Stop fake and spam orders

Fake orders are nearly always Cash on Delivery orders, because placing one costs the buyer nothing. You pack it, pay the courier, and the parcel comes back. Your store has two defences, both in the Spam & abuse protection card under Settings → Checkout: a block list for people you have already caught, and order limits that slow down anyone you have not caught yet.

Both are included on every plan, and the order limits are already switched on for every store. Both checks run on our server at the moment an order is placed. Nothing about them is visible on your storefront.

Block a buyer straight from a junk order

This is the quickest way, because you do not have to retype anything.

1. 1Open Orders and click the junk order.
2. 2In the Customer box, next to the WhatsApp, phone and email buttons, click Block customer.
3. 3A message confirms Customer blocked from placing new orders, and the button turns red and reads Blocked — undo. Click it again to unblock; you will see Customer unblocked — they can order again.

This blocks both the phone number and the email address on that order, and it takes effect at once — there is nothing to save. It does not cancel the order you are looking at, so use Cancel order for that.

Block a number or email by hand

1. 1Open Settings → Checkout and scroll to Spam & abuse protection. It sits just below Order methods.
2. 2Under Blocked phone numbers, type the number and click Block. Country code and spacing are ignored, so +91 98765 43210 and 9876543210 count as the same person.
3. 3Under Blocked email addresses, type the address and click Block. Plus-tags are ignored, so blocking spammer@gmail.com also blocks spammer+1@gmail.com.
4. 4To take someone off a list, click Unblock next to their entry.
5. 5Press Save in the bar at the bottom of the screen.

Block the phone number whenever you have it. A new email address takes ten seconds to make. A new phone number costs money, and a COD order needs a real one because the courier has to call it. Each list holds up to 500 entries.

Limit how fast one person can order

The tick box Limit how fast one person can order is on by default, even if you have never opened this screen. It catches a spammer you have not noticed yet, without you blocking anyone. It has three numbers:

• Orders per customer per day — default 5. Counted across the same phone number or email in the last 24 hours.
• Unpaid COD orders at once — default 3. How many Cash on Delivery orders one buyer can have open before you have delivered any. Customers who pay online are never affected by this one.
• Orders per hour from one device — default 15. Catches someone who changes their name and number each time. Raise it if many of your buyers share one office or campus connection. Treat it as a rough backstop rather than an exact count.

Set any one of them to 0 to turn just that limit off, or untick the box to turn all three off. Press Save afterwards.

What a refused buyer sees

A refused buyer sees one line at checkout: We couldn't place this order. Please contact the store directly. It is the same line whether they are on your block list or have hit a limit, and it never says which detail caused it. Telling them would only show them what to change. A genuine customer caught by mistake will message you, and you can unblock them in seconds.

Where it cannot help

• Razorpay Magic Checkout and Shiprocket Checkout. With these, the buyer types their details inside Razorpay's or Shiprocket's window, so your store only learns who they are after the order is placed. A blocked buyer cannot be refused there. The order is saved with a note in its Activity list saying the buyer is on your block list, and you cancel it yourself. The order limits do not apply to these checkouts either.
• Someone with a stack of SIM cards. The limits slow them down; they do not make fake orders impossible. For a high-value COD order, a quick call or WhatsApp message before you ship is still the best check — the WhatsApp button is right there in the order.
• If fake COD orders keep coming, you can switch COD off for a while: untick Show Cash on Delivery under Settings → Checkout → Order methods. See Checkout: order methods & form.

Separately from all this, the checkout form already rejects obvious junk before an order can be placed — a one-letter name, an address line that is a single repeated character, or an Indian phone number that is not a valid 10-digit mobile.

Common questions