Orders created by bots

Every online store receives visits from bots: automated programs that browse pages without a person behind them. Most of them only read your pages, but some go further, add products to the cart and enter the checkout. When that happens, you may see orders or abandoned carts in your admin panel that no real customer created.

Not all bots are a problem. Some are sent by Google to verify your products and are essential if you sell on Google Shopping. Others only fill your abandoned carts with junk. And a few are an actual fraud attempt. This article helps you tell them apart and act accordingly.

The three types of bot orders

Type	What you see	Is it harmful?	What to do
Google StoreBot	Abandoned carts from Google Bot / johnsmith001@storebotmail.joonix.net, coming from js-google-shopping-app	No. It is Google verifying your products	Do not block it
Spam bots	Many abandoned carts with random names, disposable or nonsense emails, created in bursts	Not directly, but they distort your metrics and email lists	Exclude them from metrics and email lists
Card testing	Many small orders in a short time, often with failed or declined payments	Yes. Someone is testing stolen cards in your checkout	Act quickly with your payment provider

Google StoreBot: verification orders from Google Shopping

This is the most common case for stores connected to Google through the Google Commerce app.

How to recognise it

Field	What you will see
Customer name	Google Bot or Google StoreBot
Email	johnsmith001@storebotmail.joonix.net, johnsmith002@..., etc.
Phone	A number ending in 650 253 0000.
Browser	Chrome (Generic Linux). The crawler identifies itself with the user agent Storebot-Google/1.0.
Referral information	Campaign source and medium js-google-shopping-app: the visit came from a product link in your Google Shopping feed.
History	Only “Cart Created”.
Products	Sometimes none (“Customer removed them before completing checkout”) and a total of $0.

Why it happens

Google StoreBot is an official Google crawler. In Google’s own words, it “systematically scans web pages to gather and analyze data” and navigates product pages, cart pages and checkout pages. Google uses it to check that the information you send to Merchant Center matches what shoppers see on your site: product and shipping prices, availability, coupon validity, delivery times, payment methods, and the store’s security and contact information.

To see shipping costs and payment methods, the bot goes into the checkout like a customer would. When it fills in the contact details, Jumpseller creates the cart, and because the bot never completes a purchase, the cart ends up in Orders > Abandoned.

Should I block it?

No. Google says that “allowing the crawler access to your pages is highly encouraged”. If you block it (by IP, firewall, robots.txt or any other method):

• Google can no longer verify your products, Merchant Center reports access issues and may disapprove your products.
• Crawling preferences for Storebot-Google affect all Google Shopping surfaces, so your products can stop showing there.
• Once access is restored, Google says it typically takes 12 to 48 hours for products to be approved again.

Blocking only makes sense if your store does not use Google Shopping or Merchant Center at all.

You can block the customer from your admin panel if you really want to, but we do not recommend it for Google StoreBot, for the reasons above.

Spam bots: junk abandoned carts

These are automated scripts that visit stores, add products to the cart, type an email and leave without buying.

How to recognise them

• Many abandoned carts in a short time, often at night or in waves.
• Random or repeated names, and emails from disposable or unknown domains.
• The same product (or the same few products) in every cart.
• No referral, or no product page visited before the checkout.

What to do

• They are not sales and no payment is made, so there is no money at risk.
• Exclude them from your metrics. If you analyse abandoned carts or conversion, filter out these emails when you export your abandoned orders.
• Keep your email lists clean. If you use abandoned cart recovery emails or an email marketing tool connected to your store, remove or suppress these addresses so they do not count towards your contacts or skew your email statistics.
• Keep Spam Protection enabled. Under Settings > General, Spam Protection adds a captcha to customer registration and contact forms to stop fake registrations and automated messages.

If the volume is very high, you can block the customers involved or temporarily enable the captcha at checkout, and contact us so our team can take a look.

Card testing: when bots try stolen cards

This is the type that requires action. Fraudsters buy lists of stolen card numbers and use bots to run many small payment attempts through a real checkout, to find out which cards still work.

How to recognise it

• A spike of orders with small amounts in a few minutes.
• Many failed or declined payments, sometimes from the same email or with very similar data.
• Orders from countries or regions you normally do not sell to.
• A sudden drop in your average order value.

What to do

1. Contact your payment provider right away. Most gateways have their own fraud tools (such as card security code checks, risk scoring or 3-D Secure) and can help stop the attack.
2. Enable the captcha at checkout while the attack lasts, so bots cannot keep submitting payment attempts.
3. Do not ship any order that looks suspicious, even if the payment was approved. Payments made with stolen cards can be disputed later by the real cardholder.
4. Cancel or refund suspicious paid orders through your payment provider.
5. Contact us with the order numbers and timeframe so we can review the activity on our side.

Tools to protect your store

Block a customer

If a specific customer keeps creating junk carts or suspicious orders, you can block them from your admin panel: go to Customers, open the customer and click Block.

Keep in mind:

• Do not block Google StoreBot (@storebotmail.joonix.net) if you sell on Google Shopping. We do not recommend it, for the reasons explained above.
• Spam bots and card testers usually change email on every attempt, so blocking one customer will not stop an attack on its own. Use it for repeat offenders, together with the captcha below.

Enable captcha at checkout

Under Settings > Checkout > Checkout Form you can turn on Enable captcha at checkout. The captcha is only shown when necessary, and it makes it much harder for bots to go through your checkout.

We only recommend enabling it during an attack (for example, a wave of card testing or spam carts). Any extra step in the checkout can add friction for real customers, and it may also get in the way of legitimate bots such as Google StoreBot. Once the attack is over, you can turn it off again.

How to tell them apart quickly

• storebotmail.joonix.net email + js-google-shopping-app → Google StoreBot. Ignore it and do not block it.
• Random emails, no payment attempt, many carts → spam bot. Clean your metrics and lists; block repeat offenders.
• Many payment attempts, small amounts, declined cards → card testing. Act now and enable the captcha at checkout.

Frequently asked questions

Can I block a specific customer? Yes, from Customers, by opening the customer and clicking Block (see how). For spam bots and card testing it rarely stops an attack on its own, because they usually change email, name and IP on every attempt. For Google StoreBot we do not recommend it.

Was a payment made? Google StoreBot and spam bots go through the checkout without paying, which is why they stay in the Abandoned list. A payment method (for example, Webpay) may appear selected on the order, but that only reflects what was chosen in the checkout form. Card testing is the exception: it does attempt payments.

Why did these orders start appearing now? Google does not publish StoreBot’s crawl schedule. In our experience these carts tend to show up after a store connects to Google Shopping or updates its catalogue. Spam bots and card testing usually come in waves, unrelated to anything you changed.

Can I delete them? Abandoned carts do not count as sales, so there is no need.

Sources

• Google Merchant Center Help: About the Google StoreBot crawler
• Google Search Central: Google’s common crawlers (Storebot-Google)

If you have any questions, you can contact us at any time and we will be happy to help you.