How to Prevent Shopify Card Testing
Card testers use your checkout to check stolen cards, leaving you with failed payments, chargebacks and confused cardholders. Here's how to spot them and block them automatically.
Short answer
Shopify Payments has some built-in card-testing protection. Ongoing Defender adds automatic blocking at checkout: after repeated checkouts with the same email, phone or address, that detail is blocked, and blocked buyers see no payment methods at all, so there's nothing left to test.
Signs of card testing
- Bursts of failed payments, minutes apart.
- Small orders for your cheapest products.
- Made-up names like John Doe, with a new email each time but the same address or phone.
- Lots of abandoned checkouts appearing at once.
- Customers contacting you about charges or holds they don't recognise.
What card testing costs a store
- Chargeback fees on any test orders that go through.
- A rising dispute rate, which payment providers watch closely.
- Holds on real cardholders' statements, which lead to angry emails.
- Hours spent cancelling, refunding and cleaning up.
How to do it with Ongoing Defender
- 1Install Ongoing Defender and turn on Checkout rules.
- 2Turn on Stop repeated checkout attempts and approve the permission Shopify asks for.
- 3Keep the default of 5 checkouts within 60 minutes, or set your own limit.
- 4Switch on Block disposable email addresses, since testers rely on throwaway inboxes.
- 5Look over Checkout rules now and then. Automatic blocks are marked Added automatically.
Rules run on Shopify's own servers, so bots that go straight to checkout without loading your store are caught too.
What happens when a tester is blocked
- They see no payment methods, including Shop Pay, Apple Pay and Google Pay, so there's nothing to test a card against.
- They see no shipping options either, so they can't get any further.
- They see your message, which never says which rule matched.
- The block stays in place until you remove it.
Private and tamper-proof
Counting keeps only scrambled fingerprints of each detail, never the details themselves, and deletes them after a day. Checkouts are reported by Shopify and signed, so nobody can fake attempts to get a real customer blocked.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Block repeat testers automatically | Temporary IP blocks that usually lift within a day | Blocked until you remove them |
| Catch bots that skip your storefront | Storefront checks don't see them | Rules run inside checkout |
| Hide wallets like Shop Pay and Apple Pay | Needs an app | Automatic for blocked buyers |
| Choose how strict to be | Not built in | Set your own limit |
Tips for best results
- During an attack, tighten the limit, for example to 3 checkouts in 30 minutes, then relax it once things calm down.
- Consider manual payment capture during a wave, so you only take payment after checking each order.
- Cancel and refund any test orders that got through before the cardholder disputes them.
- Pair it with datacenter blocking to keep card-testing bots off your storefront too.
Related guides