Card-Testing Attacks and Fraud Orders on a Small Store

Short answer: Card testing is someone running stolen card numbers through your checkout with scripts to see which ones work, usually as a burst of small payments, many of them failing. Right away, refund any that succeeded and don't ship anything from them, then make sure your checkout uses your payment provider's protected integration and add CAPTCHA and rate limits where you control the code. Separately, review high-risk orders before fulfilling them, because a single fraudulent order that ships is a lost product plus a likely chargeback.

How to recognize it

Card testing and ordinary fraud look different, and they need different responses.

Card testing shows up as volume. Stripe's documentation lists the symptoms: a spike in failed or blocked payments, a spike in declined requests, and suspicious low-value payments, often with nonsense names and email addresses. The attacker doesn't want your products; they want to know which cards are live so they can use or sell them elsewhere. Stripe also notes testers increasingly use card setup (saving a card) rather than payments, because those checks rarely show on a cardholder's statement.

A fraudulent order looks like a real sale: one order, often larger than your average, sometimes with express shipping and a billing address that doesn't match the shipping address. The goal is your product.

Both hurt. Card testing creates disputes from the payments that succeed, raises your decline rate (which Stripe warns can make issuers treat your legitimate payments as riskier, even after the attack ends), can trigger fees, and pollutes your sales data with fake "new customers."

Incident playbook

Now (the first hour)

Confirm the pattern. In Stripe, look at the Dashboard home page and the transactions list for a spike in failed and blocked payments. In Shopify, check recent orders and the abandoned checkouts list. A cluster of tiny payments in a few minutes is the giveaway.
Refund successful test payments. Stripe's own checklist says to refund fraudulent payments to avoid disputes. A refund now is cheaper than a dispute later.
Hold fulfillment of anything placed during the attack window until you've looked at it.
Contact your payment provider's support. Tell them it's card testing. Platforms can apply extra protection that you can't switch on yourself.
If you have a custom checkout, ask your developer to check whether your secret API key could have leaked. Stripe notes that testers can create payments with a stolen secret key, and a key that's been exposed should be rolled.

This week

Use the provider's recommended checkout. Stripe says its current Payment Element and Checkout include rate limiters, AI models and automatic CAPTCHA triggers, and that attacks are marked "Blocked by Stripe." Older or hand-built card forms often lack these protections. On Shopify, card testing protection is part of Shopify Payments, according to Shopify's fraud prevention page.
Add CAPTCHA where you control the code. Stripe's advice: require validation on every request that can validate a card or take a payment, check it server-side, and if a score-based invisible CAPTCHA isn't stopping it, raise the threshold or switch to a visible one.
Add rate limits. Limit how many payment or card-saving attempts one session, IP address or customer can make in a period. On its own an IP block rarely works, because testers rotate addresses, but it adds friction.
Make the payment form harder to reach. Stripe points out that easy guest access to a payment form makes attacks easier. If your form can be hit directly without visiting the store (common with donation or "pay an invoice" pages), require a session or a CSRF token first.
Send more data with each payment. Stripe says email, name, billing address and IP address all improve its card testing models. Plugins sometimes leave these out.

Ongoing

Set an alert for unusual numbers of failed payments, so you hear about the next attack in minutes, not days.
Review your payment provider's fraud settings after any platform or plugin change.
Keep high-risk order review as a habit, not just an incident response.

Reviewing risky orders before you ship

Shopify's fraud analysis gives eligible online card orders a low, medium or high recommendation, and flags medium and high orders on the Orders page. Its guidance is to judge on the overall recommendation, not on one indicator: an IP address in another state means little by itself. As of November 2026, fraud indicators are available from the Basic plan, while fraud recommendations need the Grow plan or higher, or Shopify Payments. Some orders, including those paid entirely by gift card and POS orders, get no recommendation at all.

For each flagged order, work through this checklist:

[ ] Does the card pass the address check (AVS) and the security code (CVV) check?
[ ] Does the billing country match the customer's location and the shipping address?
[ ] Did the customer try more than one card before this one succeeded?
[ ] Is the order much larger than usual, or several units of your most resellable product?
[ ] Is express shipping chosen on a first order, especially to a freight forwarder or a different name?
[ ] Do the email and phone look real, and does the customer have past orders?
[ ] Is this one of several orders from similar details in a short time?

Several ticks on the wrong side, and you have three options Shopify lists for a high-risk order: verify it, cancel it, or refund it. Verification means contacting the customer through details you trust, not by replying to a suspicious email. If you can't verify, cancel and refund rather than shipping and hoping.

Refund or cancel?

Cancel when you've decided not to fulfill: on most platforms canceling also lets you refund the payment and put the stock back, though check the options on your own cancel screen. A refund on its own leaves the order in place, which can suit an order you're still investigating or one you've partly shipped. Either way, return the money before the cardholder notices and files a dispute.

If you want time to decide before money moves, Shopify supports manual payment capture: authorize at checkout, capture after review. It adds a step for every order, so it suits stores with a small number of high-value sales.

FAQ

Why did card testers pick my store?

Usually because the checkout was easy to automate, not because of anything you sell. Small stores with older payment forms or exposed payment endpoints are attractive.

Will I be charged for failed payments during an attack?

It depends on your provider and plan. Stripe mentions authorization fees on some custom pricing plans and dispute fees. Check your provider's pricing page and talk to support.

Can I block a country to stop fraud?

You can restrict shipping destinations, and some fraud tools let you block by country, but testers rotate locations. Treat it as one layer, not the fix.

Do I need a third-party fraud app?

Not usually. Start with your provider's built-in tools and a consistent review routine. Consider an app if you sell high-value, easily resold goods and still see chargebacks.

If you're running a custom or plugin-based checkout and the card testing won't stop, let us look at how your payment form is wired.