← All guides · By Agents4Ecom · Published Oct 15, 2026

How Do I Stop the 'James Anderson' Bot Orders on My Shopify Store?

On Shopify Basic you can't stop the "James Anderson" bots from reaching your store, but you can stop them from costing you money. Keep hCaptcha on, use double opt-in so fake sign-ups never become subscribers, and clean out fake zero-order accounts in bulk. For the orders that do get through, a free Shopify Flow automation that starts on "Order risk analyzed" can tag the order, put its fulfillment on hold and email you, so you check it before anything ships. Don't auto-cancel on the name alone, because real James Andersons exist.

This question has been all over r/shopify since August 2026. The thread titles say it plainly: "Fake orders", "James Anderson Bot Issue", "Gathering Info on the James Anderson Situation" and "more on the James Anderson situation". This guide sorts out what's going on, what each fix actually covers, and how to set up the order-hold automation step by step.

What is the "James Anderson" bot?

It's the name owners gave to a wave of automated traffic that creates fake activity in Shopify stores. Based on the threads above, it shows up as:

• Fake customer accounts. One owner wrote: "I'm now getting 100s of fake customer accounts per day, 100s of fake newsletter sign ups per day, and a few fake orders."
• Fake newsletter sign-ups that fill up your email list (and your email plan's contact limit).
• Abandoned checkouts, often the same item to the same address, with no payment attempt.
• A smaller number of real orders, sometimes for the cheapest item in the store.

The names vary. Owners report James Anderson, John Smith, Mary Garcia and James Wilson, with a new email address each time.

Nobody outside Shopify has confirmed the cause. Some owners suspect card testing. One commenter pointed out that checkouts with no payment attempt look more like "a script hitting your checkout endpoint" than card testing. Treat any single explanation as unconfirmed.

Why can't I just block it on the Basic plan?

Because the strongest checkout protection isn't on your plan. Shopify's Help Center says: "Additional bot protection for your Shopify checkout during sales is available only for stores on the Shopify Plus plan." One owner quoted Shopify Support as saying "there's no config change that would stop it on the Basic plan right now." That's one owner's report of what Support told them, not an official Shopify statement.

What Shopify does run on every store: Cloudflare in front of your storefront, and hCaptcha, which Shopify says is "activated by default on all Shopify stores" to limit spam on contact and comment forms and customer account pages.

So on Basic you're not trying to keep every bot out. You're trying to contain the damage: dirty data, a polluted email list, and the occasional fake order you might ship.

Which fix handles which part of the problem?

Our Bot Order Shield recipe covers only the last row. It works on orders. It does nothing about fake accounts, sign-ups or abandoned checkouts, which never become orders, so do the free steps above as well.

Why does the fake-account cleanup matter?

Two knock-on costs come up in the threads.

• Email reputation. If an abandoned-checkout or welcome email goes out to hundreds of fake addresses, bounces can hurt delivery to your real customers. One commenter warned that sending a campaign to those addresses "will hurt your sender reputation fast."
• Ad data. Another commenter noted that if your Meta pixel shares checkout events server-side, fake checkouts can inflate "checkouts initiated" in Ads Manager. If that applies to you, compare it with your real checkout count.

Should I auto-cancel these orders or hold them?

Hold them. Several owners suggested a Flow that cancels any order from "James Anderson". It's quick, but it has two problems:

1. Real customers share the name. As one owner joked in the "Fake orders" thread, it's "a shame if a real dude names James Anderson orders from my store."
2. Bots change names. A name rule alone misses the John Smith and Mary Garcia versions.

A fulfillment hold stops the order from shipping, but leaves the decision to you. You open the order, read Shopify's fraud analysis, and either release the hold or cancel and refund. That's the approach Shopify's own Hold fulfillment order action is built for. Shopify also lists holding fulfillment "when an order is flagged as having a high risk of fraud" as a standard use.

On payment capture, Shopify's documentation is clear: if your store captures payments automatically, Flow can't stop the capture, it can only cancel the order afterwards. If you want Flow to decide whether to capture at all, you need manual capture in your payment settings, plus Shopify's "Capture payment if order is not high fraud risk" template. Some owners report that processing fees on captured fraud orders weren't returned when they cancelled. Check your payment provider's fee policy before you rely on auto-cancel.

How do you build a bot-order hold in Shopify Flow?

This is the logic behind Bot Order Shield. It uses only built-in Flow steps, so it runs on Basic.

1. In Shopify, open Apps → Flow and click Create workflow.
2. Choose the trigger Order risk analyzed. Shopify's guidance is to use this trigger instead of Order created for anything fraud-related, because the fraud analysis "takes some time to process" after the order is placed.
3. Add a Condition set to Any of the following: the order's risk recommendation is CANCEL, or it's INVESTIGATE. These are Shopify's own fraud verdicts.
4. On that condition's Otherwise branch, add a second condition set to All of the following: the customer's number of orders is 1 or less, billing address matches shipping address is false, and the order total is 150 or more (pick your own threshold).
5. On the second condition's Otherwise branch, add a third: first name equals James and last name equals Anderson. Swap in whatever names hit your store.
6. On every Then branch, add the same three actions: Add order tags (bot-shield-review); Hold fulfillment order (reason: high risk of fraud; with an order trigger like this one, Shopify places the hold on every fulfillment location in the order); and Send internal email to yourself with the order name, customer, total and Shopify's risk verdict.
7. Click Turn on workflow, then Turn on.

If you'd rather not build it, the Bot Order Shield recipe is this exact workflow as a one-click Flow file: import it, type your email into the email step, turn it on. About 5 minutes.

How do you test it?

1. On a development store, or with a test payment method, place an order as a new customer with different billing and shipping addresses. Temporarily lower the amount threshold so a small test order qualifies.
2. Wait a few minutes. The workflow only runs once the fraud analysis finishes.
3. Check Recent runs in Flow. The order should have the bot-shield-review tag and show as On hold, and the email should arrive.
4. Place a second test order with matching addresses. It should not be held.
5. Put your real threshold back, then release and cancel the test orders.

Shopify's own testing note for this trigger is to "create a test order that triggers Shopify's fraud analysis." Shopify also notes that fraud analysis takes time, so the workflow won't run the instant the order is created.

What do you do when the email arrives?

1. Open the order and read the Fraud analysis section.
2. Looks real (returning address, sensible items, matching details)? Click Release hold and ship as normal.
3. Looks fake? Cancel and refund before you ship. Commenters advise cancelling early rather than waiting for a chargeback.
4. Optional: tag the customer, and use Shopify's "Cancel and tag orders from known bad email addresses" template for repeat offenders.

What are the limits?

• It waits for Shopify's fraud check. The alert arrives minutes after the order, not instantly.
• It only reads Shopify's risk analysis. Shopify says the Order risk analyzed trigger is "only invoked for Shopify risk assessments and not for third-party assessments." If you use another payment provider or a fraud app, check that orders still get a Shopify risk result.
• Some real customers will be held. That's why it pauses instead of cancelling.
• It doesn't touch accounts, sign-ups or abandoned checkouts. Use the free steps in the table above for those.

Next step

Set up the free steps for fake accounts today, then add the order hold. The Bot Order Shield recipe installs it in about 5 minutes. For the next order problem to tackle, see How to get a stuck-orders alert in Shopify, or run the free AI audit to see which jobs in your store are worth automating.

FAQ

Is James Anderson a real customer or a bot?

Usually a bot in this 2026 wave, but not always. Owners on r/shopify report fake accounts and orders under that name and others. It's also a common real name, so hold and check rather than cancel on the name alone.

Does Shopify have bot protection for checkout on Basic?

No. Shopify's Help Center says additional checkout bot protection "is available only for stores on the Shopify Plus plan." hCaptcha, which protects forms and customer account pages, is on by default for all stores.

Should I use Order created or Order risk analyzed?

Order risk analyzed. Shopify recommends it for fraud workflows because fraud analysis finishes some time after the order is created.

Will this automation cancel or refund orders?

No. It tags the order, puts its fulfillment on hold and emails you. You decide whether to release or cancel.

Does this stop the fake customer accounts?

No. Those never become orders. Check hCaptcha, turn on double opt-in, and bulk-delete zero-order fake accounts on a schedule.

Does it work on Shopify Basic?

Yes. It uses only built-in Flow steps (Order risk analyzed, Condition, Add order tags, Hold fulfillment order, Send internal email). Flow is free on Basic and up.

Is this an AI agent?

No. It's an automation: a fixed set of rules that runs on its own inside Shopify Flow. You can read exactly why it held an order.

Related guides

• How Do Small Shopify Stores Handle 'Where Is My Order?' Emails Without Paying $500/mo?
• What Is Shopify Flow (and Is It Free?)
• What Can You Automate in a Shopify Store? 8 Jobs Worth Handing Off
• All automation recipes