Most bot problems on Shopify cost you accuracy. Card testing costs you money, and then it costs you your payment processor’s trust, which is the part that actually hurts.
A card-testing bot runs stolen card numbers through your checkout in small bursts, a dollar here, a few dollars there, just to see which numbers still authorize. Your store is the test bench. The bot doesn’t want your product, it wants a clean yes or no on a list of cards it bought somewhere, and your checkout is a convenient, low-friction place to ask the question.
The reason this one deserves its own post, separate from the general bot noise, is that the bill keeps growing after the attack is over.
What a card-testing attack looks like in your admin
If you have been hit, the pattern is usually obvious once you know to look for it:
- A burst of small transactions in a short window, often off-hours, frequently in the middle of the night your time.
- Lots of declines clustered together, because most of the cards on the list are dead. The successful ones are the bot’s payoff.
- Tiny order values, often your cheapest product or a single low-priced variant, sometimes the exact same item over and over.
- Sequential or gibberish customer details attached to the orders, throwaway emails, filler addresses, names that don’t read like people.
- The same card prefixes (the first six digits, the BIN) repeating, because the list came from one breach.
One or two of these on their own might be nothing. All of them at once, in a tight time window, is a card-testing run.
The real cost isn’t the test charges
This is the part merchants underestimate. The dollar charges themselves are small. The damage is everything downstream of them.
- Dispute fees. Every one of those test charges can come back as a chargeback when the real cardholder notices, and your processor charges a flat fee per dispute (commonly around fifteen dollars) whether you fight it or not. A few hundred test charges turns into real money in fees alone, before you have lost a single product.
- Processor warning programs. This is the one that can end your store. Visa’s acquirer monitoring program and Stripe’s Radar both track your dispute and fraud ratios. Cross a threshold and you land in a monitoring program, with fines, mandatory remediation, and in the worst case the loss of your ability to process cards at all. A card-testing attack can push a clean account over that line in a single bad week.
- Held or frozen payouts. When your fraud numbers spike, processors get cautious. Held funds and frozen payouts while they review are common, and that is a cash-flow problem on top of everything else.
- Your fraud-analysis score. Shopify and your processor start scoring more of your real orders as risky, which means more manual review, more friction for genuine customers, and more false declines on legitimate sales.
None of that shows up in the order total. It shows up weeks later, in fees, in warning emails, in a payout that didn’t land when you expected it.
If you want to put real numbers on your own exposure, we built a card-testing cost calculator that takes your monthly orders, average order value, dispute rate, and processor, and estimates what an attack is actually costing you in fees and risk. It is free, no signup, and it makes the math concrete in a way a blog post can’t.
Why Shopify’s defaults don’t stop it
Shopify’s fraud analysis is real, but it scores orders after they exist. It tells you an order looks risky, it does not stop the bot from running the card in the first place. The charge already hit your processor by the time the risk flag appears.
The checkout CAPTCHA helps against bots that load your storefront, but card testers usually hit the checkout directly, the same cart-URL trick the rest of the checkout-abuse bots use, so the CAPTCHA never renders. And rate limiting at the IP level gets sidestepped by bots that spread the run across many addresses.
So the defaults catch some of it and miss the patient, distributed version, which is exactly the version that does the most damage to your processor standing.
How to respond right now
If you are in the middle of an attack, there are free moves worth making immediately:
- Turn on every checkout protection Shopify offers in your settings, including the CAPTCHA and any bot-protection toggles.
- Tighten your processor’s own rules. Stripe Radar lets you block on repeated declines and BIN patterns, Shopify Payments has fraud controls worth turning up during an active run.
- Temporarily require customer accounts for checkout, which adds friction the cheaper bots won’t bother with.
- If it is a hard, ongoing flood, a WAF in front of your store can rate-limit the volume, with the usual caveat that DNS rerouting carries its own risk during sales.
These slow an attack down. What they don’t do is stop the bot from reaching your checkout, because most of them act at the wrong layer or arrive after the charge already ran.
The two ways to actually block it
When you decide the free layer isn’t holding, you are choosing between the same two categories that apply to all Shopify bot blocking, and it is worth knowing which is which.
Edge or DNS-layer blocking reroutes your domain through a third-party proxy that drops bad traffic before it reaches Shopify. Strong against raw volume, but you are handing off your DNS and a bad rule can break real checkout traffic.
Shopify checkout-layer blocking stops the bot at the session layer inside Shopify, before the card ever runs, before the order exists, before any dispute can be filed against it. For card testing specifically this is the layer that matters, because the goal is to never let the card hit your processor in the first place. No charge, no dispute, no hit to your fraud ratio.
FAQ
Is card testing my fault?
No. Card testers pick stores by how easy the checkout is to script, not by anything you did wrong. A brand-new store with ten orders can get hit as easily as an established one.
Should I refund the test charges?
Refund the ones you can identify quickly, since a refund is cheaper than a chargeback. But refunding does not undo the hit to your fraud ratio, and it does not stop the next run. Triage first, then close the door.
How do I know if it is card testing or just fake checkouts?
Card testing involves actual payment attempts, lots of declines, real charges, processor activity. Fake checkouts usually stop before payment and just leave abandoned carts and junk customer records behind. Different patterns, related bots. The bot traffic field guide lays out both.
Will this hurt my Stripe or Shopify Payments account long-term?
It can, if the dispute ratio climbs high enough to trigger a monitoring program. That is the real reason to treat card testing as urgent rather than annoying, the account standing is harder to repair than the fees are to absorb.
Where Doorman fits
Doorman is a Shopify checkout-layer bot blocker. For card testing, that means stopping the bot at the session layer before the card ever reaches your processor, so there is no test charge, no dispute, and no quiet damage to your fraud ratio weeks down the line. Run the cost calculator to see what an attack is worth to you first, then decide.
The founding cohort is open, no credit card… doormanapp.com.