Halt, a Shopify app
Halt stops
card-testing bots
before the card
is charged
A bot runs stolen card numbers through your checkout to find the ones that work. You get the refunds, and you lose a fee on every one. Halt refuses those checkouts inside Shopify, at the payment step, before any charge.
The short version
How do you stop card testing on Shopify?
Refuse the checkout before the card is charged. Halt does that inside Shopify. It checks every checkout at the payment step and refuses the ones that reuse the same email, address, or phone number within a day. Nothing is charged, so there is nothing to refund and no fee to lose. Customers who have ordered from you before are never stopped. It works on every Shopify plan, and it starts in watch mode so you can see it work before it blocks anything.
The problem
Forty orders overnight, and not one of them is real
A candle shop in Henderson opens the laptop at seven and finds forty orders for the cheapest item in the store. Every name is different. Every address is nonsense. Every card was charged. Now every one has to be refunded by hand, and Shopify keeps the card fee on each refund. The shop sold nothing and paid forty fees.
That is card testing. Somebody with a list of stolen numbers is using your checkout to find out which ones still work. The ones that pass get sold on or used somewhere bigger. Your store was only the test.
Why it keeps happening
Four reasons a store gets hit
Bots skip your storefront
They go straight to checkout with a list of stolen card numbers and try them one after another. Each one that works gets sold on. Your store is just the test bench.
Every try costs you a fee
Each order is a real charge, so each refund is a real refund. Shopify keeps the card processing fee on a refunded order. On a busy night that is dozens of fees for nothing sold.
Most tools act after the order
Fraud analysis looks at an order once it exists. By then the charge has happened, the fee is gone, and the refund is your job.
Nobody is watching at three in the morning
That is when it happens. A store owner finds out at breakfast, from a pile of order emails with names that do not exist.
What Halt does about it
Before the charge, not after
Shopify lets an app check a checkout at the payment step, before the card is charged, through what it calls checkout validation. Halt runs there. When a checkout reuses details that have already come through that day, it is refused on the spot. The bot sees a decline. You see one line in your Activity log. Nothing is charged, so nothing is refunded.
What it includes
Everything on the box
- Stops repeat checkouts from the same email, address, or phone within one day.
- Works on every Shopify plan, including Basic. Nothing to add to your theme or checkout.
- Starts in watch mode. You see what it would stop before it stops anything.
- A bait product: a trap item only a bot would buy. A guest checkout with it in the cart is refused.
- Stops throwaway email addresses, and lookalike addresses you define yourself.
- Customers who have ordered from you before are never stopped.
- Emails you when an attack starts, and a daily summary on busy days.
- Never stores customer emails or addresses. It keeps only that the same details came back, and forgets after a day.
Setting it up
Three steps, and the first one is the install
Install it
One click from the Shopify App Store. It runs inside Shopify checkout, so there is nothing to add to your theme.
Watch for a day
Halt starts in watch mode. The Activity page shows every checkout it would have stopped, and why, with the email masked.
Turn on protection
One button. From then on, matching checkouts are refused at the payment step, before any charge. One click allows a real customer for good.
Price
Free for 14 days, then $6.99 a month
One plan, every feature, unlimited checkouts. No usage fees and no per-order fees, so a busy night costs the same as a quiet one. If you uninstall, Shopify cancels the subscription and nothing more is charged. One refunded fee a month pays for it.
Halt never stores a customer’s email, phone or address. It keeps a short fingerprint of each, the email domain, the country and the cart total, and forgets them after a day. The details are in our privacy policy.
Straight answers
Questions store owners ask before they install
What is card testing?
Card testing is when someone with a list of stolen card numbers runs them through an online checkout to find the ones that still work. They use small orders so nobody notices. The store owner is left with the refunds, and the card fee on each one is not returned.
Will Halt stop my real customers?
The default limits are gentle: three checkouts in a day from the same email or address, five from the same phone. Anyone who has ordered from you before passes every time. If a real customer is ever stopped, one click in Activity allows them for good.
Does it work on the Basic plan?
Yes. Halt works on every Shopify plan, including Basic and Starter. It runs inside Shopify checkout, so it does not need checkout customization or a Plus plan.
Does it change my checkout or my theme?
No. Nothing is added to your theme, and your customers see the checkout they always see. Halt only steps in when a checkout matches a rule, and then that one checkout is refused before payment.
What does it cost?
Free for 14 days, then 6.99 dollars a month. No usage fees and no per-order fees. If you uninstall, Shopify cancels the subscription and nothing more is charged.
What does Halt know about my customers?
Very little, on purpose. It never stores an email address, a phone number, or an address. It keeps a short fingerprint of each, the email domain, the country and the cart total, and forgets them after a day. When you uninstall, everything for your store is deleted.
Does it stop chargebacks?
It stops the orders that lead to them. A card-testing order that never gets charged cannot be charged back. Halt is not a general fraud tool, and it does not review orders that have already gone through.
Why am I getting fake orders on my Shopify store?
Almost always card testing. A bot is using your checkout to find out which stolen card numbers still work. The orders are small, the names are made up, and they come in bursts, often overnight. Your store was picked because its checkout was open, not because of anything you did.
Does Shopify refund the transaction fee when I refund an order?
No. Shopify keeps the card processing fee on a refunded order, so every card-testing order you refund still costs you the fee. That is why stopping the checkout before the charge matters more than cleaning up orders after.
How do I stop bots from creating abandoned checkouts?
You cannot delete abandoned checkouts, and they expire on their own after three months. What you can do is stop the source. Halt refuses the repeat checkouts at the payment step, so the bot stops getting an answer from your store and moves on.
Does Halt work with Shopify Payments or another payment provider?
Yes. Halt runs inside Shopify checkout itself, before the payment provider is ever called, so it works with any of them. The one thing it needs is Shopify’s own checkout. A store that sends customers to a third-party checkout page is the only case it cannot cover.
What does a bot see when Halt stops a checkout?
A calm message at the top of checkout, which you can change in Rules, and a Pay button that does not go through. There is no mention of fraud, so a real customer stopped by mistake feels fine about contacting you. One click in Activity lets them through for good.
In the newsroom
What we have announced about Halt
Halt is live: a Shopify app that stops card-testing bots
Native Code today released Halt: Card Testing Blocker on the Shopify App Store. Halt runs inside Shopify checkout and refuses card-testing attempts before any charge is made. A store owner has nothing to refund and loses no card fee. It is free for 14 days, then $6.99 a month.
Every release, and the media kit, is in the newsroom.
Where to start
Install Halt, and watch it for a day.
Free for 14 days. It begins in watch mode, so the first thing you see is what it would have stopped. Nothing to add to your theme, nothing charged after uninstall.
Read the announcement, or write to support@nativecodeapps.com with any question.