Catch fraudulent Shopify signups with email risk scoring

Build an agent workflow that catches fraudulent or low-quality customer signups in my Shopify store before they pollute my customer list.

Trigger: a Shopify webhook for the customers/create event. Each time a new customer is created in my store, the agent runs on that customer's record. If Shopify webhook triggers are not available in this platform, fall back to polling Shopify for new customers on a short interval and process any I have not seen before.

Step 1. Call ZeroBounce Validate Email on the new customer's email address. Capture the status (valid, invalid, catch-all, unknown, spamtrap, abuse, do_not_mail) and the sub_status (especially disposable, toxic, role_based, mailbox_not_found, possible_typo, global_suppression).

Step 2. Call ZeroBounce AI Email Scoring on the same address to get the 0 to 10 engagement-likelihood score.

Step 3. Reason over the combined evidence and assign a risk tier. Use these rules as a starting point, and feel free to combine signals rather than treating each rule in isolation:

High risk: status is invalid, abuse, spamtrap, or do_not_mail; sub_status is disposable; or the AI score is below 3. Also treat toxic and global_suppression as high risk.

Ambiguous: catch-all status with an AI score in the medium band (roughly 3 to 6), or role_based addresses, or possible_typo with a decent score. These look uncertain rather than clearly bad.

Clean: valid status with an AI score of 6 or higher and no concerning sub_status. The workflow should exit silently for these.

Step 4. Act on the risk tier:

For high-risk signups, call Shopify Update Customer to add a risky-email tag (preserving any existing tags), then call Slack Bot Send a Message to post an alert into a fraud-watch channel I will configure. The Slack message should name the customer, list which specific signals tripped the decision (status, sub_status, AI score), explain the likely order risk in plain language (chargeback risk, throwaway address, abuse pattern, etc.), and recommend an action such as hold fulfillment, require manual review, or refund and cancel.

For ambiguous signups, do not tag the customer. Only call Slack Bot Send a Message into the same channel with a softer heads-up that explains why the signal was inconclusive and suggests watching the first order. This keeps the Shopify customer record clean while still giving the team visibility.

For clean signups, do nothing and exit. No Slack message, no tag, no log entry.

Operational notes: keep the Slack alerts concise and scannable, ideally with the customer's name and email as the headline and the signals as a short bulleted list underneath. Never block checkout or refund automatically. The workflow's job is to surface evidence, not to take destructive action. If ZeroBounce returns an error or runs out of credits, skip the customer and alert me in Slack so I can top up rather than failing silently.