Most order protection works after the fact. The order is placed, a rule flags it, and someone cancels or refunds it. That still costs you: payment processing fees, inventory held for the wrong buyer, and time spent on manual review.
Validating the cart
Shopify lets an app run a validation function while the customer is checking out. If the function returns an error, the checkout stops with a message and no order is created.
That makes it a good place to enforce a blocklist. If an email domain, phone number, or name is one you have blocked, the customer is stopped before payment. There is no order to cancel and no refund to issue.
Why verification matters
The request that reaches your app has to be trusted. A production setup verifies the signed request before acting on it, so a forged call cannot block real customers or let bad ones through.
Use it for repeat problems
Checkout validation works best for known, repeated abuse. It is not a replacement for scoring behavior, which catches new attackers. Use both: behavioral detection for the unknown and blocklists for the known.
A note on rollout
A checkout block affects real customers, so test it on your own store first and confirm your blocklist entries are what you intend. Skyfense’s checkout block ships as part of its order protection, which is in beta.