We have been bombarded with bot attacks for the last couple of days. Just when I think I’ve about got the fake orders deleted we get more in. And there are very few legit orders coming through.
What do we do?
Theres a difference between stopping the attack and relieving the operational pain.
Depending on the severity, I would start with Shopify Flow and create a workflow to automatically cancel fake orders. Like if you see a certain address, you can put the address as a condition in Flow and automatically cancel any future order that has that address. If it’s card testing bots they generally use repeatable things like John Doe. So you could set it up to cancel order if name is John Doe.
Use things like hCaptcha too.
Hi @KarenFaulkner .
It’s really stressful.
Turn on the Catcphta
installation fraud filter free on shopify app.
Add Cloudflare free, blocks bots before they hit your store.
Contact Shopify support.
That combo should stop most of it pretty quickly.
Unfortunately, there is no single fix.
There was a bunch of similar topics here, just search for “bot attack”
Some of those topics had suggestions on how to use Flow to automatically cancel fraudulent orders.
This topic, for example, has a write-up on how to use Cloudflare filtering – Massive Chinese Bot Traffic Is Corrupting Shopify Analytics, Ad Attribution, and Paid Tools (Plus Merchants Affected) - #66 by Jamie_Grove
This is typically a checkout busting pattern on stores that have exposed checkout or weak fraud filters. Step one is to enable Shopify’s fraud analysis and then set high risk orders to manual review. Add (if any) Shopify Flow rules to auto cancel / hold suspicious orders. You can also restrict shipping zones and ask for address confirmation. Alongside, integrate a CAPTCHA / bot protection at checkout via a trusted app. Now, it is a standard to review your traffic sources in analytics to find and block source patterns.
It is getting WAY WORSE lately. Over the past 5+ years, I’ve had maybe two bot carts checkout successfully. I’ve had almost 10 get through just this week alone. What is Shopify doing to make it worse? Most of them weren’t even marked as any risk level!
Sorry you’re dealing with this — what you’re describing (waves of fake orders that resume right after cleanup) is usually a card-testing or checkout-abuse pattern, and it has a few tells: check whether the orders cluster from datacenter regions (Ashburn VA, Singapore) in your analytics, whether the emails share a pattern, and whether sessions last under 2 seconds. Shopify’s fraud analysis + a Flow rule to auto-hold matching orders stops the cleanup burden even if it doesn’t stop the traffic.
I’m a backend engineer researching this problem across a bunch of stores right now — happy to look at your specifics if you want, just DM me.
Hi @KarenFaulkner .
Carding bots often attempt to use stolen credit cards. To combat this, activate Shopify’s fraud filters to automatically place high risk orders on hold and add CAPTCHA verification to your online forms.
Check whether certain products or price points, such as free items, are being targeted.
Share any patterns you discover with Shopify support so they can implement broader blocking measures.
Before deleting another batch, save a small evidence set: five order timelines, targeted SKUs, order values, payment outcomes, and whether there was any storefront browsing. That tells you whether this is ordinary fake-order spam or a card-testing burst.
For immediate containment, use manual capture and a Flow rule to tag/cancel the repeating pattern. Flow reduces cleanup after an order exists; it does not stop the attempt at checkout. Pause abandoned-checkout emails during the wave so fake addresses do not damage deliverability.
I work on Blockio. It is built for the checkout-side part—card-testing and automated checkout abuse—and can be run in monitor mode first so you can validate the pattern before blocking. It is not a promise to stop every kind of fraud: Blockio Card Testing Blocker - Stop card testing bots before they abuse your checkout. | Shopify App Store