Hi guys.
We’re seeing an unusual pattern in our Shopify store and would appreciate any advice.
Every day we receive a large number of orders from different customers via the Online Store channel.
The order totals are very similar (often the same or within a small range).
Most of these orders end up with Payment status: Expired
Most likely fraudulent orders. There are lots and lots and lots of threads here about fraudulent orders and abandoned checkout bots using stolen or fake credit cards.
Hi @edwaryhu
Like Maximus said, there are a lot of threads you can have a look. Like this one for example: Widespread Fraud Bot Using Shopify Checkout to Test Stolen Credit Cards (John Doe / Failed Payments)
Hi there @edwaryhu apologies for the inconvenience this must be causing for both you and your business. My advice would be that you try an analytics tool to see if you can pinpoint a location or certain locations where these fraud related orders are getting placed from. The next step would be to use location blockers to stop orders from coming in from those locations. Hopefully, this can put an end to the pattern and if not, I think you can also get in touch with the Shopify customer support team.
This looks like someone testing stolen credit cards. I’d suggest blacklisting them from your store. We’ve been blocking people using Blox. It will automatically detect any future attempts by the same person, so you don’t have to keep blocking new attempts with slightly different information.
What you are seeing here is a classic automated card-testing attack. Bots are running stolen credit card numbers through your checkout using small, randomized carts ($15-$16) to see which cards are valid. The payments expire or fail, but the bots will keep hammering your site. If you let this continue, your payment processor will likely flag or suspend your merchant account for excessive failed authorizations.
Native fraud apps usually misclassify these because the cart values are so low.
The most reliable way to stop the admin chaos and protect your gateway is to build a verification bypass valve natively in Shopify Flow. You need a Flow that triggers on ‘Order Created’, checks if the assessments_item.riskLevel is HIGH, and immediately triggers an ‘Cancel order’ action to kill it before it clogs your system.
