I’m getting attacked by bots with fraudulent credit cards, I’m talking about hundreds of attempts with cards until they get one approved. I need a way to slow down this attacks by confirming my customers email/cell phone with sms pin code and/or a captcha system in my checkout but none of this seem doable.
What can I do?
Hi,
Shopify has this built in for checkout. You can enable it via Online Store > Preferences > Scroll to bottom - Checkout Protection > Enable and Save.
Only available to Shopify Plus Members, which is unfair, everyone deserves and needs security.
agreed. unfair, I pay for the mid level account this feature should be available to ALL. along with many other features shopify refuses to add and lets sketchy third party developers gain access to our stores instead. SMH.
Shopify does not allow this feature during checkout. Many banks and transaction clearing vendors require this. $2,000 a month for plus account is obviously outrageous and out of the question for small businesses. I am shocked that they are effectively shutting out small businesses. Do they not even consider that these could possibly grow into being bigger businesses who would want the plus service? Incredibly angry and disappointed that Shopify would have made such a terrible move
@Shopify_77 seriously Shopify? something like this should be available to everyone… ridiculous.
Yes it should be available and now is. It is forced with no way to turn it off for normal Shopify stores. For some of us this is unacceptable as we have elderly clients and they cannot navigate captcha at checkout, causing us to lose sales.
Just to clarify, It WAS “available” or should I say FORCED on our store. We did not ask for it and when I submitted a trouble ticket, it magically disappeared a few days later.
If they are going to add some function to a store that changes the overall function for an end customer such as this, it would be great to have it as an option and not forced. Having captcha added to check out as an option would be great. It would work for some and those of us who can’t use it can turn it off.
Can you share whether you’re on the Plus plan or not, and whether you use Shopify Payments for you payment processor? We’re on Plus, but do not use Shopify Payments, and for whatever reason, getting reCaptcha added to Checkout doesn’t seem possible. We are able to implement it ourselves, in theme code, but it’s useless without being able to access the server-side code, since the bots can get past it.
We are on the regular Shopify plan and do not use Shopify payments as they wouldn’t let us when we started our store. We use Authorize.net instead which we found offers us some more flexibility in managing our business.
Thanks. Maybe switching to Authorize.net would somehow enable reCaptcha on checkout. We’re using another provider (Braintree).
It is absolutely ridiculous that Shopify reserves the captcha at checkout page for Plus plan only. Even simple Contact Us pages are using captcha now. Checkout page is the most important page because it involves financial transactions, but we can’t include captcha unless we subscribe to the very expensive Plus plan. We are being bombarded with fraudulent credit card transactions by bots everyday. It’s like fraudsters are using Shopify platform to verify their stolen credit cards. Shopify should be sued for helping fraudsters verify their stolen credit cards! Seriously considering alternate platforms!
same, bots testing cc non stop.
I read a few things that suggested enabling “Accounts are required” (Legacy Accounts under customer accounts ) and it does not seem to bee slowing down the bots at all.
Starting this week bots hitting my store have also started using a new email address for almost every single attempt (for months it has been the same handful of email addresses with a new one showing up every now and then).
At least Shopify Payments / Stripe did something on their end about a month ago that is rejecting all credit card transactions from the bots. Going through the payment details Shopify provides it seems like Stripe is blocking the transaction and not trying to actually authorize the card (it is labeled as high risk and as not sent to network).
I wanted to add a couple of things that might help others with this.
I started using the CartLock app to setup rules that prevent most of the bots from completing an order by blocking checkout. It’s not hard to get around the rules you can put into place but most work because the bots / people using the scripts don’t bother to figure it out or use the same few addresses / email addresses / try to purchase the same product.
This community thread Fraudulent orders won’t stop also helped. After reading it I setup a rule in Shopify Flow that doesn’t capture the credit card payment or fulfill the order if the order is flagged as high risk by Shopify.
The reason you would do this is it prevents the credit card payment from being captured. If the credit card payment is captured you will be charged fees by Shopify Payments (even if you refund the payment and cancel the fraudulent orders). If the credit card payment isn’t captured you are not charged fees.
If you use Stripe, you can enable Stripe Radar.
I use Shopify payments however if you go through the payment data that is provided Stripe seems to be the payment processor.
I am not sure when it started but I noticed at some point any of the bot transactions that get through and authorize the credit card states something like “Stripe has blocked this transaction as high risk” and a flag not_sent_to_network (implying to me that the card wasn’t verified or processed and instead just blocked).
If you connect your Stripe account directly via a third-party checkout solution, you can customize Stripe Radar settings and shape Stripe Radar rules and lists as you wish.
Google: Stripe Checkout & Subscriptions for Shopify
Just in case it helps someone else: I changed my settings to require the customer to login before checkout and that seems to have stopped the bots and the dozens upon dozens of daily incomplete checkouts for now.
Settings → Checkout → Require customers to sign in to their account before checkout.
I also have captcha enabled on login forms. Online Store → Preferences → Spam protection and Enable on login, create account and password recovery pages
