How to stop card testing on your Shopify store

What is card testing?

Shopify describes card testing (also called carding) as automated scripts testing whether stolen card details are valid. Fraudsters run many small payment attempts at once, then use the confirmed cards for larger purchases or resell them (Shopify Help Center).

Your store is just the test bench. The attackers don't want your products. They want a checkout that answers "approved" or "declined" quickly and cheaply.

How do I know my store is being card tested?

• A burst of declined payments within minutes or hours, often on your cheapest products.
• Orders or checkouts from placeholder names such as "John Doe" or "Test Test", or random-looking and throwaway email addresses.
• The same shipping address or phone number used by many different names.
• Batches of new customer accounts with zero orders, created minutes apart.
• A sudden jump in email signups that never open anything.

Shopify now leaves checkout attempts it identifies as suspected card testing or bot activity out of your abandoned checkouts (source). So a quiet abandoned-checkout list doesn't prove you're safe: check declines, orders and new customers too.

Why does card testing cost me money if the payments fail?

• Chargebacks. Cardholders can later dispute charges they didn't make. Shopify says each chargeback counts toward your chargeback rate whether you win or lose the dispute (source).
• Your decline rate. A surge of declines can increase your decline rate for legitimate customers, even after the attack stops (source).
• Payment fees. Depending on your payment provider, attempts can carry fees, and third-party transaction fees aren't returned when you refund an order.
• Fake customers and email profiles. Bot checkouts leave customer accounts behind, and those can count toward your email-marketing bill.
• Your time. Someone has to sort real orders from bot orders and clean up afterwards.

What can I do today for free?

1. Check what Shopify Payments already does. Stores on Shopify Payments get built-in card testing protection, and you can review the AVS and CVV fraud filters in your Shopify Payments settings (source).
2. Install Shopify's free Fraud Control app and add checkout rules for the emails, addresses and IP addresses the bots keep reusing. Rules only catch checkouts that match them, so keep them narrow to avoid blocking real buyers (source).
3. Cancel high-risk orders before you fulfil them, and consider manual payment capture while an attack is running (source).
4. Use Shopify Flow templates, for example "Cancel orders from bad email addresses" or "Restrict orders from customers to five a day" (source).
5. Don't leave $0 products buyable on their own. Free samples and gifts that can be checked out alone are an easy target. Make them unavailable as a standalone purchase.
6. On Shopify Plus, you can schedule checkout bot protection for up to 60 minutes around a flash sale. Shopify notes it's meant for auto-checkout bots, not for fraud (source).

Why doesn't IP or country blocking stop it?

Card-testing bots usually skip your storefront pages and post straight to checkout, so a blocker that works on storefront pages may never see them. They also rotate IP addresses and countries, while country rules can turn away real shoppers and search-engine crawlers.

And no app can block visits to your store. Every request reaches Shopify first, and Shopify filters most automated traffic itself with Cloudflare and hCaptcha (source). What an app can do is check what a bot tries next: the checkout, the payment, the account it creates.

Which approach stops card testing at checkout?

How does Linesman stop card testing?

Linesman adds a check at the payment step using Shopify's Cart and Checkout Validation Functions, which also run for Shop Pay and express checkouts. A small app embed gives real shoppers' carts an invisible browser check after they interact with the page. Carts without it, with throwaway emails, placeholder names or addresses reused across many buyers, score as bots.

• Proof first. You start in Watch mode: Linesman records what it would block and checks it against your real orders before anything is blocked.
• Real customers get through. Returning customers, your allow list and recent buyers always pass. A stopped shopper sees a short message, can refresh and continue, and you can allow them in one click.
• Attacks handled automatically. When an attack starts, checks get stricter and repeat emails, phones and addresses are blocked for 24 hours. You get an email when it starts and a summary when it ends.
• Cleanup. Delete or tag the fake customers the attack left behind, after downloading a backup.

Blocking at the payment step is included in the Free plan. Pro adds Attack mode, Strict mode and Klaviyo suppression, and every new store gets Pro free for its first 14 days.

Frequently asked questions