Build or Buy a Customer Blocklist on Shopify?
Customer blocklist and repeat-offender management is a CUSTOMIZE on Shopify. Shopify scores each order for risk and never remembers the person, so blocking is an app job: Chargeback Blacklist runs $29 to $149/month and MIDA is free to install (verified Sep 2026). Build the part the apps skip. Deciding who belongs on the list, matching a new email to an old offender, and giving a wrongly blocked customer a way back.
Your profile — see how the verdict shifts
- Confidence
- High — Shopify's own customer and order fraud documentation describes no persistent customer blocklist. Shopify scores individual order risk, and Shopify Protect covers only fraud-based chargebacks on eligible Shop Pay transactions in US stores, which leaves the repeat offender untouched at the next checkout. Two listings were verified on the App Store. Chargeback Blacklist is the purest fit, blocking checkout by email, phone, name, address, customer account or tag and syncing past chargebacks into rules, but it carries just 9 reviews. MIDA Fraud Filter is far larger at 4.9★ across 329 reviews and lists blocklists plus rules blocking by email, phone, name, zip code and country, though blocklisting sits inside a broader real-time IP and bot tool rather than being the product. Neither app decides who deserves a block, and neither resolves a new email to an old offender.
- Reference scenario
- $20M–$100M GMV · apparel or electronics · 150,000–300,000 orders a year · measurable return abuse and chargeback abuse · one fraud and disputes owner
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Under 10 blocked customers a year | BUY | The free tier is the whole answer: 10 blocking rules, 30-day chargeback history sync and 15 blocked checkouts a month (Chargeback Blacklist, verified Sep 2026). Write two paragraphs of policy and move on. |
| 10 – 100 blocked customers a year | BUY | Essential at $29/month or Professional at $79/month covers the volume (verified Sep 2026). The only thing to add is a written rule for who goes on the list and who can take them off. |
| Systematic abuse: serial returners, wardrobing, delivery claims | CUSTOMIZE | Chargebacks are the only abuse type these apps detect on their own. Return abuse and delivery-claim abuse need detection you build, scored per customer across order history rather than per transaction. |
| High-risk category with abuse as a standing cost line | BUILD | Own the offender graph and the decision record. Identity resolution beyond exact-match email, a graduated response short of a full block, and an appeal path are all beyond what any listing offers. |
What Customer blocklist and repeat-offender management Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Operational efficiency | High | A blocked checkout is an order never picked, packed, shipped, refunded or disputed, which removes five downstream tasks rather than one. |
| Revenue — indirect | Medium | Each prevented abusive order protects the margin, outbound shipping and return freight that a refund never gives back, so the value shows up in cost avoided rather than sales made. |
| Customer experience | Medium | A rule matching on name or address catches households and apartment buildings, and a wrongly blocked shopper hits a dead end at checkout with nobody to appeal to. |
| Data & insight | Medium | An offender record with reason codes shows which products, price points and shipping lanes attract abuse, which is a merchandising signal as much as a fraud one. |
Spend ceiling: Size the spend to abuse actually measured, not to abuse suspected. Multiply abusive orders a year by lost margin plus outbound and return freight plus chargeback fees. For most mid-market catalogs that lands in the tens of thousands annually, which comfortably justifies detection work and never justifies an expensive subscription.
What buying enables (top apps)
- + Persistent blocking at checkout by email, phone, name, address, customer account or customer tag
- + Chargeback history sync that turns proven past offenders into rules without anyone entering them by hand
- + A community-sourced cross-store blocklist on higher tiers, for merchants who want other stores' signals
- + Real-time IP, country and bot blocking bundled in the same install on the larger listing
What building additionally unlocks
- + Detection across return abuse and delivery-claim abuse, not only chargebacks, scored per customer over rolling windows
- + Identity matching on normalized address, phone and payment signals, so a new email does not reset an offender's record
- + A decision record with evidence, reviewer, duration and appeal outcome, which is what defends a block months later
- + Graduated responses short of a block: require prepayment, disable free returns, or hold for manual review
Find Your Verdict in 3 Questions
Do you block more than a handful of customers a year?
Yes: Go to question 2.
No: Your verdict: BUY — the free tier covers 15 blocked checkouts a month, and a short written policy covers the rest (verified Sep 2026).
Is return abuse or repeat delivery-claim abuse costing you as much as chargebacks?
Yes: Go to question 3.
No: Your verdict: BUY — chargeback history sync turns past offenders into rules automatically, which is the case these apps handle on their own.
Have blocked customers come back successfully under a new email or a slightly different address?
Yes: Your verdict: CUSTOMIZE — build detection and identity matching above the app's rules for $15,000–$40,000 (Deploi estimate, illustrative).
No: Your verdict: CUSTOMIZE — start with the written policy and the decision record; add identity matching when the first repeat offender slips through.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | Blocking rules configure in an afternoon; detection, identity resolution and a decision record run an estimated $15,000–$40,000 depending on how far identity matching goes (Deploi estimate, illustrative). | ||
| Recurring fees | Chargeback Blacklist tops out at $149/month on Enterprise and MIDA installs free (verified Sep 2026), so the subscription is never the deciding number on this page. | ||
| Maintenance & upgrades | The vendor maintains the checkout block; detection thresholds drift as abuse patterns change, so the rules need a quarterly review by whoever owns disputes. | ||
| Switching & exit | A blocklist held in an app leaves with the app, and rebuilding it means re-deciding every entry without the evidence that justified it. | ||
| Risk | |||
| Vendor risk | The purest-fit listing carries 9 reviews while the larger option treats blocklisting as one feature among many, so neither is a comfortable sole dependency. | ||
| Security & compliance surface | Blocking named individuals is a legal act with consumer-protection and discrimination exposure, and a documented policy with an appeal path is the control that matters. | ||
| Platform-deprecation exposure | Checkout blocking depends on Shopify's validation surfaces in both lanes, and those are current sanctioned APIs rather than legacy scripts. | ||
| Value | |||
| Fit to requirement | Apps fit the blocking mechanism exactly and fit the judgment not at all, which is the half of this capability that actually costs money when it goes wrong. | ||
| Time to market | Rules are live today; detection and identity resolution take an estimated 4–8 weeks before the first scored list is trustworthy (Deploi estimate, illustrative). | ||
| Performance & scale | Exact-match rules scale fine at a few hundred entries; catching the same person on a new email needs matching logic that only exists if you build it. | ||
| Data ownership & AI-readiness | An offender record with evidence, decision date and reviewer is what defends a block later, and a vendor's rule list holds none of that context. | ||
| Focus & opportunity cost | Nobody should build checkout blocking, and the detection work competes with the fulfillment fixes that would reduce claims at the source. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Shopify order fraud analysis | Native — First-party. Shopify scores each order for risk and surfaces the indicators behind that score, and Shopify Protect covers fraud-based chargebacks on eligible Shop Pay transactions for US stores using Shopify Payments, with fulfillment and tracking required within seven days. Protect explicitly excludes non-delivery, defect, damage and misrepresentation disputes. Nothing here is a blocklist: Shopify evaluates the order in front of it and does not remember the person who placed the last one. | Included with Shopify; Shopify Protect is free where eligible | Per-order risk scoring, which is a different job from stopping a known repeat offender at checkout |
| Chargeback Blacklist | Live — flagged — 5.0★, 9 reviews; Built for Shopify; 14-day trial on paid plans. Thin install base for a purpose-built app, and worth weighing before you route your enforcement through it. Blocks checkout by email, phone, name, address, customer account or customer tag, and syncs past chargebacks so previous offenders become rules automatically. Higher tiers add a community-sourced cross-store blocklist. | Free tier: 10 blocking rules, 30-day chargeback history sync, 15 blocked checkouts/month; Essential $29/month ($290/year); Professional $79/month ($790/year); Enterprise $149/month ($1,490/year) (verified Sep 2026) | The purest fit on the App Store: a persistent blocklist tied to chargeback history rather than a bot filter |
| MIDA Fraud Filter, Bot Blocker | Live — 4.9★, 329 reviews; Built for Shopify; free to install. Lists blocklists as a feature and advanced fraud rules that block by email, phone, name, zip code and country, so the persistent-list capability is real. Read the fit honestly: blocklisting sits inside a broader real-time IP, country and bot blocking tool rather than being the product, and the listing does not itemize paid tiers beyond free to install. | Free to install; paid tiers not listed on the current listing | Merchants who want IP, country and bot blocking anyway and will take the blocklist as part of the same install |
| Offender policy, detection and identity resolution (custom) | Build lane — The judgment layer. Detection across chargebacks, return abuse and delivery claims scored per customer; identity matching on normalized address, phone and payment signals so a fresh email does not reset the record; and a decision record holding evidence, reviewer, block duration and appeal outcome. Feeds the app's rules rather than replacing them. | $15,000–$40,000 one-time (Deploi estimate, illustrative) | Merchants where abuse is a standing cost line and a wrong block costs a real customer |
The Build Path
- Write the policy before the rule: Name the behavior that qualifies, the evidence required, the person who decides, how long a block lasts and how someone appeals. Blocking a named individual is a legal act, and a list assembled ad hoc by whoever was annoyed that week is the version that produces a complaint you cannot defend.
- Detection across all three abuse types: Chargebacks are the only type an app detects for you. Return abuse shows up as return rate by customer against category norms, and delivery-claim abuse shows up as repeat item-not-received claims across carriers and addresses. Score all three per customer over rolling windows, then send only the confirmed cases to the block rules.
- Identity resolution and graduated response: Normalize addresses, match on phone and payment signals, and flag near-matches for review so a new email does not reset an offender's record. Then give yourself something between allowing and blocking: require prepayment, disable free returns, or hold for manual review. A full block is the blunt end of a range most merchants never build.
- Effort band
- $15,000–$40,000 build — Deploi estimate (illustrative); lands in the $10–25K contact-form band for policy and detection, and the $25–75K band once identity resolution is in scope
- Typical timeline
- 4–8 weeks for policy, detection scoring and the decision record; add 3–4 weeks for identity matching and graduated enforcement (Deploi estimate, illustrative)
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $2,500–$8,000/yr (Deploi estimate, illustrative) to retune detection thresholds as abuse patterns shift, review false positives, and keep the policy current with legal. There is no subscription line beyond the blocking app itself.
- What you own — and what you take on
- You own: the policy, the evidence, the offender graph and every decision on it. You take on: the false-positive review queue, which is real ongoing work, and the responsibility that comes with refusing to sell to a named person.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $0–$500 | $15,000–$40,000 |
| Years 1–3 (recurring) | $1,000–$5,400 (plan tiers) | $7,500–$24,000 (threshold tuning and review) |
| 3-year total | ≈$1,000–$5,900 | ≈$22,500–$64,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Buy column: Chargeback Blacklist at Professional $79/month rising to Enterprise $149/month (verified Sep 2026); MIDA installs free and does not itemize paid tiers.
- † Build column: policy, detection scoring across three abuse types, the decision record and identity matching, with the blocking app running in both columns. Three-year horizon.
What the Sticker Price Hides
On the buy path
- — The purest-fit listing carries 9 reviews (verified Sep 2026), which is a thin base for a tool that decides who can buy from you
- — MIDA does not itemize paid tiers on its listing, so the cost past free to install is unknown until you ask
- — Rules that match on name or address catch households, apartment buildings and workplaces, and the false positive is a real customer who never tells you
- — A community-sourced cross-store blocklist means enforcing another merchant's evidence against your customer, which is a policy decision rather than a feature toggle
On the build path
- — Address normalization is genuinely messy work, and over-matching creates the exact false positives the app rules already produce
- — Refusing to sell to a named person carries consumer-protection and discrimination exposure, so legal signs the policy before engineering writes the rule
- — A blocklist with no appeal path becomes a support queue, and support will quietly start overriding it
- — ~$2,500–$8,000/yr upkeep (Deploi estimate, illustrative) for threshold tuning and false-positive review
What Merchants Say
Disputes owners describe the same loop: the same address orders again under a new email, the block rule matched on email only, and the second chargeback arrives before anyone connects the two orders.
The recurring theme in blocking-app reviews is false positives: a household member or an apartment building gets caught by a name or address rule, and a genuine customer discovers it at checkout with no way to appeal.
If You Change Your Mind Later
If you bought and outgrow it
A blocklist held inside an app is a list of strings with no evidence attached, so export it before uninstalling and expect to re-justify every entry in the next tool. The chargeback history the app synced stays with your processor, which is the part that survives. Check export format during the trial rather than at cancellation.
If you built and want out
Nothing strands. The offender records, evidence and decisions live in your own data with a reviewer and a date attached, and they feed whichever blocking app you run. Change vendors and you re-import a list you can still defend, which is the difference between an offender graph and a rule list.
When This Answer Changes
We're watching for:
- ▸ Shopify shipping a persistent first-party customer blocklist, since as of September 2026 order risk scoring is per order and remembers nobody
- ▸ MIDA publishing itemized paid tiers, since only the free install price is listed today
- ▸ Chargeback Blacklist accumulating review depth beyond its current 9 reviews, which would make the purest-fit option a safer dependency
Verdict change log:
No changes since first publication (September 2026).
Common Questions
Does Shopify have a native customer blocklist?
No. Shopify scores each order for risk and surfaces the indicators behind that score, and Shopify Protect covers fraud-based chargebacks on eligible Shop Pay transactions for US stores only. Neither remembers a person across future orders. Blocking a known bad actor at checkout requires an app, a checkout validation function, or both, which is exactly the gap this small app category fills.
What does a Shopify blocklist app cost?
Chargeback Blacklist offers a free tier with 10 blocking rules, 30-day chargeback history sync and 15 blocked checkouts a month, then Essential at $29/month, Professional at $79/month and Enterprise at $149/month (verified Sep 2026). MIDA Fraud Filter is free to install and does not itemize paid tiers on its listing. Subscription cost is never the deciding factor here.
Why is blocking by email alone not enough?
Blocking by email stops 1 account, not 1 person. A repeat offender re-orders from a new address on a new email, and an exact-match rule never connects the two. Catching that needs normalized address matching, phone and payment signals, and a review queue for near-matches. Building that identity layer costs an estimated $15,000–$40,000 (Deploi estimate, illustrative).
Your Next Steps
If you're going with CUSTOMIZE(matches your selected profile)
- Write the policy first: qualifying behavior, evidence required, decision owner, block duration, appeal route
- Install a blocking app and start with chargeback history, since those cases are already proven
- Score return abuse and delivery-claim abuse per customer over rolling windows before adding either to the rules
- Add identity matching on normalized address and phone, with near-matches sent to review rather than blocked
- Track false positives explicitly, because a wrongly blocked customer never files a complaint, they just leave
If you're going with BUY
- Start on the free tier and confirm the blocked-checkout cap against your actual volume
- Turn on chargeback history sync so past offenders become rules without manual entry
- Avoid name-only and address-only rules until you have a review step for near-matches
- Decide deliberately whether to act on a community-sourced cross-store blocklist, since that is somebody else's evidence
- Export the list quarterly, because a blocklist stored only in an app is one uninstall from gone
Official Docs & Sources
- Order fraud analysis (Shopify) — Shopify Help Center
- Customer segmentation (Shopify) — Shopify Help Center
- Shopify Flow — Shopify Help Center
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Build or Buy Accessibility Regression Monitoring on Shopify?
AudioEye's Shopify listing is delisted and UserWay sits at 2.6★ on 10 reviews, so catching a theme-update regression is a pipeline job.
Build or Buy ADA Litigation Exposure Management on Shopify?
Shopify tests Dawn, Checkout and Admin, not your storefront. A widget is not the answer to a demand letter; a code-level audit, remediation and a dated log are.
Build or Buy a Checkout Terms Consent Checkbox on Shopify?
Shopify ships no native terms-of-service consent checkbox at checkout, so this is one of the few decisions here that is a clean, cheap buy.
Build or Buy Counterfeit and Impersonation Monitoring on Shopify?
One Shopify app scans for copycat stores (StoreLock, 9 reviews); Red Points is quote-only. Neither enforces. Build the evidence ledger, intake and seller directory.
Shopify Theme Sections: Buy Premium or Build a Section Library?
A custom theme section library wins at mid-market campaign tempo; below the floor, a premium theme is the right call.
Ready to block the person, not just the email?
Buy the blocking rules; they cost almost nothing. Then let us build the layer that makes them worth having: detection across returns, chargebacks and delivery claims, identity matching that survives a new email, and a decision record you could defend to a lawyer.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.