How to Block a Customer on Shopify, and When a Block Isn't Enough
What each way of blocking a Shopify customer really stops, why email and name blocklists miss sanctioned parties, and how to hold future orders for review.
4 min read
Most merchants who want to block a customer on Shopify are dealing with chargebacks, abuse or repeat returns. A blocklist built on emails, names or addresses can work for that. It works poorly for a different reason to stop someone: the person or company is on a sanctions list. Sanctioned parties don't arrive under one fixed email, and the lists change every week. This guide covers what each blocking method stops and where screening has to take over.
What each blocking method stops
On small screens, scroll the table sideways to compare all columns.
| Method | What it stops | When it acts | Easy to get around? |
|---|---|---|---|
| Flow workflow on an email, name or customer tag | The order, by cancelling it | After the order is placed | Yes: a new email or spelling |
| Checkout rules (address format validation) | Shipping addresses that don't meet your format rules | At checkout | Not a person-level block |
| A checkout-blocking app | Checkout for matching customers, emails or addresses (depends on the app) | At checkout | Depends on what the app matches |
| Disabling the customer account | Logged-in access to that account | When they log in | Yes, if guest checkout is open |
| Sanctions screening with a fulfillment hold | Fulfillment, until someone reviews a possible match | After the order is placed, before shipping | Harder: names are compared with aliases and spelling variants |
Shopify's own Flow fraud templates include one that cancels orders from an email address used for past fraud. Shopify notes that fraudsters can easily work around it. In June 2026 Shopify deprecated the Checkout Blocks Address Blocker, with a sunset on 31 August 2026. Its replacement, address format validation under Settings → Checkout → Checkout rules, checks address formats; it is not a list of people.
Why a blocklist isn't sanctions screening
A homemade list of "do not sell" names misses most of what matters:
- A listed company can appear under transliterations, trading names or abbreviations. An exact-match rule on a fictional "Northgate Trading LLC" won't catch "Nortgeit Trade OOO".
