Orders → Abandoned checkouts fills up with names that look almost real, emails that look almost real, and carts that never become orders. That is what these Shopify checkout bots look like from the admin.
As of 17 September 2026, CartWatch had scored 277,000 Shopify checkouts across 130 stores and flagged 247,000 as bots. About 89% of this set was flagged, and that is not the rate for Shopify as a whole. Stores install CartWatch because the abandoned-checkout list already looks wrong, so a quiet store will come in lower. How the bots behave is the part that still applies there. The 90-day volume count, 24 June through 22 September, is in the Shopify Bot Checkout Benchmark.
A few farms produce most of the raw volume. The typical-store numbers below are the median among 89 stores that had at least 20 bot checkouts, so one campaign does not set the number for a typical store.
Checkouts that were scored and not flagged are the comparison group. A score under the line is not proof the buyer was a real shopper. Below, those are the checkouts that were not flagged.
How Shopify checkout bots actually behave
At a typical store in this set:
- They never browse. 100% of bot checkouts left no Web Pixel session. About three in four skipped the storefront and entered through
/cart/add.jsor a cart permalink. - They fill guest checkout in seconds. 98.5% were filled that fast. Checkouts that were not flagged: 2.3%.
- They take one cheap item. 100% were a single-line cart. 95% were under $15, and 62% were under $5. Checkouts that were not flagged: 72% were over $50.
- The email is generated. 99.7% matched a generated pattern. The common one is
firstname.lastnameplus digits (sophia.miller8842@…): 43% of bots, and 2.4% of checkouts that were not flagged. - Almost none complete an order. The median completed-order rate for those bot checkouts is 0%. Across all 247,000, 27 became an order.
That is the pattern behind fake abandoned checkouts. How many of those checkouts attempted payment is in How Many Shopify Bots Are Actually Testing Credit Cards?. It is also why captcha, IP and country blockers, and Shopify’s Human or bot session filter keep missing them. Those tools watch a storefront visit. These scripts often never make one.
They skip your storefront
Community threads keep landing on the same URL: https://your-store.com/cart/VARIANT_ID:1. That is a cart permalink. Open it and Shopify adds that variant and sends the visitor toward checkout. No homepage. No collection page. No theme app. No hCaptcha.
At a typical store, about 28% of bot checkouts entered that way, or through the same kind of link with skip_shop_pay=true added. The larger farms post straight to /cart/add.js instead: 61% of all bot checkouts by volume, and only 11% at the median store. Either path skips the pages where you can put a challenge.
Where they landed:
| Entry | Share of 247k bot checkouts | Typical store (median) | Not flagged |
|---|---|---|---|
Direct /cart/add.js | 61% | 11% | 0.1% |
Cart permalink (/cart/{id}:1) | 16% | 28% | 0.8% |
| Empty / missing landing | 18% | — | 4% |
| Product, collection, or home | ~4% | — | 82% |
Checkouts that were not flagged land on a product, a collection, or the homepage. Bot checkouts almost never do. 99.6% of the 247,000 bot checkouts had no pixel session at all. At 86 of 89 stores, that was the majority. The script never loaded a page, so there is no browse history, no referrer from a collection, and no time spent on the site.
Cloudflare in front of your domain does not close this on its own. Permalinks and /cart/add.js also work on yourstore.myshopify.com. About 28% of bot checkouts, by volume, had a myshopify.com referring site. They hit the hostname that rules on your own domain often miss.
They fill guest checkout in seconds
A person reads the shipping rates, types an address, and sometimes pauses. The script does not.
93% of these bot checkouts, and 98.5% at the typical store, were filled that fast. The email arrived within seconds of the checkout being created, or the guest form, address included, was finished in under 30 seconds. Among checkouts that were not flagged, that rate is 2.3%.
You cannot see this in the Shopify admin. Abandoned checkouts shows a name, an email, and a timestamp. It does not show that the email arrived a few seconds after checkouts/create. If you only scan the list by eye, every row looks like a shopper who got busy.
They grab one cheap item
Card testers pick the cheapest item so the real cardholder will not notice a $4 charge. Abandoned-checkout farms use that same item because it is easy to script and it still creates a customer.
In this data:
- 96% of bot checkouts were a one-item cart (100% at the typical store).
- 75% of all bot checkouts were under $5, and 92% were under $15.
- Checkouts that were not flagged were the other way around: 72% were over $50 before shipping.
Taking the $3 sticker off your store during an attack still helps. A farm will move to the next cheapest variant that is still live. A one-item cart also shows up on 55% of checkouts that were not flagged, so the cart size alone does not settle it. What shows up together is the cheap item, the skipped storefront, and the form filled in a few seconds.
Fake names are no longer the tell
James James is the name merchants still search for. Same first and last name, a throwaway Gmail, a made-up street in San Antonio. That is still what a lot of people look for.
In these 247,000 bot checkouts, the same first and last name was 0.1%. John Smith and Jane Doe were 0.5%. 123 Main St was 9% of all bot checkouts, and the majority pattern at only 5 of 89 stores. That older pattern is rare in this traffic now.
What shows up instead:
- Ordinary American names. One farm reused “James Anderson” tens of thousands of times. In a list, it does not look fake.
- Generated emails on real domains. Gmail, Outlook, Yahoo, Hotmail, iCloud, and Proton, not disposable inboxes. Disposable domains were effectively zero. The giveaway is the part before the @ (
firstname.lastnameplus digits), not@mailinator. - Fictional addresses and placeholder phones, when they use one. 221B Baker Street showed up on 29% of bot checkouts by volume, and it was the majority pattern at exactly one store. Phone numbers that start with 555, which are not real lines, showed up on 39% of all bot checkouts and on 19% at the typical store. A lot of farms still use a placeholder phone. Plenty now use a number that looks local.
- A shipping country you already sell to. 41% were the US and 29% were GB in the raw mix. The GB spike is the Baker Street farm. They are shipping to a country you already sell to, so a country block does not catch them.
If you are still sorting Abandoned checkouts by whether the name looks weird, you will delete the obvious rows and leave the quiet majority.
Almost none complete an order
Two jobs use the same checkout. Abandoned-checkout spam wants a customer, a recovery email, and a row in the list. Card testing wants the processor to answer on a cheap item. The cheap one-item cart in this data does both jobs. Both still create the abandoned checkout.
A missing payment method does not mean they never tried to pay. On stores with payment blocking, CartWatch refuses the payment when a bot attempts it, and Shopify leaves the checkout with no gateway set. 42% of the 247,000 bot checkouts had a payment refused that way. A gateway on the checkout means the attempt got past payment blocking. It does not mean the bot was doing a different job.
A completed order almost never happens. 27 of 247,000 bot checkouts became one (0.01%). The median store had zero. In the same window, 73% of checkouts that were not flagged were completed.
Shopify’s June 2026 bot-noise filter hides some failed card tests from Abandoned checkouts. Scripts that never complete, whether they left on their own or the payment was refused, still become rows, customers, and Klaviyo profiles.
They tick the marketing box more often
By volume, 80% of bot checkouts had the marketing box checked (buyer_accepts_marketing). Checkouts that were not flagged: 56%. The typical store is lower, a median of 28%, because the largest farms check every field and they dominate the total.
The damage is the same either way. A Started Checkout event creates a profile in your email app. If the box is checked, that profile is subscribed. Recovery flows send. Open rates fall. In Klaviyo the profile bills you whether you send or not.
For farms that are bombing the list, getting into that flow is the point.
What this means for your abandoned checkout list
The abandonment rate is supposed to tell you why people leave. It cannot do that when most of the list is scripts.
If your list is suddenly 90% or more abandoned, sales look fine, and the carts are a $4 variant with a generated email and no browse path, this is that traffic. The shipping step is not what broke. Filter these checkouts out first. The rate that is left is the one you can act on.
What does not catch them:
- Storefront captcha. They never loaded a form that has one.
- Country and IP apps. There is often no storefront session for those apps to see.
- Shopify’s session bot filter. A bot checkout is not a bot session.
- Requiring a login. It slows crude scripts, and it also slows real guests.
What does:
- Score the checkout when
checkouts/createandcheckouts/updatearrive. Look at where they landed, how fast the form was filled, the email, the cart, and the address, instead of waiting for a widget the bot never loaded. - Tag the customer and suppress the email in Klaviyo, Omnisend, Mailchimp, Drip, or Brevo before a recovery send. Unsubscribe is not enough in Mailchimp. Unsubscribed contacts still bill.
- Refuse the payment when a bot attempts it. Payment blocking runs on Shopify’s servers, so a permalink script cannot dismiss it the way it dismisses a theme overlay. The abandoned checkout will still be there. The order will not.
The app-by-app roundup is in best Shopify bot protection apps.
FAQ
How can I tell if Shopify abandoned checkouts are bots?
Look at several fields together. A direct cart or /cart/add.js landing, a one-item cart under $15, a firstname.lastname plus digits email, and a form that was filled in seconds. A normal-looking name still fits this pattern.
Do Shopify checkout bots browse the store?
Usually no. In this set, 99.6% left no pixel session, and most entered through a cart permalink or /cart/add.js. A later wave that does click Home, then a collection, then a product is the exception.
Are abandoned checkout bots the same as card testers? Same door, different job. Some scripts only want the abandoned checkout: a customer and an email. Some are testing stolen cards on a cheap item. A missing payment method does not tell you which. On stores with payment blocking, a refused attempt often never gets a gateway recorded. Almost none of them complete an order.
Why didn’t captcha, Cloudflare, or an IP app stop them?
Those run on the storefront. Checkout bots that hit a permalink or /cart/add.js never load that page. Captcha on contact forms and login still does that job. It does not cover checkout.
Do they still use fake names like James James? Rarely. The same first and last name was 0.1% of these checkouts. The names look ordinary. The email format, the cheap item, and the missing browse path are what stand out.
Will scoring delete the abandoned checkout? No third-party app can. Shopify writes the row when contact details are entered. Scoring lets you tag the customer, keep the address out of email, and refuse the payment so the order is never completed.
Across 247,000 bot checkouts, the moves repeat. They skip the storefront, fill the form in seconds, take the cheap item, and leave. Score that, and the abandoned-checkout list you use to diagnose the store is the list that remains.
CartWatch scores every Shopify checkout as it arrives, tags likely bots on the customer record, and keeps them out of your email flows before a recovery send. On the Standard plan, payment blocking refuses the payment when a bot attempts it, so the order is never completed. Install CartWatch from the Shopify App Store and see which checkouts never browsed the store.