Card testing is when someone uses your checkout to find out which stolen card numbers still work. Shopify describes it as automated scripts running many small payment attempts at once to find active cards. This guide covers what an attack looks like in your admin, what Shopify does automatically, and what you should do during and after one.
What card testing looks like
The attacker does not want your products. They want a yes or no from the card network, so the pattern is volume and repetition, not a believable order.
- Declines: A sudden surge of declined transactions
- Small orders: Some low value orders that do go through
- Repeated details: Many checkout or payment attempts with repeated or suspicious customer details
- Saved cards: Attempts to save card details without completing a purchase
Where to look, and where not to
Do not rely on abandoned checkouts to measure an attack. Shopify says checkout attempts it identifies as suspected card testing or bot activity might not appear as abandoned checkouts. Look at placed orders and their fraud analysis instead.
- Orders: Open recent small orders and read the Order risk section
- Blocked checkouts: Under Orders, then Abandoned checkouts, Shopify has a Blocked view for checkouts Shopify Payments blocked as high risk
What Shopify does automatically
Some protection is already running. It reduces attacks but does not remove the need to review what gets through.
| Protection | How it works |
|---|---|
| Temporary IP block | Many orders or failed payment attempts from one IP in a short time can trigger a block that lifts automatically within 6 to 24 hours |
| hCaptcha | On by default. Shopify advises keeping it active |
| Checkout bot protection | Available on the Shopify Plus plan. Shopify says it is aimed at auto-checkout bots, not fraud |
What to do during an attack
The orders that succeed are the problem. Each one was paid with a card that belongs to someone else, and Shopify notes that every chargeback counts toward your chargeback rate whether you win or lose.
- ✅ Cancel the high risk orders before you fulfill anything
- ✅ Switch to manual payment capture so you can review orders before collecting funds
- ✅ If you use Shopify Payments, set up the AVS and CVV fraud filters
- ✅ Use Shopify's Fraud Control app to block specific email addresses, IP addresses or billing details
Shopify also notes that cancelling or voiding an order does not stop the cardholder's bank from filing a chargeback, so keep records of what you cancelled and when.
After the attack
Attackers often return to stores where testing worked. Use the quiet period to tighten your process.
- Automation: Shopify Flow can flag, hold or cancel orders that match high risk patterns
- Disputes: Watch for chargebacks and inquiries on orders from the attack window. See how to respond to a chargeback
Doing this at scale
RiskClarity reviews each paid order, explains the risk in plain English with the fraud signals behind it, and recommends allow, verify or hold. You decide with one click, and every decision is logged in an audit log you can export for chargeback disputes. See RiskClarity.