A Shopify checkout bot changes one thing on nearly every checkout: the email address. The street address, the phone number, and usually the name stay the same, for weeks, and often on dozens of other stores.
CartWatch measured this on 322 Shopify stores over the 90 days ending 15 October 2026, comparing 101,710 flagged checkouts with 56,697 checkouts that were not flagged. The finding matters for anyone trying to block bots by email: at the typical store, 98.6% of flagged checkouts arrived with an email that no other flagged checkout used.
The email changes. The rest stays.
For each store, we counted how many of its flagged checkouts carried a value no other flagged checkout on that store carried. The table shows the median store among 113 stores that CartWatch read in full and that had at least 50 flagged checkouts (the median such store had 269).
| Share of checkouts with a value used only once on that store | Flagged | Not flagged |
|---|---|---|
| Email address | 98.6% | 92.8% |
| Name | 59.1% | 92.4% |
| Street address | 23.7% | 93.5% |
| Phone number | 20.4% | 93.3% |
Shoppers repeat themselves about 7% of the time, on every field at once, which is what returning customers and second attempts look like. Bots repeat the address and phone on three checkouts out of four and the email almost never.
On 87 of the 113 stores, at least 90% of flagged checkouts had a one-off email. Only 17 stores saw a quarter or more of their flagged checkouts share an email with another one, and those stores had a different kind of bot, one that reuses the whole identity.
Across the 60,374 flagged checkouts on the 241 fully read stores, there were 49,161 distinct emails, 20,257 distinct street addresses, 17,472 distinct names, and 16,292 distinct phone numbers. Eleven street addresses account for half of those checkouts. Five phone numbers account for half. It takes 18,974 distinct emails to cover half.
One address, hundreds of emails
Looking at it from the address: 68% of flagged checkouts on the fully read stores shipped to a street address that other flagged checkouts on the same store used with a different email. For shoppers it was 2.2%. At the typical store it was 75% of flagged checkouts and 0% of shoppers.
Phones tell the same story: 72% of flagged checkouts used a phone number that also appeared with other emails, against 1.5% of shoppers. Names: 77% against 3%.
Among addresses used five or more times by flagged checkouts, the median address had a different email on every single use. At the typical store, 61% of flagged checkouts sat on an address that had been used with ten or more emails.
The reverse pattern, one email with several addresses, was rare: 18% of flagged checkouts on the fully read stores, driven by a handful of farms, and 0% at the typical store.
Stores split on this. On 68 of the 113 stores, at least half of flagged checkouts shared their address with other emails, and on 44 it was 90% or more. On 25 stores it was under 10%, and on those stores the bots tend to invent a new address each time as well as a new email. Both kinds leave the same row in Orders → Abandoned checkouts.
The same identities come back for weeks
Reuse is not one burst. On the fully read stores, 407 street addresses were used five or more times by flagged checkouts, covering 34,846 checkouts. 85% of those checkouts sat on an address that was still being used 30 or more days after its first use. Only 0.9% sat on an address that was used on one day and never again. The median repeated address was active on four separate days across a two-week span.
Phone numbers and names recur even longer: 83% of checkouts on repeated phones and 86% on repeated names belonged to values that were in use for 30 days or more.
Shoppers who reuse an address do it within the week. Of the 911 non-flagged checkouts on repeated addresses, 48% belonged to addresses used over fewer than seven days, and 13.5% to addresses spanning 30 days or more.
The same addresses show up store after store
Bots do not keep an address for one store. 70% of flagged checkouts with a street address used an address that also appeared on flagged checkouts at a second store, and 51% used one that appeared on ten or more stores. For phones it was 71% and 61%. For names, 82% and 56%.
Shoppers’ details almost never cross stores: 0.4% of non-flagged addresses, phones, and emails appeared on a second store. Names did, 2.6% of the time, because some names are common.
The biggest cross-store value is the placeholder 123 Main, with or without St, with a New York zip code. It appeared on 21% of all flagged checkouts that had an address. Its most common spelling alone appeared on 135 stores, under 6,287 different emails and 884 different names. Leaving every 123 Main variant out, 62% of flagged addresses still appeared on a second store and 38.5% on ten or more.
The rest of the cross-store list reads like a tourist itinerary. Flagged checkouts shipped to 10 Downing Street on 16 stores (1,474 checkouts, 1,464 emails), the Willis Tower on 34 stores, the Empire State Building on 31 stores, Apple Park on 24, 221B Baker Street on 22, Google’s Mountain View headquarters on 15, 1 Martin Place in Sydney on 14, and Unter den Linden 1 in Berlin 2,318 times on the fully read stores. One actor cycled through Google’s office addresses in New York, Boulder, and Ann Arbor on 15 to 18 stores each, with one name and the same ten emails every time.
Not every repeated address is a landmark. A single real Manhattan street address appeared on 113 stores and 15,176 flagged checkouts, with 15,144 different emails and only 13 names. Four invented Washington, DC addresses, two of them in the White House’s zip code, each appeared on 32 to 37 stores with roughly 800 checkouts, 95 emails, and 65 names apiece. That actor rotates slowly: the same hundred emails recur, in different combinations with the same addresses and names, for months.
Emails cross stores far less. 20% of flagged checkouts used an email seen on another store, and nearly all of that is the slow-rotating actors above. A bot that invents an email per checkout invents it per store too.
What the emails look like
Flagged checkouts used 188 email domains. Non-flagged checkouts used 4,613. The spread across providers is the clearest difference:
| Email provider | Flagged | Not flagged |
|---|---|---|
| Outlook, Hotmail, Live, MSN | 29% | 11% |
| Gmail | 17% | 55% |
| Yahoo | 12% | 11% |
| Proton | 12% | 0.3% |
| iCloud | 8% | 4% |
| AOL | 5% | 3% |
| Yandex | 3% | 0% |
| Everything else | 13% | 16% |
Shoppers are a Gmail crowd. On 86 of the 132 stores with at least 20 non-flagged checkouts, Gmail alone held more than half of shopper emails. Bots spread themselves across providers: on 156 of the 182 stores with at least 50 flagged checkouts, no single provider held even half of the flagged emails. A Proton or Yandex address is nearly always a bot in this data, but together they are only 15% of flagged checkouts, so they do not help much.
Disposable domains were 0.3% of flagged checkouts and 0.1% of non-flagged ones. Bots do not use Mailinator. They use outlook.com. 94% of flagged emails were on a mainstream free provider, against 84% of shopper emails. At the typical store it was 99% against 86%.
The local part, the piece before the @, is built from the name on the checkout plus digits:
| Of checkouts with a name on them | Flagged | Not flagged |
|---|---|---|
Name appears in the email, with digits (emma.wilson4821@) | 47% | 25% |
| Name appears in the email, no digits | 27% | 42% |
| Name absent, digits present | 22% | 16% |
| Name absent, no digits | 4% | 18% |
| Local part contains a run of four or more digits | 26% | 10% |
| Local part contains a dot | 50% | 18% |
The median flagged local part was 14 characters long; the median shopper’s was 11. None of these shapes is rare among shoppers, which is why the email alone is a poor signal even before it rotates.
Same first and last name, the James James pattern, was 0.1% of flagged checkouts and 0.6% of non-flagged ones. Real people are more likely to be called that than bots are now. More on names in James James & John Smith: Fake Names in Shopify Abandoned Checkouts.
What this means for blocking
An email blocklist cannot work against this traffic. The bot has already moved on before the address is on the list. The typical store would block one flagged checkout in seventy that way. What a blocklist is still good for, and why blocking domains or patterns fails too, is in Why Blocking Bot Emails Doesn’t Stop Shopify Checkout Spam.
The stable values are the address, the phone, and to a lesser degree the name, and those recur for weeks and across stores. They also collide with real customers more than an email does: a street address is shared by a household and a phone by a family, and 123 Main turns up on real test orders. CartWatch scores a checkout on the whole record, including a merchant-specific history of values seen on confirmed bots and a cross-store view of values seen on confirmed bots elsewhere, rather than on any single field. The emails in this study rotated; the records behind them did not.
Whatever you block, the row Shopify writes stays. Why bots leave those rows and what they cost is in How Shopify Checkout Bots Actually Behave and The Shopify Bot Checkout Benchmark. What a rotated email does to an email provider bill is in how bot profiles raise your Klaviyo bill.
How we counted
- Window and stores. Checkouts created from 17 July through 15 October 2026 on 322 stores running CartWatch. Banned shops, CartWatch’s own development stores, point-of-sale checkouts, and CartWatch’s own audit checkouts are left out.
- Records. 319,059 checkout records were read. 25,645 had their details wiped when the customer record was later deleted, and 122,552 had no score, usually because they had no email. Both are left out. That leaves 101,710 flagged checkouts and 56,697 non-flagged checkouts with an email, scored under CartWatch’s rules. “Not flagged” means scored under the bot threshold, not verified human.
- Samples. 241 stores were read in full. The 81 busiest were sampled: about 3,000 checkouts each, spread across every day of the window. Figures that count repeats within a store (“used only once”, “one address, many emails”, “comes back for weeks”) use only the 241 fully read stores, because a sample under-counts repeats. Cross-store and email-shape figures use every store. Counts are counts of records in the sample, not estimates of volume.
- Matching. Emails were compared lower-cased. Street addresses were compared as the first address line plus the postal code, with punctuation and common abbreviations normalised. Phones were compared on their last ten digits. Names were compared as first plus last name, lower-cased. All matching was done on hashes.
- Typical store. The median store among stores with at least 50 flagged checkouts in the sample: 113 of the fully read stores for within-store figures, 182 stores for email-shape figures.
These figures are stores running CartWatch, not Shopify as a whole. Stores usually install CartWatch because the abandoned checkout list already looks wrong.
FAQ
Do Shopify checkout bots reuse email addresses? Rarely. At the typical store, 98.6% of flagged checkouts used an email no other flagged checkout there used. Across 60,374 flagged checkouts on 241 fully read stores, there were 49,161 distinct emails.
What do Shopify bots reuse? The street address, the phone number, and the name. At the typical store, three in four flagged checkouts used an address or phone that other flagged checkouts also used, and the median repeated address had a different email on every use.
Do the same bot addresses appear on different stores? Yes. 70% of flagged checkouts with an address used one that also appeared on another store, and 51% used one seen on ten or more stores. Shoppers’ addresses appeared on a second store 0.4% of the time.
Which email providers do Shopify bots use? Mainstream ones, spread evenly: Outlook and Hotmail 29%, Gmail 17%, Yahoo 12%, Proton 12%, iCloud 8%. Shoppers were 55% Gmail. Disposable domains were 0.3% of flagged checkouts.
Can I block Shopify bots by email address? Not usefully. The email changes on almost every checkout. The address, phone, and name are what recur, and CartWatch scores on the whole record, including a history of values seen on confirmed bots, rather than on the email alone.
Is a Proton or Yandex email a bot? In this data, nearly always, but they are 15% of flagged checkouts combined. Most bot emails are on Outlook, Gmail, and Yahoo, the same providers shoppers use.
CartWatch scores Shopify checkouts as they arrive. On the Starter plan and above, it can tag the customer and keep the address out of Klaviyo, Omnisend, Mailchimp, Drip, and Brevo. On the Standard plan, payment blocking blocks bots from attempting payment. Install CartWatch from the Shopify App Store.