I think it is a pretty clear racket that Shopify has the tools to prevent the credit card bots from checking out on our sites, but gates that functionality behind Shopify Plus. They can prevent the bots from going through, but still collect their transaction fee on fake transactions. That’s a pretty crappy way to do business.
Totally agree. In the meantime, try enabling AVS/CVV checks and using Shopify’s Fraud Control app to block suspicious IPs and customer details. This may help reduce the attacks.
Hey @VersattaKilts
Hope this message finds you in good spirits!
I agree. hopefully Shopify makes advanced fraud prevention more accessible, as it is important feature for merchant of every size.
Hi there @VersattaKilts
I know how frustrating that is. Card testing atacks can rack up the charges for store owners, especially for stores on the standard plans. A practical approach enable CAPTCHA where you can, use Shopify Flow if you have it, install a fraud prevention app that detects card testing patterns, block suspicious IP ranges with a security app, and limit how often people can “rush” through checkouts. Combining these measures can help prevent a significant number of fraudulent transactions without having to move to Shopify Plus.
I understand why you’re frustrated. Card testing attacks can be costly and disruptive, and it’s understandable that merchants want stronger protection by default. While Shopify does offer fraud prevention tools, many advanced bot mitigation features are reserved for higher-tier plans.
It would be helpful if Shopify made more robust protection against card testing available to all merchants, since this is a security issue rather than a premium feature. In the meantime, if anyone has found effective ways to reduce these attacks without upgrading to Plus, I’d be interested to hear what has worked.
This is the exact reason I think card testing needs to be treated differently from normal “fraud orders”.
By the time you have an order to review, the attacker already got what they wanted: a yes/no signal on whether the card works.
I’m one of the developers working on Blockio, and we’ve been looking at this specifically for non-Plus stores. The approach I think makes the most sense is layered: stop obvious bad IP/proxy traffic early, look for repeated/automated behavior, and keep Shopify’s payment/fraud controls as the last layer.
I wouldn’t claim any storefront app can magically stop every direct-to-checkout bot — Shopify controls that layer — but there’s still a lot of junk you can cut out before it reaches that point.
Would be curious what pattern you’re seeing: lots of failed checkouts, or actual small orders successfully getting through?
@sophia24 — this is a direct answer to your question about options without upgrading.
Shopify’s native bot protection is Plus only, but that isn’t the only layer you can use to block these attacks. Shopify has cart and checkout validation functions, which run server-side in the checkout pipeline on every checkout, and merchants on any plan can use them through public App Store apps.
Blockio is correct that no storefront app can block these checkouts, since storefront apps run on the client and a bot can simply not load and run the assets there. Validation functions don’t run on the client or the storefront, so they aren’t bound by that limitation.
The catch is that the function only rejects what you tell it to, so the work is correctly identifying the signal that separates the bots from real customers.
Disclosure: I’m working on an app, Doorman, that uses checkout validation functions to filter these bots.