Card testing attack: how to tell your store is under one

It usually starts with your phone. Ten order notifications where you’d normally get one, all for the same small thing, from people you’ve never heard of.

That isn’t a sales spike. Nobody is after your stock. The pattern has a name.

What the bot is doing

Somebody has a list of stolen card numbers. Most of them are dead. Before the list is worth anything, they need to know which cards still work.

So a script runs them through a real checkout and watches which payments go through. Shopify describes it as many small payment attempts at once. The cards that pass get used for bigger purchases or resold.

Your store was picked because its checkout was open and easy to reach. The bot doesn’t want what you sell. It wants the one thing your checkout tells it: approved or declined.

How to tell it’s card testing

No single order proves it. The pattern does. Here is what each reading tends to mean.

• A run of declined payments. Stripe says most attacks show up first as a sharp rise in failed payments. A bot tries far more cards than it gets through.
• Small totals. Stripe also notes that testers keep payments small, because a cardholder is less likely to notice a small charge.
• Names and emails that make no sense. Stripe lists these as one of the common symptoms. Strings of letters, not people.
• One shipping address, many billing names. Shopify treats several orders with different names and billing addresses, all shipping to one place, as a possible sign of fraud.
• A burst, not a trickle. Real customers arrive spread out. A script arrives all at once, then stops.

One more thing is easy to miss. Checkouts that Shopify suspects are card testing aren’t included in your abandoned checkouts. So that list can look calm while an attack is running.

What it usually isn’t: one strange order on its own, or a real customer retrying a declined card a couple of times. Those are ordinary. The volume and the sameness are what give an attack away.

What it costs once it stops

The orders are the part you see. Most of the cost arrives later. Some of it outlasts the attack.

The card fees stay gone. On Shopify Payments, the credit card fee isn’t refunded when you refund or cancel a paid order. That holds whether it shipped or not. Every test order that got through leaves its fee behind.

Chargebacks can follow. A chargeback is a cardholder asking their bank to reverse a charge. The real owners of those cards never ordered from you. Some of them will notice. Shopify says each one counts toward your chargeback rate, whether you win the dispute or lose it.

A hold can be enough. An authorization hold is the bank setting money aside before a payment is collected. It can appear on the real cardholder’s statement even if you never collect. Shopify notes that if they report it, their bank can still file a chargeback against your store.

Real customers can get declined. A surge of declined attempts can raise the decline rate for your genuine buyers. Shopify says that can last after the attack ends. Stripe explains why: card issuers start treating the whole store as riskier.

Your data fills with bots. Stripe points out that test orders can look like new customers in your sales numbers. Every bot also types an email address, and the store keeps it as a contact. Some email tools charge by the contact, so you can end up paying to email a bot.

What Shopify already does

More than most store owners know. Stores on Shopify Payments get card testing protection built into checkout, with nothing to set up.

The same help page then lists Shopify’s own steps for reducing exposure:

• Cancel high-risk orders before fulfillment, using fraud analysis to find them.
• Capture payments manually, so high-risk orders get reviewed before the money is collected.
• Use Shopify Flow to flag, hold or cancel orders that match high-risk patterns.
• Turn on the address and security code checks, known as AVS and CVV.
• Use the Fraud Control app to block specific emails, IP addresses or billing details.

Look at where most of those sit. All but one act on an order after the checkout has finished. That’s the same timing behind the high risk of fraud flag, which arrives after the card is charged. Chargeback cover works the same way. It needs an order to exist before it can protect one.

The exception is Fraud Control. Its checkout rules do stop a checkout before it becomes an order, which is the right moment. What they need from you is the email, address or IP to block, named in advance.

Stopping it at the payment step

The cheapest test order is the one that never gets charged. That’s the job Halt was built for.

It uses Shopify’s checkout validation to look at each checkout at the payment step. That happens before the payment provider is ever called. Repeat checkouts from the same email, address or phone within a day are refused. No charge means no fee, no hold and nothing to dispute.

It starts in watch mode, so you see what it would have stopped before it stops anything. A signed-in customer with a past order always gets through. It works on every Shopify plan and with any payment provider, as long as the store uses Shopify’s own checkout. It’s free for 14 days, then 6.99 dollars a month.

When it stops a bot, it can also take that address off your email list. It doesn’t replace Shopify’s tools. It just means the orders they review are the few worth a person’s attention.