Your Shopify store is being used for card testing. What to do.

Updated October 14, 2026

Short answer: don't ship anything from the burst, and stop taking money automatically. Cancel the high risk orders, switch payment capture to manual, and tighten the card checks your payment provider offers. Then keep the fake sign-ups out of your marketing emails. You can't delete the fake abandoned checkouts; Shopify removes them after three months.

What card testing is

Shopify describes card testing (also called carding or card enumeration) as fraud where someone uses automated scripts to test whether stolen card details are valid. Your checkout is the test bench: the script tries card after card, usually on a cheap item, and notes which ones go through.

The damage comes in three forms. Declined attempts pile up, which Shopify says can raise your decline rate for real customers even after the attack ends. A few attempts succeed and become orders. And the real cardholders later dispute those charges, so each one can become a chargeback that counts toward your chargeback rate whether you win or lose.

How to tell it's happening

Many small payment attempts close together, often for the same low-priced product.
A surge of declined transactions, sometimes with a few placed orders mixed in.
A jump in abandoned checkouts with repeated or odd customer details.
Many new customer profiles with strangely formatted names.

The abandoned checkout list understates an attack. Since June 2026 Shopify leaves out checkout attempts it identifies as card testing or bot activity, but it also says not all automated activity is filtered out. So a quiet list doesn't prove the attack has stopped, and a noisy one means some of it got through the filter.

What to do right now

Hold fulfillment. If you use automatic fulfillment or a 3PL, stop orders from the burst shipping while you look.
Cancel the high risk orders. Use the fraud analysis on each order. Shopify notes that canceling or voiding lowers your risk but doesn't stop the cardholder's bank from filing a chargeback.
Switch to manual payment capture. Go to Settings > Payments, find Payment capture method, and choose Manually. Orders are then authorized but not charged until you capture them. With Shopify Payments you have 7 days to capture; with other providers the period depends on the provider.
Tighten card checks, if you use Shopify Payments. In Settings > Payments > Shopify Payments > Manage, the Fraud prevention section lets you decline charges that fail the CVV or address (AVS) check. Shopify warns that turning on AVS declines may increase failed transactions for real customers, and the filters only apply where the card's bank supports the check.
Block the repeat offenders. Shopify's Fraud Control app can block specific email addresses, IP addresses or billing details at checkout. Its checkout rules need Shopify Payments.
Automate the routine part. Shopify Flow can flag, hold or cancel orders that match a high risk pattern.
Confirm hCaptcha is on. Go to Online Store > Preferences > Spam protection. It is on by default and covers contact, newsletter and comment forms and the legacy customer account pages. Shopify's description doesn't list checkout among the forms it covers.
On Shopify Plus, turn on bot protection for checkout. It is only available on that plan.

Keep the fake sign-ups out of your email

Card-testing scripts fill in email addresses, and those addresses can end up receiving your marketing. Two settings limit that:

Marketing double opt-in. Go to Settings > Notifications > Customer notifications and turn on Customer marketing confirmation. New subscribers must then click a link in a confirmation email. It doesn't apply to people who subscribed before you turned it on.
Who gets abandoned checkout emails. In Apps > Messaging > Automations, open Abandoned checkout emails by Shopify, choose Edit settings and check Send to. Sending only to people who subscribed keeps recovery emails away from addresses a script typed in.

What depends on your plan and payment provider

Protection	Who can use it
Manual payment capture	Any store. The authorization period depends on the payment provider.
hCaptcha on forms and account pages	Any store. On by default.
Shopify Flow	Basic, Grow, Advanced and Shopify Plus.
Fraud risk level on each order	Stores using Shopify Payments, or on the Grow plan or higher.
Built-in card testing protection	Stores using Shopify Payments.
AVS and CVV decline settings	Stores using Shopify Payments.
Fraud Control checkout rules	Stores using Shopify Payments.
Bot protection for checkout	Shopify Plus.

If you use another payment provider, ask them what they offer for card testing. Most of the blocking happens on their side.

What you can't do

Delete the fake abandoned checkouts. Shopify doesn't let you delete an abandoned checkout. They are removed automatically once they are older than three months.
Undo the authorization holds. A real cardholder may see a pending charge on their statement for up to 30 days after an authorization, even if you canceled the order. The timing depends on their bank.

After the attack

Watch for chargebacks on any order from the burst that was captured. Check Orders in your admin for open chargebacks and inquiries.
Keep manual capture on until a few quiet days have passed.
Note what the attack looked like: the product it targeted, the email pattern, the hours it ran. The next one usually looks the same.

Where FraudPilot fits

We make FraudPilot, a Shopify app for reviewing the orders Shopify flags as risky. It checks your store's abandoned checkouts every 15 minutes and shows an alert in the app when they jump well above your usual rate, for one product or across the store, so you hear about a possible card-testing run early. It reads only the time, the total and the first product name of each checkout, and no customer details. It is a warning, not a shield: FraudPilot doesn't block checkouts or cancel orders, the alert appears in the app and is not emailed, and it can only count the abandoned checkouts Shopify records, which leaves out the attempts Shopify already filtered. The orders that do get through and are flagged show up in its review queue with the reasons each was flagged. Read how FraudPilot works. Free and paid plans available. See the FraudPilot listing on the Shopify App Store for features and plans.

Common questions

What is card testing on Shopify?

Card testing is fraud where someone uses automated scripts to check whether stolen card details are valid, using your store's checkout to do it. It shows up as many small payment attempts close together, a surge of declined transactions and sometimes a few completed orders.

Can I delete fake abandoned checkouts in Shopify?

No. Shopify doesn't let you delete an abandoned checkout. Abandoned checkouts older than three months are removed from the admin automatically.

Does canceling a card-testing order stop a chargeback?

Not always. Shopify says canceling or voiding a high risk order lowers your risk, but it doesn't stop the cardholder's bank from filing a chargeback. Cancel anyway, and never ship it.

Does hCaptcha stop card testing at checkout?

Shopify's hCaptcha setting covers contact, newsletter and comment forms and the legacy customer account pages. Checkout isn't listed among the forms it covers. Bot protection for checkout is a separate feature, available on Shopify Plus.

Do I need Shopify Payments to protect my store from card testing?

Some protections need it and some don't. Shopify's built-in card testing protection, the AVS and CVV decline settings and Fraud Control checkout rules are for stores using Shopify Payments. Manual payment capture and Shopify Flow work with other providers too.

Sources

Questions: support@alpenglowsoftware.com