The Magento Expert

Blocking recurring fake orders in Magento

Mex — Thu, 01 Oct 2026 07:42:41 +0000

When fake orders become a recurring problem

Does someone keep placing fake orders in your Magento 2 store, perhaps using different email addresses or customer accounts each time?

Apart from the unnecessary work involved, such orders can interfere with your business processes and, in some circumstances, even be used to obtain opportunities for abusive product reviews.

Blocking a single email address often achieves little if the next order arrives with a different one.

But what if you could recognize connections between orders and take action based on what you already know?

Recognizing relationships between orders

Every Magento order contains information that may help identify recurring activity. Customer accounts, email addresses and IP addresses can provide useful clues about relationships between different orders.

Of course, a matching IP address alone doesn’t prove that two orders came from the same person.

That’s why it’s important to distinguish between observed relationships and identities that have actually been confirmed.

Magento already stores the underlying order and customer information. What it doesn’t provide by default is a dedicated layer for preserving confirmed relationships between different customer accounts, email addresses and IP addresses.

This is exactly where Nexus for Magento 2 comes in.

From individual clues to confirmed identities

Nexus makes relationships between orders visible and allows you to connect multiple customer accounts, email addresses and IP addresses to a confirmed identity group.

The important distinction is that Nexus doesn’t automatically decide who belongs together.

You review the available information and decide which relationships should be preserved.

Once an identity group has been confirmed, that knowledge remains available for future orders.

Blocking known identities

Individual customer accounts, email addresses and IP addresses can be blocked using configurable rules.

You can also block an entire confirmed identity group.

If a new order matches an enabled blocking criterion, Nexus can stop the order directly on the server during order placement.

And if you later add another email address, customer account or IP address to an already blocked identity group, that attribute is automatically included in the group’s blocking rules.

This makes it possible to respond to recurring problematic activity without repeatedly starting from scratch.

Assigning guest orders to existing customer accounts

Nexus also provides another useful feature that is independent of order blocking.

You can assign existing guest orders to Magento customer accounts afterwards, even when the email address used for the order differs from the one registered with the customer account.

The order is linked to the selected account while its original email address, billing and shipping addresses, products and prices remain unchanged.

This can be particularly useful when customers place orders with different email addresses or when existing guest orders need to be associated with the correct customer account.

No automatic fraud scoring. No unnecessary guesswork.

I deliberately designed Nexus without an automated fraud scoring system.

A matching IP address, an unusual order or a recurring email address doesn’t automatically mean that someone is acting dishonestly.

Nexus provides the information, makes relationships visible and allows you to enforce the restrictions you consider necessary.

The decisions remain yours.

This approach combines useful technical controls with the experience and judgment of the person managing the store.

Developed for Magento 2

I developed Nexus to address problems that can arise in real Magento projects, particularly when individual blocking rules are no longer sufficient.

The extension works with Magento 2 and is not limited to Hyvä. Its core functionality operates within the Magento administration and on the server side, making it suitable for traditional Magento frontends as well.

Nexus is available through my software brand Vermonta and can be integrated or adapted to individual project requirements where necessary.

Discover Nexus for Magento 2

If recurring fake orders, unclear customer identities or guest order assignments are causing unnecessary work in your Magento store, Nexus may be a useful addition.

You can find more information about its functionality, technical requirements and integration options on the Vermonta product page.

Explore Nexus for Magento 2

Reading a customer attribute

Mex — Sat, 26 Jul 2025 21:18:25 +0000

Want to read a particular customer attribute in Magento 2? Use the following code to retrieve an attribute value for any customer by customer ID:

public function __construct(
    \Magento\Customer\Api\CustomerRepositoryInterface $customerRepository,
    ...
) {
    $this->customerRepository = $customerRepository;
}

$customer = $this->customerRepository->getById($customerId);
$customAttr = $customer->getCustomAttribute('what_ever');
if ($customAttr) {
    echo $customAttr->getValue();
}

Excluding the login page from Google’s index

Mex — Tue, 15 Aug 2023 07:21:49 +0000

By default, the login page /customer/account/login/referer/aHR0cHM6Ly93d3cuc2FuaWRvZS5kZS9jdXN0b21lci9hY2NvdW50L2luZGV4Lw~~/ may be indexed by search engines such as Google. To prevent this, create or override the file customer_account_login.xml in your theme and add the following code:

Redeploy the content, clear the cache and inspect your login page’s HTML source. It should now contain:

Fertig :-)!

Customer grid does not show all customers

Mex — Thu, 01 Jun 2023 06:00:35 +0000

If the customer grid in your Magento 2 admin area shows only some customers or none at all, run the following two commands from your Magento 2 root directory:

php bin/magento indexer:reset customer_grid
php bin/magento indexer:reindex customer_grid

Resetting a customer password using SQL

Mex — Mon, 28 Oct 2019 11:05:27 +0000

Use the following SQL code to reset a customer’s password directly in your Magento 2 database.

SET @passwd='123456789', @salt=MD5(RAND());

UPDATE customer_entity
    SET password_hash = CONCAT(SHA2(CONCAT(@salt, @passwd), 256), ':', @salt, ':1')
    WHERE email = 'test@example.com';

Show address data (like company, name) on registration form

Mex — Fri, 25 Aug 2017 05:47:48 +0000

By default, the Magento 2 registration form does not show address data such as the company, name or street. To change that, simply create customer_account_create.xml in the folder app/design/Your Vendor/Your Theme/Magento_Customer/layout and add the following code:

Now just clear the cache and reload the registration form / page.

Showing address fields during registration

Mex — Mon, 21 Aug 2017 06:59:25 +0000

To request address details during registration, create the file customer_account_create.xml im Verzeichnis app/design/YourVendor/YourTheme/Magento_Customer/layout and insert the following content:

Clear the cache afterwards. Address fields should then appear when registering a new account.

Reading recurring profile data

Mex — Mon, 28 Sep 2015 08:12:05 +0000

Magento stores the recurring profile directly on the customer object. You can read its data using the following code:

    $collection = Mage::getResourceModel('sales/recurring_profile_collection')->addFieldToFilter('customer_id', $customerId);
    $profileData = $collection->getData();
    $profileData = Mage::getModel('sales/recurring_profile')->load($profileData[0]['profile_id']);
    $profileShippingAddress = $profileData->getShippingAddressInfo();
    // ...

User not able to login after version update

Thu, 22 Jan 2015 13:24:01 +0000

If the user is not able to login after a Magento version update, you have most likely overwritten the login.phtml template in your local theme. To fix that problem, open \customer\form\login.phtml in your local theme and add the following code right below the form tags:

getBlockHtml('formkey'); ?>

Users cannot log in after a version update

Mex — Thu, 22 Jan 2015 13:20:59 +0000

If a customer cannot log in after a Magento version update, you may have overridden login.phtml in your theme. Open \customer\form\login.phtml in your theme and insert the following code immediately after the form tags.

getBlockHtml('formkey'); ?>