*First written July 2025, updated November 2025.*
In this lengthy article I’m going to explain my view on what the bot attacks are, how to spot a fraudulent order, what to do if you get attacked, and how to prevent them happening again.
In 2025, several of the authors I work with have experienced multiple fraudulent orders with their Shopify stores.
There appear to be two main types of attack: Credit card testing fraud and Abandoned Checkouts. I’ll spend most of the article talking about credit card testing fraud.
It is upsetting to be plagued by fraudulent orders. You think you’ve had lots of lovely customers buying your books, only to discover they are not who they say they are, and are in fact criminals. It is depressing and costly having to refund orders, and the whole thing can be very demoralising, especially if you’re not getting many genuine orders anyway.
I work with a lovely author who was on the verge of shutting down her store altogether, because of both credit card testing and abandoned checkout fraud. It has taken a long time (and some money) to get on top of the problem, but I hope it is now sorted. I have included the lessons learned from this and other authors in this article, as I don’t want you to have to go through the same thing.
What is credit card testing fraud?
Credit card testing happens when criminals purchase stolen card numbers on the dark web and “test” them online to see which are still active. They typically use bots to run hundreds, or even thousands, of small-dollar authorization attempts through a retailer’s online checkout. Cards that process successfully are flagged as valid and then resold on the black market at a premium.
What does this look like in Shopify?
Here’s a screenshot from an author’s store following an attack (after the orders were cancelled):

You can see a long list of orders, many of which were flagged as high risk, some medium risk, and some weren’t spotted by Shopify at all. All the orders were for the same 0.99c ebook. This was particularly obvious as fraud because it is clearly noted on the product page that the book is free with a voucher code, but all the orders paid the full price.
How to spot the bots
This is an example of why it is really important to keep an eye on your orders coming in.
You might get one or two fraudulent orders at first and not notice them. However, if you suddenly get dozens at once it becomes easier to notice patterns and clues.
Firstly, look at what Shopify says about an order. It will flag orders as high or medium risk. Check your list of orders and look for the warning triangles.

If Shopify says an order is high risk (red warning) I would be inclined to trust Shopify. I haven’t yet seen it get a high risk order wrong.
The medium risk (yellow warning) orders are more of a grey area. Shopify can flag an order as medium risk if the customer has made a mistake in writing their address, for example. But often Shopify will find a fraudulent order but doesn’t have enough evidence to be certain it’s fraudulent.
With medium risk orders I would be looking out for the following:
Email address
Is it name followed by numbers @ gmail, outlook, hotmail? In my experience the email address always has some form of name followed by two or three numbers. It’s always something pretty boring, never catlover@gmail. It’ll be c.lover324 or catherine.lover345 instead.
Home address
If you get a lot of dodgy orders, you will find the same home addresses coming up. I have two authors who have had a whole bunch of orders from apparently different people who all live together in the same house in Villa Rica, Georgia. I have another author who had a bunch of orders from the same house in Caernarfon, Wales.
What they buy
Is this something you would expect the customer to use a voucher code to buy? An easy way to check is to put a book on sale using a discount code and write the code in the description – the bots won’t use the discount code (like this).
Have you had a lot of orders for the same book for no apparent reason?
How much they spend
They usually will spend around 0.99 – 4.99. I haven’t seen more than $4.99 (USD) spent by a bot and I haven’t seen them buy more than one book at a time.
Here’s a classic example of a fraudulent order:

With this particular order, it was obvious to Shopify that it was fraudulent, and was flagged as high risk.

Compare this with another order, which Shopify flagged as medium risk:

The clues here are that it’s the same book again, bought for full price when they should have used the extremely obvious discount code, and again, the email address.
What you can’t see here is that this billing address was also used in several other orders under different names, so that’s a major clue you can’t see by looking at this order in isolation.
A really good way to check if a customer is legitimate
If you are in any doubt about a customer, email them! If the email bounces back, you can be pretty certain they are not a real customer.
(Of course, real people can type in the wrong email address. You should be taking into account all the other clues I’ve discussed above to build a picture of whether you think this is a genuine customer who has made an error.)
What should I do if this happens to me?
It’s important to cancel all the fraudulent orders immediately and refund the money before you get a chargeback.
Here is the Shopify Help video on what to do about high risk orders: https://youtu.be/U7kMNfa2eA4
Immediate Actions:
- Cancel and refund any fraudulent orders immediately to prevent chargebacks (which cost more than refunds)
- Check other orders taken around the same time. Has the same home address come up before, or have other orders bought the same book as the fraudulent orders? Are there other orders with those catherine.lover345-style email addresses? Look for patterns in similar orders you previously thought were OK.
Important: If payment has been taken, issuing refunds now is better than waiting for chargebacks, which result in additional fees and can damage your payment processor relationship. If you get a lot of chargebacks it can result in higher payment processing fees or your store can be shut down.r relationship. If you get a lot of chargebacks it can result in higher payment processing fees or your store can be shut down.
Blocking the bots
It is a cat-and-mouse game to stop these bot attacks, with the fraudsters always being one step ahead and everyone else playing catchup to try and stop them.
Shopify has bot protection for its Shopify Plus stores: https://help.shopify.com/en/manual/checkout-settings/bot-protection but Shopify Plus subscription is too expensive for most of us.
Instead, here are four simple measures that might help (though none are guaranteed to work!):
1 Use an app
The first step is to get a blocker/anti-fraud app. Search the Shopify App Store and you will find lots to choose from. You can get them for around $4-$8 a month, so they are not expensive.
Using a blocker app, you can block individual customers, IP addresses, and countries. I don’t see the point in blocking all the IP addresses that have already been used, as the bots will use different ones next time. Blocking countries could be more helpful, and you can block all the countries except the ones you sell to, in the hope that the bots are coming from a high risk country you don’t sell to.
You want an anti-fraud app that can also automatically cancel and refund high risk orders for you, which saves you a job.
Have a look at BM Country Blocker IP Blocker or Blockify Fraud Filter for blocking countries you don’t want to sell to, plus cancelling high risk orders, and also NoFraud has a free tier and will cancel and refund risky orders.
There’s also this app which has a free tier and will prevent people from copying your IP: https://apps.shopify.com/securityking
2 Review your pricing
You could make sure you don’t have any free or very cheap books in your store. Use discount codes instead to sell books for 0.99. I’ve put this text in the product description for free books and you could do the same for 0.99 books:

I also edited the product image to make it clear when people look at the collection that the book is actually free:

I can’t guarantee that this will make much difference, as ebooks are cheap anyway, even at full price.
3 Set up manual payments
You should change your settings to accept payments manually, not automatically.
When an order comes in, you have one week to accept the charge and if you do not, it does not go through and cancels automatically. https://help.shopify.com/en/manual/payments/payment-authorization#set-up-manual-payment-capture
If your store is configured to capture funds manually, then make sure that you get paid by capturing every payment that has the Authorized status as soon as possible.
The credit card authorization period for capturing payment varies depending on your payment provider. For example, Shopify Payments provides an authorization period of 7 days for credit card payments. Capture payment within the authorization period, as after the authorization period ends, you might be unable to collect any money for the order.
This will give you time to review orders.
By switching to Manual you will be able to cancel (void) the payments before they are processed and avoid the credit card processing fees you are losing on the transactions. It also prevents any possibility of a chargeback since no money is ever exchanged.
However, you don’t have to manually approve every payment! You can create a flow that will assess the risk of the transaction and allow low risk orders to go through automatically and stop high risk orders.
To do this, first, set your payments to manual:
Go to Settings > Payments and select manual payments

Then in the Shopify Flow app (install it through Apps if you haven’t already) there’s a fraud flow already in the templates.

You can install and edit this workflow.
What it will do is analyse the risk of an order. If it’s high risk it will send an email alerting you. If it’s not high risk, the payment will be captured.

I edited the flow to add the email address(es) I want to be notified. I also edited it to add medium risk transactions as well as high risk transactions.

This means that low risk orders will take payment as normal, but any medium or high risk orders will not take payment and I will get emailed about it.
If you don’t want to use Flow, some anti-fraud apps can also do this process for you. For example, NoFraud has a free tier and has a setting to prevent payment of high risk orders and capture payment for low risk orders:

Again, you must set payment capture to manual.
(Please note, this app is new to me so I don’t make any guarantees about its effectiveness.)
4 Turn on ‘customers must be logged in to order’.
This is probably the most severe method you can use to prevent bots. You can set up your store so that people have to log in / create an account to buy from you. This will affect your sales, but could be a good last-ditch effort if you are being plagued with bots. Go to Settings > Checkout

Select Require customers to log into their account before checkout.
Another unpleasant flavour of bot attack: Abandoned Checkouts
Lots of Shopify sellers are reporting bot attacks where they get thousands of abandoned checkouts. Bots put items in the cart and then abandon checkout without paying. This completely messes up their analytics and the sending of their abandoned checkout emails. No credit card details get entered so I can’t figure out what the bots are trying to achieve here, but it’s a nightmare to prevent.
If you use a paid email marketing service like Klaviyo it can send your subscriber numbers skyrocketing and if you don’t suppress/delete all the bots, your monthly subscription costs will increase too.
Why These Attacks Are Difficult to Block
These attacks often bypass the Shopify platform entirely. They occur directly through the payment processor’s iframe, the embedded payment form hosted by your processor. Your platform may have no visibility or control because the fraud happens inside the processor’s environment. My understanding is that any bot blocker app you install works on the Shopify pages before the checkout page and so the bots bypass the protection afforded by the apps.
What can you do about this?
- Report to Shopify! This is something that needs to be dealt with by Shopify themselves, so the more people who report it, the more likely they are to do something.
- Turn off abandoned checkout emails if you’re sending thousands. Or separate abandon cart from abandon checkout email automations. Since the bots are going direct to checkout, you can still capture people are abandoning the cart prior to checkout.
- You can create a BOT segment in your email provider with rules – a) have not opened any message, b) have not placed an order, c) have not visited any URL on your website where URL does not contain ‘checkout.’ You can use this to filter out a BOT segment and delete or suppress email addresses in this segment.
Potentially the best app solution…?
It’s called Armex: Block Checkout Bots.
From looking at the chat forums and reviews, it appears that this app works. Here is some information I’ve copied from the Shopify Community forum:
- “Blocks bots before they hit your checkout
- Cleans up your analytics & ad performance
- No more fake profiles and messed up Klaviyo data
- No more fake sessions inflating data
- Easy setup, no coding – just follow instructions
Install this app and follow the instructions. This is as close to a plug-and-play fix as it gets — and it actually works.
What Armex Firewall Does:
Acts as a Web Application Firewall (WAF) – It filters and blocks malicious or suspicious traffic before it reaches your Shopify storefront. This includes bot activity, known threat signatures, and other abuse vectors.
IP and Geo-based Filtering – It allows you to block or challenge traffic based on IP address, location, or request pattern – helpful for dealing with spam, fake carting, or scraping.
Reduces Bloat for Downstream Apps – By filtering out junk requests early, it helps lighten the load on your third-party tools (like analytics and chat) and prevents skewed reporting.
What Armex Firewall Does Not Do:
It’s not a replacement for Shopify’s CDN – Shopify already uses a robust global CDN to deliver site assets. Armex doesn’t handle asset delivery – it’s focused on traffic filtering at the request layer.
It won’t fix app-level issues – If you’re dealing with logic bugs, improper tracking setups, or app misuse, a firewall won’t help. That requires fixing the code or the app configuration itself.
It doesn’t work passively – You need to actively configure DNS routing through the firewall. If you’re not ready to manage that layer, results will be limited.
It won’t magically clean up analytics – It can stop new bad data from coming in, but it won’t fix past noise or cover every case, especially when bots behave like users at the JS level.
To summarize:
Armex can be a powerful tool for merchants who understand how to implement and manage it.
It’s not a “one click” solution, and it doesn’t replace fundamentals like proper tracking setup, UX best practices, or app performance tuning.
If you’re clear on your traffic flows, DNS setup, and Shopify behaviour, you’ll likely benefit from the added control and visibility.”
I don’t have an opinion on this app. I haven’t used it. It’s quite new and only has a few reviews. It looks worth a try if you are suffering from bot attacks and the other strategies listed above haven’t worked. There’s a 7 day free trial.

























