Hello! I’m so glad I found this thread. I was going crazy as Shopify had no clue what it was. Have you tried not refunding? I know it doesn’t seem ethical but it is not our position to lose money. Surely these people can do fraud report on their card when they see the other people are doing this?! I’ve previously refunded with a fee. So for example I didn’t refund about 10% of the order so that it covered my fees (just an example as I can’t remember the %) but I never had anyone contact me to say they have my company on their card and don’t recognise it. Very weird that I also noticed this since Tapcart, but my recent one via web not Tapcart.
Topic summary
Merchants are experiencing waves of fraudulent orders—often 10-20+ per day with unusually high values ($1,000-$2,000+)—that appear to be credit card testing fraud. Scammers place large orders, immediately request cancellations, and test stolen cards on smaller stores before using them elsewhere.
Financial Impact:
- Even when orders are refunded, merchants still pay processing fees (2.4-3.4% per transaction)
- One merchant lost ~$10,000 in fees on $200,000+ in fraudulent orders over three days
- Another lost $15,000 in shipped goods before realizing the pattern
Common Pattern Identified:
- Many cases trace back to orders placed through Tapcart mobile app
- Fraudsters rotate through different countries when blocked
- Orders often come through Shop app, bypassing fraud detection
Critical Solution:
Enable Manual Payment Capture in Shopify Settings > Payments. This prevents automatic charge processing, giving merchants time to review orders before capturing payment (up to 7 days). Orders can be voided without fees if fraudulent.
Additional Recommendations:
- Use Shopify Flow to automate capture/void decisions
- Enable required shipping phone numbers at checkout
- Consider fraud prevention apps from Shopify App Store
- Enable Google reCAPTCHA
Ongoing Frustration:
Merchants report Shopify support provides minimal help and doesn’t proactively warn about this fraud type or recommend manual capture as default protection.