How to Stop Card Testing Attacks on Shopify

Card testing is when fraudsters use automated bots to run stolen or guessed cards through real Shopify checkouts to find which cards still work. Stop it with velocity controls, bot detection, pattern monitoring, and stronger verification where needed - without relying on a single fraud act or adding unnecessary friction for legitimate customers.

One of the easiest ways for fraudsters to test stolen cards is to use someone else's checkout.

For Shopify merchants, that can mean suddenly seeing hundreds of small payment attempts that have nothing to do with customers actually trying to buy your products.

This is card testing. Fraudsters have a list of stolen or guessed card details, but they don't necessarily know which cards still work.

So they use automated bots to run those cards through real Ecommerce checkouts. A successful authorization gives them the information they wanted - this card is live.

Your product was never really the target. Your checkout was the testing environment.

What the pattern usually looks like

The pattern is usually fairly recognisable: a sudden spike in payment attempts, lots of low-value transactions, an unusually high decline rate, multiple cards being attempted in a short period, and repeated or unusual checkout behaviour.

But what merchants sometimes misunderstand is that if all those transactions are being declined, the attack isn't necessarily harmless. A sustained attack can create large volumes of failed authorizations and distort your payment data.

It can also affect authorization performance and contribute to the enumeration activity card networks monitor.

How to stop it

So how do you stop it?

I wouldn't rely on one fraud act. Card testing is automated behaviour, so you need to make it difficult to test cards at scale while avoiding unnecessary friction for legitimate customers.

A few places I'd look:

• Velocity controls. Detect unusually high numbers of payment attempts over short periods.
• Bot detection. Look for automated checkout behaviour.
• Transaction patterns. Repeated low-value amounts, multiple cards, and rapid-fire attempts.
• Additional verification. Use stronger authentication where the risk warrants it.
• Your lowest-value products. Card testers often target cheap products.
• Monitoring. A card-testing attack should be something you identify quickly.

If you're actively being attacked, involve your payment provider early. The important point is that card testing isn't really an individual-transaction problem.

One $2 payment attempt might look completely unremarkable. Thousands of similar attempts over a short period tell a very different story.

Good fraud systems understand the behaviour - not just an individual transaction that looks unremarkable on its own.

See also how to reduce chargebacks on Shopify, how it works, pricing, and the FAQ.

If you want help spotting testing patterns and ranking Radar, Flow, Blockify, or RevenueProtect changes on your data, book a demo.