I own a Square Developer application (a client-management app for estheticians). Over the past several days, hundreds of customers I did not create keep appearing in my production Customer Directory, and the count climbs by ~60/day. I need help finding what’s creating them.
The fake customers are clearly generated test data:
Reserved fictional phone numbers: US (734) 555-0100 and UK +44 20 7946 0958
Randomly generated emails, e.g. [email protected] (name + random suffix)
Realistic but fake names
Visits: 0, Last visited: Never
creation_source: THIRD_PARTY
What I’ve already checked:
Only one application is authorized on my account (mine)
In my application’s Production API Logs, under the Customers API I see only ListCustomers, RetrieveCustomer, and DeleteCustomer — there are zero CreateCustomer calls across the entire date range. Yet customers keep being created with creation_source: THIRD_PARTY.
I’ve rotated my Production Access Token several times — the customers keep appearing afterward, so it doesn’t appear to be that token.
These are in production, not sandbox. I have only one location.
My questions:
If a customer shows creation_source: THIRD_PARTY, some app called CreateCustomer. How do I find which application ID / access token made those calls, when they don’t appear in my own app’s API Logs?
Why would CreateCustomer calls not appear in my application’s API Logs — does that view exclude Personal/Production Access Token calls, or calls from an authorization I can’t see?
Rotating my Production Access Token repeatedly hasn’t stopped it. What other credential or authorization could still be writing to my Customer Directory, and how do I revoke it?
Is there a way for me to see the complete list of tokens/authorizations that currently have write access to my Customer Directory?
This is my live business account, so the junk data is a real problem. Any help identifying and cutting off the source would be hugely appreciated. Thank you!
Hi @botanicalaesthetics! API Logs in the Developer Console are application-scoped — they only show calls made with tokens belonging to that specific application. If another application (or a different OAuth token) is creating these customers, those calls won’t appear in your app’s logs.
Rotating your PAT would not disconnect any third-party apps that are connected to your merchant account. If you have an app that has OAuth access to your account, it would still be able to create customers in your account without leaving any API logs in your application.
The first thing I would check is your authorized apps: Go to Square Dashboard → Settings → App Integrations → My Applications. Disconnect anything you don’t recognize.
If that doesn’t resolve the issue, please share your App ID and we can conduct further investigation internally.
Thank you — that clears up why the CreateCustomer calls weren’t in my logs.
I’ve already checked Dashboard → Settings → App Integrations → My Applications. The only app listed is my own custom app, SlickChart — and Square won’t let me revoke a custom app I created from that page. There’s nothing else there that I don’t recognize.
Since I can’t find or disconnect the source myself, could you please investigate internally? Specifically:
On my merchant (MLJ6ACV37VWQ0), which application ID / OAuth token is calling CreateCustomer? These are fake/generated records — reserved fictional numbers like (734) 555-0100 and +44 20 7946 0958, randomized emails, 0 visits, ~60 per day.
How do I revoke that application’s OAuth access, given it doesn’t appear in my App Integrations list?
Can you show me all OAuth authorizations currently able to write to my Customer Directory, so I can confirm exactly what has access?
My App ID: sq0idp-kiUnqYIaeYeI3_RCEDptog
This is my live business account, so I really appreciate the help.
Thank you — the detail about API Logs being application-scoped was the key that unlocked this. It led me to several “Solved” community threads describing this exact issue.
It turns out these fake THIRD_PARTY customers are being created by bots spamming a Square website form on my site— specifically my email signup / newsletter subscription form on Square Online — not by my own application. Every fake profile is tagged “Email subscribed” / Email Subscribers, has reserved fictional phone numbers (US 555-0100, UK +44 20 7946 0958), a randomized email, and 0 visits, no bookings, and no charges (my online booking requires a deposit, so no fake bookings came through, and I have no suspicious payments). So this is junk signups, not payment fraud.
Two things I’d appreciate help with:
Locking down the source: what’s the best way to stop bot submissions to my Square Online email signup form — disabling it, adding CAPTCHA, or any spam protection you’d recommend? Can you confirm from your side that these customers are coming from that signup widget and not another application?
Cleaning up the mess: I now have hundreds of these fake customers (grown from ~800 to 910+ in a day), and the dashboard gives me no way to bulk-filter and remove them. Could you help me bulk-delete all customers created in the last ~week matching this pattern — fictional phone numbers (555-0100, +44 20 7946 0958), randomized emails, creation_source: THIRD_PARTY, Email Subscriber, 0 visits? If you can purge them in bulk on your end, or give me a safe filter/query, that would save an enormous amount of manual work.
Thanks again for the pointer in the right direction.
@botanicalaesthetics - As an immediate next step, I recommend temporarily removing or disabling the signup form and monitoring whether new profiles stop appearing. Square Online’s newsletter signup form does not currently provide a CAPTCHA, email-verification, or double-opt-in setting.
For cleanup, the Customers API provides a BulkDeleteCustomers endpoint that deletes up to 100 customer IDs per request. You can use SearchCustomers to identify candidates by creation date, THIRD_PARTY creation source, phone number, and Email Subscribers group membership, then perform any additional validation in your script before submitting the IDs in batches.
Please carefully review the candidate list first. Customer deletion is permanent and can affect related Square records, so I would not delete profiles based only on their creation source or date. If new profiles continue after the newsletter forms are removed, please let us know so the source can be investigated further.