thread Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions in Online Store

Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

KIB2014 — Sat, 22 Aug 2026 00:56:45 GMT

Square Online is getting hammered by bots, Blocking cards, emails & IPs isn’t working;

I've been using Square for over 10 years, and I’m seriously considering other alternatives because of a problem I can’t seem to get anyone at Square to actually address.

Our Square Online ordering system is being repeatedly hit with what appears to be automated/bot activity. They’re making frivolous order attempts that are clogging up our online ordering system and creating a headache for our staff.

The weird part is that Square is often blocking the payments, so the fraud system is clearly recognizing the activity as suspicious. But the bots are still getting through to the online ordering system and repeatedly generating order attempts.

I’ve gone through Square Support, Risk Management, Square Online, back to Square Support.

Today alone, I spent well over an hour on chat with Square Support and was transferred multiple times. I kept getting passed from one department to another, only to end up back where I started.

* I was also informed that I am not the only Square user being affected by this issue.*

I’ve created around 11 Risk Manager rules.

I’ve tried blocking:

Credit card numbers
Email addresses
IP addresses

It has not helped in the slightest. The activity keeps coming.

I contacted KDS too. They told me there isn’t anything they can do from their side other than us turning off online ordering. Their engineers were going to contact Square about it.

Turning off online ordering isn’t a solution for a restaurant.

What I’m trying to figure out is whether this is a Square-specific problem or a common problem with restaurant online ordering platforms.

Has anyone else dealt with bots repeatedly hitting their Square Online ordering page?

If you have, were you ever able to get Square to actually stop the bot traffic?

I’m particularly interested in whether anyone has found a solution involving bot protection, CAPTCHA, rate limiting, device fingerprinting, IP blocking, or anything that actually prevents the automated requests from reaching checkout.

At this point, blocking individual cards, emails and IP addresses isn’t doing anything.

I’ve been loyal to Square for over 10 years, but I’m now seriously looking at other POS/online ordering systems because I can’t keep spending time fighting this problem while being bounced between Square departments. I'm told there is nothing they or I can do aside from creating rules through risk management. The CS at Square isn't what it used to be.

I’d really appreciate hearing from other restaurant owners who have dealt with this.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

MapleStreet510 — Sun, 23 Aug 2026 23:31:43 GMT

We're getting it bad too. They're all using the phone number 734-555-0100 and so far 338 different email addresses with the same number. 2 accounts have successfully made small fraudulent purchases that I had to refund. There's no way to block by phone number and there's no point in blocking by IP because they can use VPN's to mask their real IP address. We just had to turn off our abandoned cart automated email campaign and void every single coupon they generated with abandoned carts. I'm hoping maybe that is why they're making so many bot accounts, I don't really understand but Square in general does not have enough security on the customer facing side. Bare minimum there should be 2 factor authentication for anyone who creates accounts or signs up for your marketing lists, but Square does not provide that - which is probably even illegal and it's crazy it hasn't been implemented by this point in 2026.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

parcels — Tue, 25 Aug 2026 21:50:05 GMT

Just noticed the same issue when sending out an email marketing campaign. 800+ new emails within few days with the same 734-555-0100 number. Have not received fraudulent orders (retail business). How would people check to see if they are trying to hit online ordering?

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

KIB2014 — Tue, 25 Aug 2026 22:05:51 GMT

For the online orders, from your dashboard select Payments > Risk Manager > Blocked Payments. Mine were showing up on my screen, clogging traffic for online ordering and it made it dufficult to find the actual orders. I've shut off online ordering since Friday evening, even then 2 orders still slipped through afterwards. Square still hasn't gotten back to me, no solution yet.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

KIB2014 — Tue, 25 Aug 2026 22:08:00 GMT

I agree, this is ridiculous. The 2 factor authentication should be set up. Still no resolution.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

parcels — Tue, 25 Aug 2026 22:37:20 GMT

Thank you. Please keep us updated as you learn more information. Appreciate finding this in the forum.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

KIB2014 — Fri, 28 Aug 2026 20:02:10 GMT

Update 08/28/26: I contacted Square August 20th and 21st. I received an email on the 24th

"I’ve escalated your case up to our Square Online support team."

Still no response or resolution. Sent another message today.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

CakeLoft — Tue, 01 Sep 2026 11:58:44 GMT

I’m so glad I found this thread, as I got an order like this overnight. I don’t even have items listed on my site for preorder currently, and I’ve spent over an hour trying to find WHERE they found the item to even place the order.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

KIB2014 — Fri, 04 Sep 2026 18:40:18 GMT

I received a message the issue is being worked on yesterday. I turned online ordering on Wednesday evening after listing the minimum order to $10. They made one order yesterday and 1623 orders this morning of 11 sides of sauce, so it would be over $10. I've set 20 rules in risk management, 20 is the limit. The orders are blocked but still coming through on my ordering screen. Some showing as approved but no payment was processed. Also, the orders had to be removed one by one. I'm paying for a service I'm unable to use.

09/04/2026

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

BlueBellaDonna — Mon, 07 Sep 2026 21:38:40 GMT

I've had over 1,000 credit card transactions blocked, some by bank, some by Square, and over 1,000 abandoned cart emails sent out since the beginning of August. All with the 734-555-0100 phone number, but different names and email addresses. I've had my website on hiatus since June, there's no products currently in my store, where these scammers are getting things to "add to cart" or attempt to make a payment transaction is beyond me. I have a landing page up telling my customers I'm on a break. The first notice I got of this, I removed my "sign-up for my newsletter" subscription form, and deleted all the fake accounts. Today I receive another notice and logged in to report this issue. That's when I found this thread. I just deactivated my abandoned cart emails, and deleted all the fake accounts again... because they all got added to my newsletter customer list automatically. This is ridiculous. If I get any resolution from Square, or I can figure something out on my own, I'll come back to let you all know. Good luck, I hope this gets resolved for all of us SOON!

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

JoeTend — Sat, 26 Sep 2026 17:53:56 GMT

We had the bot attack in Spring, hitting us with thousands of low value order. Setting up fraud rules did help, but mostly the attacke went away on its own. However, for the least 6-8 weeks, we've been inundated with fake email addresses with creation source "Third Party". We don't have any third party apps connected, so I can't figure out how it is happening. Reading through this trail i see that others have the fraudulent phone number "734-555-0100" entered, and we are seeing that as well.

On Friday 9/125, Square Marketing emailed me to say my email list was filled with fraudulent addresses (I knew this already and Square Support told me not to worry about it. Hmm). "We detected an issue with your Square Marketing account that requires your attention. To protect your reputation and those of other Square Marketing customers, we are required to take immediate action when we detect a sender reputation issue. Rest assured we are here to work with you through this . . . Please respond/action within 72 hours, or we may have to put a temporary block on your Square Marketing Account. As always, our goal is to protect our Square sellers and ensure everyone can continue to send emails without any issues."

When I tried to reply to them, i got an auto reply that the inbox doesn't receive messages. I emailed square support and included the information that was shared with me. The auto reply said i'd get a response within 1-3 business days. Given it's the weekend, i'm confident I won't receive a reply until Monday at the earliest . . . which is more than 72 hours from when the sent me a note saying I need to action this in 72 hours.

Feeling lost and confused by Square (again) on this issue. It's not comforting to see others are having the same issue with no help.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

parcels — Mon, 28 Sep 2026 11:59:38 GMT

Joe - this was the issue we were having. 100's of emails being signed up daily. Discovered it after a marketing email went out. After 2 weeks of back and forth with Square and adding/subtracting items from our website, it was discovered that the root of the issue is at the checkout screen for products there is a 'contact' form that is formatted by Square and cannot be removed. It is a system issue - nothing that can be modified on our end. The basic statement was 'you will need to continue to manually delete these emails.'

I added one more rule into Risk Manager to block any card where the CVV does not match. Since that adjustment I have not had issues with people signing up for email marketing and the number of blocked transactions went from 100's per day to only 1 in the past two weeks.

I have not put back the 'sign up for marketing' on the front page of our website yet. I will do that today and see if the numbers increase again.

Tim

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

JoeTend — Fri, 02 Oct 2026 18:17:50 GMT

As an update here, over the weekend, over 2,000 customers were deleted from our list it seems by Square. Not an issue considering they were all "bad" addresses, but this was done without Square telling us so we were wasting time on our end investigating the list while we awaited a reply from Square.

I keep asking what "third party" is allowing customers to add addresses to our list, and keep being told the same thing - the address could have been "captured through an integration, POS import, online checkout, or another connected app/plugin tied to your Square account, it can be tagged as "third party"

I don't have any integrations, so I'm confused as to what this truly means. I only use Square for POS and Online and have no other forms that I know of. I'd love to know what is going on.

Re: Square Online is getting hammered by bots, Blocking isn't working; Fraudulent Transactions

JoeTend — Fri, 02 Oct 2026 18:18:49 GMT

oh wow! good intel! I just added another comment above but missed this reply. I hope this gets rectified! (now i'm assuming that Square deleted the 2k emails from our list because they found this was an issue on their end)