are over $50.
Taking the $3 sticker off your store during an attack still helps, but a farm moves to the next cheapest variant. A one-item cart on its own means little, since half of real checkouts are one item too. The combination is the tell: one cheap item, no storefront visit, and a form filled in seconds.
The names look ordinary now
James James is the name merchants still search for. It is almost gone from this traffic.
| All bot checkouts | Typical store | |
|---|---|---|
| Same first and last name | under 0.1% | 0% |
| John Smith, John Doe, Jane Doe | 0.8% | 0% |
123 Main St as the street | 11% | 5% |
| 221B Baker Street | 8% | 0% |
| Phone number starting 555 | 44% | 15% |
None of these appeared on non-flagged checkouts at a measurable rate. The Baker Street rows are one farm, which also explains why 23% of all bot checkouts ship to Great Britain against 11% of non-flagged checkouts. Placeholder phones are still common in the big farms. The typical store sees them on about one bot checkout in seven.
The emails are the clearest shift. Bot checkouts spread their addresses almost evenly across mainstream domains: Gmail, Outlook, Yahoo, Proton, Hotmail, iCloud, and AOL each took between 7% and 12%. Non-flagged checkouts were 56% Gmail. Disposable domains were effectively zero on both sides. A bot email looks like sophia.miller8842@outlook.com, not @mailinator. It is also new on almost every checkout, while the address and phone behind it repeat for weeks: see How Shopify Checkout Bots Rotate Emails, Names and Addresses.
Half of all bot checkouts shipped to the US, a quarter to Great Britain, and a fifth had no shipping country at all because the script stopped before the address step. Bots ship to the countries you already sell to, so a country block does not catch them.
Almost none complete an order
| All bot checkouts | Typical store | Not flagged | |
|---|---|---|---|
| Became an order | 411 of 1.6 million (0.03%) | 0% | 77% |
How many bot checkouts try to pay before giving up is a separate question, and it can only be measured on stores where CartWatch is not refusing payments. On those stores, about half of flagged checkouts attempted payment, almost always for a few dollars, and almost never became an order. That count is in How Many Shopify Bots Are Actually Testing Credit Cards?. On stores with payment blocking on, Shopify does not tell us whether a bot pressed pay, so this post makes no claim about them.
Shopify’s June 2026 bot-noise filter hides some failed card tests from Abandoned checkouts. Everything else here still becomes a row, a customer, and a profile in your email platform.
They tick the marketing box about as often as shoppers
| All bot checkouts | Typical store | Not flagged | |
|---|---|---|---|
| Marketing box checked | 77% | 58% | 64% |
The largest farms check every field, which lifts the overall number. At the typical store, bots tick the box slightly less often than real shoppers do. Either way, more than half of bot checkouts arrive opted in. A Started Checkout event creates a profile in your email app, and if the box is checked, that profile is subscribed and recovery flows send to it.
What this means for your abandoned checkout list
The abandonment rate is supposed to tell you why people leave. It cannot do that when most of the list is scripts.
If your list is suddenly 90% abandoned, sales look fine, and the rows are a cheap one-item cart with an ordinary name and no browsing path, this is that traffic. The shipping step is not what broke. Filter these checkouts out first. The rate that is left is the one you can act on.
What does not catch them:
- Storefront captcha. They never loaded a form that has one.
- Country and IP apps. Most ship to countries you sell to, and there is often no storefront session for the app to see.
- Shopify’s session bot filter. A bot checkout is not a bot session.
- Requiring a login. It slows crude scripts, and it also slows real guests.
What does:
- Score the checkout when Shopify sends it. Where it landed, how fast the form was filled, the cart, the email, and the address, read together, instead of waiting for a widget the bot never loaded.
- Tag the customer and suppress the email before a recovery send. In Mailchimp, unsubscribe is not enough, because unsubscribed contacts still bill.
- Refuse the payment when a bot attempts it. Payment blocking runs on Shopify’s servers, so a permalink script cannot dismiss it the way it dismisses a theme overlay. The abandoned checkout will still be there. The order will not.
The app-by-app roundup is in best Shopify bot protection apps.
How we counted
- Window and stores. Checkouts created from 15 July through 13 October 2026, on 304 stores. Five development or test stores whose checkouts used Shopify’s test gateway are left out, as are banned shops, point-of-sale checkouts, and CartWatch’s own audit checkouts.
- Readable records. Of the 2.1 million flagged checkouts, about 471,000 had their details wiped when the customer record was later deleted, and they are left out of every rate. About 104,000 checkouts with no email address were never scored and are left out too. That leaves 1.6 million flagged checkouts with a readable record.
- Samples. 226 stores were read in full. The 78 busiest were sampled: about 3,000 checkouts each, spread across every day of the window, with each day weighted by that store’s volume. “All bot checkouts” figures are weighted that way. “Typical store” figures are the median store among the 207 stores with at least 20 readable flagged checkouts; the median such store had 231.
- Definitions. The entry point is the first page Shopify recorded for the checkout. A browsing session is a storefront visit CartWatch’s pixel recorded for that checkout. “Filled within seconds” is CartWatch’s record that the contact details arrived within seconds of the checkout being created. Cart values use the cart’s merchandise total, in US dollars only.
- Revision. The first version of this post, published 17 September 2026, covered 247,000 flagged checkouts as of that date and mixed volume and typical-store figures in the same sentences. This version separates them and replaces the numbers. It also drops a figure that counted checkouts CartWatch’s rules would have refused as if they were observed payment attempts.
These figures are stores running CartWatch, not Shopify as a whole.
FAQ
How can I tell if Shopify abandoned checkouts are bots?
Look at several fields together. A one-item cart under $15, an email that looks like firstname.lastname plus digits on a mainstream domain, no browsing path, and a form filled in seconds. An ordinary-looking name still fits this pattern.
Do Shopify checkout bots browse the store? Almost never. 99% of bot checkouts had no recorded storefront visit, and two-thirds at the typical store entered through a cart URL. About half of real checkouts also arrive without a recorded visit, so that one signal is not enough on its own.
Are abandoned checkout bots the same as card testers? Same door, different outcome. About half of bot checkouts attempt payment on stores where that can be seen, and the rest stop before the payment step. Which pattern a store gets is in Many Shopify bots never attempt payment.
Why didn’t captcha, Cloudflare, or an IP app stop them?
Those run on the storefront. Checkout bots that hit a permalink or /cart/add.js never load that page, and many hit the .myshopify.com address that your edge rules do not cover.
Do they still use fake names like James James? Rarely. The same first and last name appeared on fewer than 1 in 1,000 bot checkouts. The names look ordinary. The cheap item, the missing browse path, and the speed are what stand out.
Will scoring delete the abandoned checkout? No third-party app can. Shopify writes the row when contact details are entered. Scoring lets you tag the customer, keep the address out of email, and refuse the payment so the order is never completed.
CartWatch scores every Shopify checkout as it arrives, tags likely bots on the customer record, and keeps them out of Klaviyo, Omnisend, and more before a recovery send. On the Standard plan, payment blocking refuses the payment when a bot attempts it, so the order is never completed. Install CartWatch from the Shopify App Store and see which checkouts never browsed the store.