I am experiencing a sustained card-testing bot attack on my store with 225+ fraudulent $2 orders in the past month. The bots use US billing addresses, making IP/country blocking ineffective. The clearest fraud signal is an email pattern: firstname.lastname###@gmail.com (a common name followed by 2-3 digits before the [email removed]
The broader harm: Every fraudulent $2 order that goes through is not just a loss for me — it is actively helping criminals validate stolen credit card numbers. Each successful transaction confirms to the bot that a stolen card is live and usable, enabling larger fraudulent purchases elsewhere. By not providing effective pre-checkout blocking tools, Shopify is inadvertently serving as a daily card-validation service for fraud bots — at the merchant’s expense. This is an ongoing harm that compounds every single day the gap exists.
The gap: No native Shopify pre-checkout tool supports this use case:
Fraud Control only supports simple “contains” text matching for emails — no regex, no order value conditions, no product-level conditions
Shopify Flow supports regex and complex logic, but only triggers after an order is placed — fees are already incurred and cannot be recovered on refund
Third-party apps (Beacon, Fraud Judge) also lack regex email matching at checkout
What I’m losing: Approximately $0.38 in unrecoverable transaction and processing fees per fraudulent order. With 225 orders in one month, that’s ~$85/month in pure losses with no recourse.
What I’m requesting:
Extend Shopify Flow’s logic (including regex) to work as a pre-checkout blocking tool
Add order value as a condition in Fraud Control checkout rules
Add regex/pattern matching to Fraud Control email rules
This is a meaningful gap that leaves merchants absorbing real financial losses daily while simultaneously enabling criminal activity across the broader payments ecosystem.
The usual recommendation here is to change your payment provider to “authorise only” instead of “immediate capture”.
This way flow can either cancel the order (without doing actual refund, so no fees) or capture funds and allow the order to progress further.
I am having the same problem, down to how the e-mails are. And it only seems to be getting worse. Whatever Shopify changed recently, it is allowing way more of these to get through successfully. In the past 5+ years, I had maybe 2-3 go through successfully. This past week alone I have had almost 10. Most weren’t even marked as a risk either.
The practical stopgap is to make payment capture, rather than checkout, the gate. Flow still runs after the order exists, but with manual capture enabled the card has only been authorized; it has not yet gone through the captured-payment/refund path that is costing you fees.
I would set it up this way:
In Settings > Payments, change the payment capture method to Manually. Check every active payment provider first, because providers that do not support manual capture can still capture automatically, and this setting affects all online-store card orders.
In Shopify Flow, start with the Order risk analyzed trigger, not Order created. Shopify’s own high-risk-order templates use this trigger because the fraud analysis is available before the workflow decides whether to capture or cancel.
Add a Run code step that reads the order email and shop-currency amount, then returns a Boolean such as suspiciousPattern. Match the numbered Gmail pattern only when the order is also below your chosen low-value threshold. Keep Shopify’s risk recommendation as a separate signal so a legitimate customer who happens to match the email shape is not automatically rejected on that fact alone.
On the suspicious branch, tag the order, send an internal alert, and cancel it without capturing payment. On the normal branch, capture only orders that meet your accepted risk rules; send uncertain orders to manual review. Shopify provides a template for capturing payments on acceptable-risk orders that can be adapted for this.
Test each branch with controlled orders before turning it on, then watch the Flow run history and uncaptured-order queue closely. Shopify Payments authorizations generally need to be captured within seven days, so the review branch needs a daily check.
This does not give Shopify a true pre-checkout regex blocker, and the temporary authorization can still appear on the cardholder’s account. It does, however, prevent the automatic capture-and-refund cycle while preserving a review path for legitimate low-value orders. I would also send the attack timestamps and order IDs to Shopify Payments support so the sustained card-testing pattern is documented.
Disclosure: TinyOps Studio builds and tests fixed-scope Shopify Flow automations, including the Run code matcher and capture/cancel branches. But the structure above is enough to implement this internally if you prefer.
Shopify needs to step up because their system is not marking the orders with any Order Risk. I am getting several orders every day that look just like this one and you can see Shopify marked it Low. Cannot create a Shopify Flow when it marks someone using 61 payment attempts as a Low risk. Shopify is literally making having a store very difficult. We need a better solution!
I think you’ve highlighted an important distinction between detecting fraud after an order is created and preventing it before the payment is processed.
Shopify Flow is very flexible but because it runs after the order exists it can’t prevent the transaction fees that merchants incur during card testing attacks. For stores experiencing these attacks at scale that cost adds up quickly.
Having more advanced conditions in Fraud Control such as regex email matching and the ability to combine conditions like order value would give merchants much more targeted protection without relying solely on broad blocks that may affect legitimate customers.
Preventing these transactions before they’re authorized would not only reduce merchant losses but also make it more difficult for fraudsters to use stores for card validation. I think this is a reasonable feature request and one that could benefit merchants dealing with persistent card testing attacks.
