Shopify has no "block customer" button. If someone keeps placing fraudulent orders, filing chargebacks, or abusing your return policy, you need a workaround.
The advice you will find in most forum threads is out of date. It points you at the Fraud Filter app, and Shopify retired Fraud Filter on 31 January 2025. Many merchants lost their blocklists in that migration.
Here is what actually works in 2026, from free manual methods to fully automated rules.
The short answer: Shopify cannot block a person. It can block a checkout. If you use Shopify Payments, Fraud Control checkout rules stop matching checkouts before they become orders. If you do not, or you need to match on more than email, address, and IP, you need Shopify Flow (Plus only) or a fraud prevention app that cancels or holds matching orders automatically.
Why You Cannot Block Customers Natively
Shopify checkout is deliberately low-friction. Anyone with a valid payment method can place an order, even without an account.
Disabling or deleting a customer account in the admin only stops that person from logging in. It does nothing to their ability to buy. They open your store in a private window, check out as a guest with the same email, and the order lands in your admin exactly as before.
This is the single most important thing to understand. Guest checkout is why "just delete the customer" fails, and why most blocking advice disappoints people. Blocking a customer really means one thing: detecting their orders by stable signals, then stopping those orders.
The signals worth matching on:
- Email address, and disposable email domains in general
- Full name, first name, and last name
- Shipping and billing address, including street, postal code, and country
- Phone number
- IP address
- Payment behavior, such as repeated failed attempts
Match one signal and a new email defeats you. Match several at once and the block holds.
When You Should Block a Customer
Not every difficult customer deserves a block. These patterns do.
Repeated chargebacks. The same person disputes order after order. Each one costs you the goods, the shipping, and a chargeback fee. See our guide on how to prevent chargebacks for the wider picture.
Stolen card signals. Mismatched billing and shipping addresses, several failed payment attempts, an order far above your average value, and an express shipping upgrade. Any one is weak. Together they are a pattern.
Serial return and refund abuse. They order, claim non-delivery or damage, get refunded, and repeat.
Discount and free shipping abuse. One person creates account after account to reuse a first-order code.
Abuse of your staff. Aggressive messages, threats, or harassment aimed at your support team. You are allowed to refuse service.
Bot and spam accounts. Bulk fake signups and card testing. This is a different problem, covered in Shopify bot protection.
Method 1: Disable or Delete the Customer Account
How: Open the customer in your Shopify admin and delete the account, or remove their marketing consent and personal data.
This is what most guides tell you to do first. It is also the weakest option.
✅ Pros:
- Free, instant, works on every plan
- Removes personal data, which helps with GDPR requests
🚨 Cons:
- Blocks nothing. Guest checkout is untouched
- Destroys your own order history for that person, which you need as evidence
- Deleting a customer removes the record you would use to prove a pattern later
Verdict: Use it to satisfy a data deletion request. Never use it as a block.
Method 2: Manual Tagging and Review
How: Tag the customer "blocked" or "fraud", then check new orders against tagged customers before you fulfill.
✅ Pros:
- Free and takes seconds to set up
- Works on every Shopify plan and every payment processor
- Builds a documented record of why the person is a problem
🚨 Cons:
- Nothing is actually blocked. Orders still arrive and still need handling
- Depends on somebody remembering to check every order
- Fails the moment the customer uses a new email address
- Does not scale past a handful of orders a day
Verdict: A good habit, not a solution. Keep tagging even after you automate, because the tags document the reason.
Method 3: Shopify Fraud Control Checkout Rules
This is the native option most guides still miss, and it is the closest thing Shopify has to a real block.
Fraud Control is a Shopify app that shows a fraud dashboard and lets you write checkout rules. A matching checkout is stopped before it becomes an order. The buyer sees a generic error telling them the checkout could not be completed and to contact the store. The attempt lands in your abandoned checkouts.
How to set it up:
- Open Apps in your Shopify admin and find Fraud Control
- Go to Rules and click Create rule
- Add one or more checkout conditions
- Save and activate the rule
What you can match on: email addresses, address attributes, and IP addresses. You can combine conditions, for example an IP address together with a postal code.
✅ Pros:
- Native, free, and blocks before the order exists
- No cancellation email, no refund, no restocking
- Combines several conditions in one rule
🚨 Cons:
- Checkout rules require Shopify Payments as your processor. If you use PayPal Express, Stripe through a third party, or a regional gateway, this option is closed to you
- Only three condition categories. No phone number, no order value, no customer history, no chargeback count
- Shopify states plainly that Fraud Control cannot guarantee you will never receive a fraudulent order
Verdict: Turn this on first if you use Shopify Payments. It handles the obvious repeat offenders at zero cost. Then layer something else on top for the signals it cannot see.
Method 4: Shopify Flow (Shopify Plus Only)
On Shopify Plus you can build a Flow automation: when an order is created by a customer tagged "blocked", cancel it automatically.
Flow is also where Shopify told Fraud Filter users to migrate in January 2025. That migration went badly for a lot of merchants, because Flow could not import every existing Fraud Filter blocklist entry. If you had a blocklist before 2025 and never rebuilt it, assume it is gone.
✅ Pros:
- Native and free on Plus
- Runs after the order exists, so it sees the full order payload
🚨 Cons:
- Shopify Plus only
- The order is created first. You cancel and refund it, which means a cancellation email and a restock
- Limited to conditions you wire up by hand, and every change means editing the workflow
- Matching on a customer tag fails against guest checkout under a new email
Verdict: Fine if you are already on Plus and comfortable maintaining workflows.
Method 5: Automated Blocking Rules (Any Plan)
A fraud prevention app like FraudFalcon watches every incoming order and applies your rules instantly. No Plus plan, no Shopify Payments requirement.
The difference from the native options is the number of signals you can match on. FraudFalcon rules cover around 44 fields across seven groups:
| Group | Examples |
|---|---|
Customer | Email, phone, name, order count, past chargeback count |
Billing address | Street, city, postal code, country, company, phone |
Shipping address | Street, city, postal code, country, company, phone |
Order | Order total, item quantity, IP address |
Risk assessment | Shopify risk level, billing vs shipping mismatch, Shopify Protect eligibility |
Cross-customer | Same name used by other customer accounts |
Email quality | Disposable email domain check |
Conditions combine with contains, exact match, greater than, any of, not any of, and time windows from 24 hours to all time.
Actions you can attach: cancel the order, tag it, hold fulfillment, send yourself a notification, send an email, or explicitly allow it.
Blocking at checkout: FraudFalcon also blocks at checkout, before the order is created, on any payment processor. The checkout-time condition set is smaller than the order-time set, since less data exists that early: email, whether the customer is authenticated, their order count, shipping country, order total, and item quantity.
How to block a customer in practice:
- Open the fraudulent order in your Shopify admin
- Click More actions → Create FraudFalcon Rule. The customer's email, name, and address arrive pre-filled as conditions
- Choose the action: cancel automatically, hold fulfillment, or tag for review
- Activate the rule
From that moment, any order matching those details is handled automatically, even from a guest checkout under a new email. Our guide to creating a fraud rule from an order walks through it in detail.
✅ Pros:
- Works on every plan and every payment processor
- Matches the signals native tools cannot see, including chargeback history and disposable emails
- Blocks at checkout or cancels after the order, your choice
- Rules are built from a real order, so setup takes seconds
🚨 Cons:
- A paid app
- Broad rules cause false positives, so start narrow
Comparing Your Options
| Account delete | Manual tags | Fraud Control | Shopify Flow | Fraud app | |
|---|---|---|---|---|---|
Cost | Free | Free | Free | Free | Paid |
Plan needed | Any | Any | Any | Plus only | Any |
Shopify Payments required | No | No | Yes | No | No |
Blocks before the order | No | No | Yes | No | Yes |
Beats guest checkout | No | No | Yes | Partly | Yes |
Signals available | None | Any, by eye | Email, address, IP | Order fields | ~44 fields |
Scales without you | No | No | Yes | Yes | Yes |
How to Block by IP Address
IP blocking is the most requested method and the most oversold.
Fraud Control accepts IP conditions if you use Shopify Payments. Fraud prevention apps match on IP too. Both work.
The problem is the IP itself. Mobile networks rotate addresses constantly. VPNs cost a few dollars a month. Offices, universities, and apartment buildings share one address across hundreds of people. So an IP block misses any fraudster who reconnects, and can shut out a whole building of legitimate shoppers.
Use IP as one condition inside a rule, never as the whole rule. An IP address combined with a postal code, or an IP combined with an order value, is a useful signal. An IP alone is not.
How to Block a Country or Region
Do not do this by blocking customers one at a time.
If you never want orders from a country, remove it from your shipping zones. The country disappears at checkout and no order is created. That is cleaner than accepting the order and cancelling it later.
If you want to accept some orders from a country but review them, set the shipping or billing country as a rule condition and attach a hold or tag action instead of a cancel. You keep the revenue and add a checkpoint.
Blocking whole countries out of frustration costs more revenue than it saves. Fraud rates vary far more by order pattern than by border.
What Happens After You Block
With Fraud Control: the buyer sees a generic checkout error and is told to contact the store. Nothing reaches your orders. The attempt appears in abandoned checkouts, which is where you go to confirm the rule fired.
With a cancel action after the order: the customer completes checkout normally, then gets a cancellation. Cancel with the reason Fraudulent and refund in full. Refunding fast matters. An unrefunded cancellation is the fastest way to turn a blocked order into a chargeback, and a chargeback costs more than the order ever would.
With a hold or tag action: nothing visible happens to the customer. You review and decide.
Whichever you choose, keep a note on the customer record explaining why. You will need it if they contact support, and you will want it if a pattern needs proving later.
Avoiding False Positives
Every block is a bet. Blocking a real customer costs you the order and the relationship.
- Start narrow. One person's exact email and exact address. Widen only after you see the pattern repeat
- Prefer hold over cancel while you are learning what your rules catch. A held order is reversible. A cancelled one is awkward
- Check the rule log weekly. If a rule is firing far more than expected, it is too broad
- Never block on a single weak signal. A high Shopify risk score alone is a reason to look, not a reason to cancel
- Watch for shared addresses. Apartment buildings, offices, and freight forwarders produce repeat addresses that look like fraud and are not
Our post on Shopify fraud analysis covers how to read the risk signals before you act on them.
Legal and Compliance Notes
You can refuse service. Blocking a specific person for fraud, abuse, or policy violations is normal retail practice and Shopify permits it.
Three limits are worth knowing:
Do not block on protected characteristics. Race, religion, nationality, gender, and disability are not fraud signals. Blocking a country is a business decision about shipping and risk. Blocking people because of where they appear to be from is not the same thing, and it is not defensible.
Document your reason. A short factual note on the customer record: "three chargebacks, all claimed non-delivery, tracking shows delivered." Facts, not opinions about the person.
Handle their data properly. A blocked customer still has GDPR and CCPA rights. If they request deletion, you must comply, even though deleting the record weakens your block. This is a good reason to build rules on order signals rather than on the customer record alone.
What It Costs to Do Nothing
Repeat fraudsters do not stop on their own. One unblocked serial abuser produces the lost goods, the shipping cost, a chargeback fee per dispute, and staff time on every case.
Above a certain dispute ratio your payment processor takes an interest, and remediation is far more expensive than a blocking rule. Our guide to Shopify chargeback protection covers what happens at that point.
Frequently Asked Questions
Can you block a customer on Shopify? Not directly. Shopify has no block button on a customer profile. You can block their checkouts using Fraud Control rules if you use Shopify Payments, cancel their orders automatically with Shopify Flow on Plus, or use a fraud prevention app on any plan. Disabling their account does not stop them, because they can check out as a guest.
Does disabling a customer account stop their orders? No. Disabling or deleting an account only prevents that person from logging in. They can check out as a guest with the same email, or a new one. Blocking really means detecting their orders by stable signals such as email, name, address, phone, and IP, then stopping those orders before you fulfill them.
Does Shopify still have the Fraud Filter app? No. Shopify retired the Fraud Filter app on 31 January 2025. Its blocklist logic moved to Fraud Control checkout rules for pre-order blocking, and to Shopify Flow for post-order automation. Many merchants lost their old Fraud Filter blocklists in the migration, because Flow could not import all of the data.
Can I block an IP address on Shopify? Yes, with limits. Fraud Control checkout rules accept IP address conditions if you use Shopify Payments, and most fraud prevention apps match on IP too. Do not rely on IP alone. VPNs, mobile networks, and shared connections make IP addresses unstable, so you will miss real fraudsters and block innocent shoppers.
How do I block a customer from a specific country on Shopify? Set the country as a rule condition rather than blocking the customer. Fraud Control accepts address attributes, and fraud prevention apps let you match on shipping or billing country. A cleaner option for whole markets is to turn off shipping to that country in your shipping zones, which removes it at checkout instead of failing the order later.
What does a blocked customer see at checkout? With Fraud Control, the buyer sees a generic error saying the checkout could not be completed, with a note to contact the store. The blocked checkout appears in your abandoned checkouts. If you block after the order is created instead, the customer completes checkout normally and later receives a cancellation and refund.
Can I block a customer without Shopify Payments? Yes, but not with Fraud Control checkout rules, which require Shopify Payments as your processor. On any plan and any processor you can use a fraud prevention app to cancel, hold, or tag matching orders automatically. On Shopify Plus you can also build a Flow automation.
Is it legal to block a customer? Generally yes. A merchant can refuse service, and blocking a specific person for fraud, abuse, or policy violations is normal practice. Do not block on protected characteristics such as race, religion, or nationality. Record why you blocked each customer, keep the reason factual, and handle their personal data under GDPR or CCPA the same way you handle any customer record.
🎯 Key Takeaways
- ✓ Shopify has no block button. Deleting a customer account stops nothing, because guest checkout is still open
- ✓ Fraud Filter was retired on 31 January 2025. If a guide recommends it, that guide is out of date
- ✓ Fraud Control checkout rules are the best free option, but they need Shopify Payments and only see email, address, and IP
- ✓ Shopify Flow works on Plus only, and cancels after the order is already created
- ✓ Automated rules on any plan match the signals the native tools cannot see, including chargeback history and disposable emails
- ✓ Block on several signals at once, so a new email address does not defeat the rule
- ✓ Start narrow, prefer hold over cancel while you learn, and refund fast when you do cancel
Ready to stop repeat offenders automatically? See how to block fraudulent orders on Shopify for the full workflow.