Stop person from creating multiple fake accounts

[TheTeaTable]

Someone is creating a bunch of fake accounts on our site. Can I stop this, or do I just have to keep deleting them? I don't know what the purpose is. It's not carding since there aren't failed transactions. No orders, just a bunch of fake accounts with different email addresses. Could it be to test for valid email addresses? Most seem to be business addresses.

EDIT: to clarify, this is dozens of accounts over the last day or so. Not thousands, and they're spread out over time, so I doubt it's a bot.

[TheTeaTable]

Is there an option for a two step authentication for new accounts in Miva 9? It seems like there should be, but I don't see it.

[William Davis]

This has been brought up before (post "Someone is creating new fake customers accounts"). I've had the same problem before but with affiliate accounts (post "Someone is creating new fake affiliate accounts 1700+"). The problem has now resurfaced.

[Miss Kate]

Are the names & addresses meaningless (just gibberish)? I've had that happen on my website also but it also went along with expired baskets. If you have automatic basket cleanup activated, you won't notice that there are baskets associated with those accounts. For the life of me I can't think of the name of the process which automatically cleans up expired baskets but I have it running on my website. Until you posted above, I hadn't even looked at the customer file to see that these exist. If you don't want them in there, the simplest way to get rid of them is do an export of customers to a csv file and delete from there and then upload a clean file.

[TheTeaTable]

This has been brought up before (post "Someone is creating new fake customers accounts"). I've had the same problem before but with affiliate accounts (post "Someone is creating new fake affiliate accounts 1700+"). The problem has now resurfaced.

That. I'm reading my way through that thread.

I'm not getting a ton of them, like some of the examples. It's been 40 or so in the last 24 hours and I've just been deleting them. I doubt it is a bot. As I stated below, they all have the same name and a business related email address that's usually valid. Then everything else is just the email address copied over and over.

[TheTeaTable]

Are the names & addresses meaningless (just gibberish)? I've had that happen on my website also but it also went along with expired baskets. If you have automatic basket cleanup activated, you won't notice that there are baskets associated with those accounts. For the life of me I can't think of the name of the process which automatically cleans up expired baskets but I have it running on my website. Until you posted above, I hadn't even looked at the customer file to see that these exist. If you don't want them in there, the simplest way to get rid of them is do an export of customers to a csv file and delete from there and then upload a clean file.

It is mostly gibberish, but I don't think that's the problem. Each one has the same name and usually a valid email address at a business. Then everything else (address, phone, etc.) is just the email address copied. I manually clean up my baskets, about once a week.

It's like someone is testing for valid email addresses, but I don't know what the purpose would be.

[TheTeaTable]

Kent Multer , do you have any ideas?

Someone in the other thread had the idea of limiting the number of new accounts to any ip in a day.

[Bruce - PhosphorMedia]

Kent Multer , do you have any ideas?

Someone in the other thread had the idea of limiting the number of new accounts to any ip in a day.

That may or may not work. These accounts are most likely bots. Any decent bot rolls through different IPs. The only real answer is this:

https://www.miva.com/forums/forum/on...accounts/page3

[TheTeaTable]

That may or may not work. These accounts are most likely bots. Any decent bot rolls through different IPs. The only real answer is this:

https://www.miva.com/forums/forum/on...accounts/page3

Thanks Bruce. I'm not going to go to the trouble of something like that for the Miva 9 store, but I might have to look into it for the Miva 10 store, which is being troubleshot at the moment.

[Kent Multer]

If you don't want them in there, the simplest way to get rid of them is do an export of customers to a csv file and delete from there and then upload a clean file.

Hmm, that may not be a good idea. Customer accounts have an ID number which is used internally, and not generally seen on any shopping or admin pages. This number is used in other parts of the store database, such as orders and price groups, to link them to the customer accounts. If you delete an account and re-create it, it will have a different ID number, so the link to these other DB tables will be lost, even if the usrename and other data is all the same as before.

[Kent Multer]

Kent Multer , do you have any ideas?

Someone in the other thread had the idea of limiting the number of new accounts to any ip in a day.

Hi John, I didn't read all of the thread that Bruce referenced, but I see that it mentions ReCAPTCHA, which is just what I was going to suggest. As it happens, I just recently did a ReCAPTCHA setup for another client, to put some security on their Contact-Us page. It's not very difficult. Since I'm already doing some work on your store, we can add this to the to-do list if you want.

[TheTeaTable]

Hi John, I didn't read all of the thread that Bruce referenced, but I see that it mentions ReCAPTCHA, which is just what I was going to suggest. As it happens, I just recently did a ReCAPTCHA setup for another client, to put some security on their Contact-Us page. It's not very difficult. Since I'm already doing some work on your store, we can add this to the to-do list if you want.

Kent, that sounds like a good idea. That will only solve it on the Miva 10 site.

I was thinking of a quick thing to do on the Miva 9 site and I thought I might temporarily remove (comment out) the "New Customers Create Account" link during checkout and change the wording on the "Guest Checkout" part, since the guest checkout has an option to create an account anyway. My thought is that just adds a couple more steps for the spammer, which might be enough of a problem for them to drive them away.

[TheTeaTable]

They're still screwing around on our site, but not causing any real problems. We use live inventory and they're tending to exhaust the stock on some items by putting them in their cart. I want to shorten the time that carts are emptied, but for the life of me, I can't remember where that setting is. Would someone direct me to it?

[Bruce - PhosphorMedia]

Under Store Settings.

Though this is for a site that is being replaced--and what we use is an 'integration', you might get a deal on having it placed on the existing site AND the new site--we recommend using southbound's (southbound.com; i.e. Scott Shepard's) "auto basket" feature. This lets you cut your basket timeout down to levels like 10 minutes or so. Basically, when a basket times out, it saves the basket content locally on the customer's machine. So, if they come back to the site 11 minutes later, the get a popup showing them their last basket and let's them re-create it.

[TheTeaTable]

Under Store Settings.

Though this is for a site that is being replaced--and what we use is an 'integration', you might get a deal on having it placed on the existing site AND the new site--we recommend using southbound's (southbound.com; i.e. Scott Shepard's) "auto basket" feature. This lets you cut your basket timeout down to levels like 10 minutes or so. Basically, when a basket times out, it saves the basket content locally on the customer's machine. So, if they come back to the site 11 minutes later, the get a popup showing them their last basket and let's them re-create it.

Thanks Bruce.