We have been bombarded with bot attacks for the last couple of days. Just when I think I’ve about got the fake orders deleted we get more in. And there are very few legit orders coming through.
What do we do?
Theres a difference between stopping the attack and relieving the operational pain.
Depending on the severity, I would start with Shopify Flow and create a workflow to automatically cancel fake orders. Like if you see a certain address, you can put the address as a condition in Flow and automatically cancel any future order that has that address. If it’s card testing bots they generally use repeatable things like John Doe. So you could set it up to cancel order if name is John Doe.
Use things like hCaptcha too.
Hi @KarenFaulkner .
It’s really stressful.
Turn on the Catcphta
installation fraud filter free on shopify app.
Add Cloudflare free, blocks bots before they hit your store.
Contact Shopify support.
That combo should stop most of it pretty quickly.
Unfortunately, there is no single fix.
There was a bunch of similar topics here, just search for “bot attack”
Some of those topics had suggestions on how to use Flow to automatically cancel fraudulent orders.
This topic, for example, has a write-up on how to use Cloudflare filtering – Massive Chinese Bot Traffic Is Corrupting Shopify Analytics, Ad Attribution, and Paid Tools (Plus Merchants Affected) - #66 by Jamie_Grove
This is typically a checkout busting pattern on stores that have exposed checkout or weak fraud filters. Step one is to enable Shopify’s fraud analysis and then set high risk orders to manual review. Add (if any) Shopify Flow rules to auto cancel / hold suspicious orders. You can also restrict shipping zones and ask for address confirmation. Alongside, integrate a CAPTCHA / bot protection at checkout via a trusted app. Now, it is a standard to review your traffic sources in analytics to find and block source patterns.
It is getting WAY WORSE lately. Over the past 5+ years, I’ve had maybe two bot carts checkout successfully. I’ve had almost 10 get through just this week alone. What is Shopify doing to make it worse? Most of them weren’t even marked as any risk level!
Sorry you’re dealing with this — what you’re describing (waves of fake orders that resume right after cleanup) is usually a card-testing or checkout-abuse pattern, and it has a few tells: check whether the orders cluster from datacenter regions (Ashburn VA, Singapore) in your analytics, whether the emails share a pattern, and whether sessions last under 2 seconds. Shopify’s fraud analysis + a Flow rule to auto-hold matching orders stops the cleanup burden even if it doesn’t stop the traffic.
I’m a backend engineer researching this problem across a bunch of stores right now — happy to look at your specifics if you want, just DM me.
Hi @KarenFaulkner .
Carding bots often attempt to use stolen credit cards. To combat this, activate Shopify’s fraud filters to automatically place high risk orders on hold and add CAPTCHA verification to your online forms.
Check whether certain products or price points, such as free items, are being targeted.
Share any patterns you discover with Shopify support so they can implement broader blocking measures.