Can a blocked customer get through with a new email?

Short answer: no, not usually. Changing the email is not enough, because the first blocked checkout also bans the device fingerprint and the IP address behind it. Getting through means changing the details and the browser or device and the network — and still having somewhere to receive the parcel.

What the log actually shows

This is the sequence merchants see in the twenty minutes after a first block:

1. They retry with the same details. They assume checkout is broken. Every attempt is blocked and logged.
2. They change the email. The cheapest fix, and it fails — the browser and network are already banned.
3. They change the name or phone. Same result. Most people stop here and leave.
4. They switch to their phone or a private window. New IP, different device signals. This attempt can succeed — unless they reuse their real shipping address, which is the usual case, because they want the goods.

Replacement cost, field by field

The bottom two rows do the work. Anyone can produce a new email in seconds, but very few will change device, network and delivery address for one store.

What still gets through

Anyone promising a blocklist that cannot be beaten is selling you something.

• A determined attacker with a fresh setup. New device, VPN, new identity, drop address. No checkout-layer tool stops that.
• Organised rings. Many people, devices and addresses. The pattern matters more than any single block.
• A genuinely new fraudster. Their first attempt matches none of your rules, because nothing has happened yet.
• Shared networks. Offices and apartment buildings share IPs, which is why an IP ban is only meaningful next to device signals.

The point is not to be impenetrable. Fraud is a volume business, and someone working through a list of targets does not spend twenty minutes on the store that already refused them twice.

Layers that overlap

Layers only help when they fail in different ways:

• Identity fields — email, phone, name. Cheap to add, easy to evade, catch the lazy majority.
• Physical fields — the shipping address, which they need to receive anything.
• Technical signals — the device fingerprint and IP, banned automatically on the first block. This is what defeats the instant retry.
• Borrowed history — the community blacklist, which covers the person who has not hit you yet, using reports from other stores above a threshold you set.

Four layers, four different failure modes, one session in which to beat all of them.

How to tell it is working

Blocking is quiet by design. The interception log is the evidence: each blocked attempt, the detail that matched, the time, and the estimated value of the order that was never created. A cluster of blocks a few minutes apart on different details is one person retrying and giving up.