Stop first-order discount abuse on Shopify

The checkout check never looks at the address. It only rejects a welcome code when the buyer's email or phone number has already ordered from your store, so a family member with their own email and phone can use the code at checkout.

After checkout, a shared address does flag the order, because that is how most repeat buyers get caught. A flag is a signal for you to look at: the review page shows the new order next to the earlier one, and you can release the hold or mark the customers as different people so they are not flagged again. Orders that match only on name and zip code are never held automatically, and automatic cancelling is off unless you turn it on.

Only one-way keyed hashes of the normalized email, phone number, shipping address and name with zip code, next to the Shopify order and customer IDs, order number and date. A hash can show that two orders share a phone number, but the number cannot be read back from it.

Names, emails and addresses you see on a flagged order are fetched live from Shopify and not saved. When you uninstall the app, the access token is deleted at once and everything else 48 hours later. The full details are in the privacy policy.

Yes. Checkout blocking runs as a Shopify discount function, which apps from the Shopify App Store can use on any Shopify plan. The order checks, tags and holds use standard order data and also work on every plan.

Auto-detection counts a code when its discount is limited to one use per customer, and also when its name reads like a welcome or first-order code in several languages, such as WELCOME10, BIENVENUE15, WILLKOMMEN or FIRST-ORDER. Codes that look like staff, gift card or wholesale codes are not counted by name.

You can also pick discounts from a list in Settings, or add code names and patterns such as WELCOME*. The free audit lists the most used codes, so you can see which ones should count.

Not if they carry a customer tag you exempt. On Protect and Protect Plus you choose tags such as wholesale, staff or B2B, and customers with those tags are never flagged.

Yes, if they use both a new email and a new phone number. When a discount code is applied, Shopify does not give the discount function the shipping address, so the checkout check works on email and phone only. That is why every order with a welcome code is checked again after it is placed, by address and name with zip code as well, and held for your review when it matches.

The free plan runs the 60-day audit, checks new orders that use a welcome code, and tags up to 25 flagged orders a month with repeatstop:flagged and the reason. Holding orders automatically, checkout blocking, the blocklist and exempt tags start on Protect, which has a 14-day free trial.