How to effectively prevent and block spam tickets received from anonymous users

<zd-summary-block><p>An open Zendesk environment allowing anyone to submit tickets can lead to unwanted or spam requests, as abuse actors may exploit it to send relay spam via the Submit a request form or API. To block this, disable the "Anybody can submit tickets" option in Admin Center, restricting ticket submissions to verified users. If anonymous submissions are necessary, remove placeholders like {{ticket.title}} from first-reply triggers to stop spam relays.</p></zd-summary-block><p>An open Zendesk environment, where anyone can submit a request can also open the gates for unwanted tickets to be created against your account.</p><p>Open means that everyone can access your help center and submit support requests. Some customers choose this configuration if they sell products and provide support to the general public. This option allows for any type of support requests to be created and for new user accounts to be created in your Zendesk. More details on user access can be found, <a href="https://support.zendesk.com/hc/en-us/articles/4408887573274-Understanding-options-for-end-user-access-and-sign-in" target="_blank" rel="noopener noreferrer">here</a>.</p><p>However, having an open Zendesk implies that anyone can submit any types of requests, that could not be relevant to the customer's business case and use an email address of their choice to create these tickets, without the need of undergoing a proper verification process. </p><p>Abuse actors can take advantage of your account to send out messages to third party email addresses, who are not your customers by using the <em><strong>Submit a request</strong></em> form on your Help Center:<br><img style="aspect-ratio: 1434/1856; width: 50%;" class="wysiwyg-image-resized" src="https://support.zendesk.com/hc/article_attachments/9835766480922" width="1434" height="1856"></p><p>Once a ticket is submitted, the message details, such as the <strong>Title</strong> and <strong>Description</strong> can be relayed to the third party email address because of the outgoing notifications from your <a href="https://support.zendesk.com/hc/en-us/articles/4408832828186#h_667502120121539295305407"><strong>first-reply triggers</strong></a><strong>.</strong></p><p>Even if your Help Center requires sign-in (by enabling the option from the screenshot below), or the Submit a request page was adjusted and the ticket form removed, this will not hinder the anonymous request creation process. <br><img src="https://support.zendesk.com/hc/article_attachments/9839708765082" width="3010" height="938"></p><p>As long as your account allows <strong>anyone to submit tickets, </strong>abuse actors can make use of <a href="https://developer.zendesk.com/api-reference/ticketing/tickets/ticket-requests/#create-request">the following API endpoint</a>: <code>api/v2/requests</code> to create multiple tickets in a programmable manner and bypass restrictive rules with the intend of creating relay spam via your account.</p><p>The abuse actor does not need to use your Help Center's <strong>Submit a request</strong> page to create tickets, as the API option can be used behind any API client, where the actor can input meta data specific to your ticket form and behind an IP rotator mechanism to create multiple spam tickets. </p><p><strong>Tip</strong>: You can also test this behaviour, by using an API client such as this <a href="https://www.postman.com/">one</a>, making repeated API calls against your account and switching the IP address at regular time intervals. </p><p>To avoid the risk of your account becoming a target for relay spam and as a <a href="https://support.zendesk.com/hc/en-us/articles/4408888782618-General-security-best-practices">Security best practice</a> recommendation, you need to take the steps below:</p><h4 id="h_01K7RZFZ7X76HNGEWMZNF354GH">
<strong>Remove placeholders from your account's first-reply triggers</strong>. </h4><p>This will prevent the spam message from being relayed from your account, but it won't block the unwanted ticket creation process.</p><p>The following placeholders are targets for relay spam because they use an anonymous endpoint that allows anyone to enter any text or links they want.</p><ul>
<li data-list-item-id="efe7115c763757d79eec2b461ade410d5">{{ticket.title}}</li>
<li data-list-item-id="ead5b1a80550b600bb2175a2ba90fa659">{{ticket.requester.first_name}}</li>
<li data-list-item-id="e54665706d05ce4f83719495c588fd8f1">{{ticket.requester.last_name}}</li>
<li data-list-item-id="eca0c496dd38fed2142141f8c0c1a727a">{{ticket.requester.name}}</li>
</ul><p>To prevent spam tickets from being created in your account, you need to remove these placeholders and replace them with plain text.</p><p><strong>Please note</strong>: if these placeholders are added against dynamic rule settings, then these placeholders will need to be removed, or replaced individually from those specific rules.</p><p> </p><h4 id="h_01K7RZK5JGQW2E18D36N54EY04"><strong>Disable the option Anybody can submit tickets</strong></h4><p>This will block tickets from being created using the methods listed above as anonymous users won't be able to submit tickets anymore<strong>.</strong></p><figure class="wysiwyg-image"><img style="aspect-ratio: 2336/480;" src="https://support.zendesk.com/hc/article_attachments/9835769829530" width="2336" height="480"></figure><p>This change will block spam and unwanted tickets from being created against your account, as you'll allow only verified users to contact you directly.</p><p>This step should be taken only if the business workflow behind your activity doesn't require receiving tickets from all types of users (including anonymous ones).</p><p><strong>To disable the 'Anyone can submit tickets' option</strong></p><ol id="topic_h1t_z42_h3__ol_jpp_ckn_f3">
<li data-list-item-id="e732ffb02899bd53b64933235e956e81b">In <a href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank" rel="noopener noreferrer">Admin Center</a>, click <img style="height: auto;" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_people_icon.png" width="16" height="16" id="topic_h1t_z42_h3__d8e505"> <strong>People</strong> in the sidebar, then select <strong>Configuration &gt; End users</strong>.</li>
<li data-list-item-id="e29d9e36af92ec348b8a6eaa387b19640">If it's selected, deselect the <strong>Anybody can submit tickets</strong> option.</li>
<li data-list-item-id="e078033c751b8a01684afbc47b696218e">Optionally, in the <strong>Account emails</strong> section, select the <strong>Also send a welcome email when a new user is created by an agent or administrator</strong> option. For more information, see <a href="https://support.zendesk.com/hc/en-us/articles/4408883658906-Permitting-only-added-users-to-submit-tickets#topic_m25_3ld_hj">About new user email address verification and passwords</a>.</li>
<li data-list-item-id="e1af66aeea3a60474901be79f9ca92467">Click <strong>Save tab</strong>.</li>
</ol><p>More details on permitting only added users to submit tickets can be found <a href="https://support.zendesk.com/hc/en-us/articles/4408883658906-Permitting-only-added-users-to-submit-tickets">in this article</a>.</p><p>However, if your business workflow relies on anonymous user creation, you need to <strong>remove at once specific placeholders from your account's first-reply triggers</strong>. This will prevent the spam message from being relayed from your account, but it won't block the unwanted ticket creation process.</p><p>The following placeholders are targets for relay spam because they use an anonymous endpoint that allows anyone to enter any text or links they want.</p><ul>
<li data-list-item-id="ec0c48cda6de36ca70bfd57662cdb274e">{{ticket.title}}</li>
<li data-list-item-id="e6fa0ebb82a5db8bba517990ba3240933">{{ticket.requester.first_name}}</li>
<li data-list-item-id="eaf76d344ae955dcefa8bf2c38c9bf743">{{ticket.requester.last_name}}</li>
<li data-list-item-id="eb794d9e2f1e1162ad318fcb2ae2173e6">{{ticket.requester.name}}</li>
</ul><p>Please note: if these placeholders are added against dynamic rule settings, then these placeholders will need to be removed, or replaced individually from those specific rules.</p><p>More helpful resources can be found in the following articles:</p><ul>
<li data-list-item-id="e9a30e6171bd116537049e02864c0ba75"><a href="https://support.zendesk.com/hc/en-us/articles/4408832828186#h_667502120121539295305407" target="_blank" rel="noopener noreferrer">Remove specific placeholders from first-reply triggers</a></li>
<li data-list-item-id="eb68abbac7c0d3a79428f5894798dc3e5"><a href="https://support.zendesk.com/hc/en-us/articles/4408883658906-Permitting-only-added-users-to-submit-tickets" target="_blank" rel="noopener noreferrer">Permit only added users to submit tickets</a></li>
<li data-list-item-id="e4a5044a0c9b05c63c8b61f0313d8ab43"><a href="https://www.zendesk.com/blog/spot-phishing-attack/" target="_blank" rel="noopener noreferrer">How to spot a phishing attack</a></li>
<li data-list-item-id="ed601d405dba34c0e920f4deb886a58b4"><a href="https://support.zendesk.com/hc/en-us/articles/4408833946394-Resources-for-preventing-and-managing-spam" target="_blank" rel="noopener noreferrer">Resources for preventing and managing spam</a></li>
</ul><p> </p>