Ever wondered how a Magento 2 project gets 22,000 new customers in 24 hours? It does not. Every one of those accounts was a bot or a spammer.
I keep finding this mess, and not only on small setups. Stores running on managed and cloud Magento hosting have the same problem, because the registration form is open by default and nobody is watching the numbers.
Why fake accounts are not harmless
They poison everything downstream. Your customer count is fiction, your email list fills with dead addresses that wreck deliverability, your database and indexes bloat, and your marketing reporting becomes meaningless. Decisions get made on numbers that describe nobody.
It belongs to the same family of measurement rot as ghost traffic from a data centre and GA4 data that is quietly wrong. If the inputs are fake, the analysis is theatre, which is why I insist on benchmarking against reality before optimising.
How to check
Look at registrations by day and find the spikes. Check whether the email domains repeat or follow a pattern, whether accounts have any orders, and whether creation timestamps cluster unnaturally. A genuine store does not gain thousands of customers overnight without a campaign behind it.
Then close the door: proper bot protection on registration and checkout, rate limiting, and monitoring so the next attempt shows up as an alert rather than a surprise. Bots also drag performance down, which matters when server response time is already your bottleneck.
Clean it up, then keep watching
Purge the fake accounts rather than leaving them to distort your reporting forever, and treat this as ongoing maintenance rather than a one-off, the same way malware needs continuous monitoring rather than a single scan.
If your customer numbers look too good to be true, book a call and we will check whether they are real.