How to Block a Customer on Shopify: Step-by-Step Guide

Shopify doesn’t include a single “Block Customer” button, but there are several effective methods to prevent specific customers from placing orders — from manual tagging and order cancellation to automated rules with Shopify Flow and third-party fraud prevention apps.

This guide covers all the methods available across Shopify plans, when to use each, and how to implement automated blocking for repeat offenders.

• Chargeback fraud (filing disputes after legitimate delivery)
• Repeat policy abuse (excessive returns, discount stacking)
• Harassment of your support team
• Account hacking attempts or credential stuffing
• Suspicious purchasing patterns (bulk orders from new accounts)

The foundation of any blocking strategy is tagging the customer account. This creates the identifier other methods use to trigger restrictions.

Navigate to Customers and search for the customer you want to restrict.

In the customer profile, find the Tags field and add a descriptive tag likeblocked,fraud, ordo-not-sell. This tag is not visible to the customer.

Use the Notes field to document why the customer was tagged and the date. This creates an audit trail for chargebacks and disputes.

Tagging alone does not prevent orders — you need to combine it with a checkout rule (see Method 3) or manual monitoring.

For orders already placed by problematic customers:

Go to Orders and open the relevant order.

Select the cancellation reason (Fraud is an option). Choose whether to restock items and whether to send a cancellation notification.

Refund in full to avoid chargebacks. Note: for confirmed fraud, consult with your payment processor before refunding — some processors have specific chargeback procedures.

On Shopify Plus, use Shopify Functions to create a checkout validation rule that blocks customers tagged “blocked” from completing their purchase:

// shopify.extension.toml
[[extensions]]
type = "function"
name = "block-tagged-customers"
handle = "block-tagged-customers"

// src/run.js (Checkout Validation Function)
export function run(input) {
  const customer = input.cart.buyerIdentity?.customer;
  const isBlocked = customer?.tags?.includes('blocked');

  if (isBlocked) {
    return {
      errors: [{
        localizedMessage: "We're unable to process this order.",
        target: "$.cart"
      }]
    };
  }
  return { errors: [] };
}

Shopify Flow can automatically tag customers and cancel orders when fraud signals are detected:

• Trigger: Order Created
• Condition: Customer tags contain “fraud” OR order risk level = High
• Actions: Cancel Order → Tag Customer → Send internal email notification

This removes the manual step — high-risk orders are automatically cancelled and customers tagged without staff intervention.

Create block rules based on: email address, phone number, IP address, billing/shipping address, or customer name. Matching orders are automatically cancelled. Works on all Shopify plans.

Dedicated blocking app with a customer blocklist, bulk blocking, and order history scanning. Supports blocking by email, phone, address, and IP. Paid app (~$5–15/month).

Enterprise-grade fraud platforms with machine learning risk scoring. Integrate with Shopify to automatically approve, review, or decline orders based on fraud probability. Best for stores processing 500+ orders/month with significant chargeback rates.

For persistent bad actors accessing your store from a known IP:

1. Add your Shopify store to Cloudflare (free plan works)
2. Go to Security → WAF → IP Access Rules
3. Add the IP with action “Block” and note the reason
4. Optionally use Challenge instead of Block for less certain cases

Note: IP blocking is most effective against bots. Determined humans easily bypass it using VPNs or mobile data. Combine with checkout validation for better coverage.

To prevent a customer from logging into their account (without blocking checkout):

1. Go to Customers → select the customer
2. Click the three-dot menu → “Disable account”
3. The customer can no longer log in but can still checkout as a guest

For full blocking, combine account disabling with the checkout validation method above.