Shopify card testing: which checkout controls help?

Card testing uses checkout attempts to discover whether stolen payment details work. For a Shopify merchant, the response needs to distinguish three things: attempted payments, orders that actually exist, and fake records contaminating marketing or reporting.

Shopify Payments includes card-testing protection, but manual capture is a review step, not a switch that stops every attempt. Check payment activity, review your available fraud controls and escalate persistent patterns to support before relying on a single automation.

What the merchant reports establish

In a 22 September Shopify Community report, one Plus merchant described more than 11,000 abandoned checkouts since 1 September. The merchant said very few current attempts reached payment and that capture was already manual. Those are one store’s observations, not evidence of a newly confirmed platform-wide October outbreak.

Match the control to the problem

Fraud Control is available across plans in locations where Shopify Payments is available, but its checkout rules require Shopify Payments. Rules can match email, IP or address attributes and prevent matching checkouts becoming orders. They do not guarantee protection against all fraud or chargebacks.

In the app, open Rules → Create rule, set the checkout conditions and save. Saving activates the rule. Keep rules narrowly tied to the evidence you have: an ordinary postcode or popular email provider alone is a poor reason to reject a customer.

Shopify says checkouts blocked by these rules appear in abandoned checkouts. Separately, attempts its integrated protection identifies as suspected card testing or bot activity are excluded from abandoned checkouts. A large abandoned-checkout count therefore needs investigation; it is not itself a count of successful fraudulent payments.

Make Flow wait for the risk result

The Order risk analyzed trigger runs after Shopify’s assessment finishes, not immediately when an order is created. It does not respond to third-party risk assessments. Shopify provides templates to cancel high-risk orders or request review before capture; the latter requires manual capture settings.

Our operational recommendation is to check the whole fulfilment sequence, including digital delivery and label purchasing. A risk-review workflow is of little use if another integration has already dispatched the goods. Test the sequence with a test order and confirm which system holds release, who reviews exceptions and how legitimate orders resume.

Bot protection is a different feature

Shopify’s Plus bot-protection feature helps customers compete fairly for scarce stock during sales. Shopify explicitly says it is not designed to combat fraud associated with bots. Do not treat access to that feature as a substitute for payment-fraud controls.

Build a useful support case

For the team investigating an incident, we suggest a short log with the affected timeframe, representative checkout or order references, repeated patterns and the controls already tried. Separate attempted authorisations, captured payments and abandoned records. Ask support to investigate the payment attempts and the record pollution as distinct issues.

Likewise, review recovery-email audiences before sending another campaign. Quarantine records supported by evidence of automation rather than broadly deleting customers or suppressing everyone who shares one attribute. Preserve the examples needed for investigation, and give someone responsibility for reviewing whether the pattern changes.

Official background video

Shopify’s Help Center still links this older introduction to handling high-risk orders. It is background guidance, not an announcement of a new October defence; use the current documentation above for controls and eligibility.