I’m hearing a lot about bot attacks on Shopify sites from authors. There appear to be two main types of attack at the moment (July 2025): Credit card testing fraud and Abandoned Carts
The first one, credit card testing fraud, is one I’ve seen happen to an author I work with this week.
What is credit card testing fraud?
Credit card testing happens when criminals purchase stolen card numbers on the dark web and “test” them online to see which are still active. They typically use bots to run hundreds, or even thousands, of small-dollar authorization attempts through a retailer’s online checkout. Cards that process successfully are flagged as valid and then resold on the black market.
What does this look like?
Here’s a screenshot from an author’s store following an attack (after the orders were cancelled and refunded):

You can see that many of the orders were flagged as high risk, some medium risk, and some weren’t spotted by Shopify at all, but they are all fraudulent. All the orders were for the same 0.99c ebook. This was particularly obvious as fraud because it is clearly noted on the product page that the book is free with a voucher code, but all the orders were for the full price.
Another clear way to spot the fraudsters was that all those orders used one of three different legitimate-looking delivery addresses, one in Wales, one in Canada and one in the US. No way did all those people live in three houses together. All the names look legitimate but all the email addresses were {name} followed by three numbers @ Gmail, Hotmail or Outlook. You wouldn’t look at an individual customer and realise there’s a problem, but when so many similar orders come in over a 24 hour period, that’s when suspicions will be raised.
What should I do if this happens to me?
It’s important to cancel all the orders immediately and refund the money before you get a chargeback.
Here is the Shopify Help video on what to do about high risk orders: https://youtu.be/U7kMNfa2eA4
Immediate Actions:
- Don’t fulfill any pending orders from suspicious orders until you’ve investigated further
- Review all orders from these addresses using Shopify’s fraud analysis to check risk levels
- Cancel and refund any unfulfilled fraudulent orders immediately
- For fulfilled orders, issue refunds to prevent chargebacks (which cost more than refunds)
Important: If payment has been taken, issuing refunds now is better than waiting for chargebacks, which result in additional fees and can damage your payment processor relationship. If you get a lot of chargebacks it can result in higher payment processing fees or your store can be shut down.
Blocking the bots
It seems to be a cat-and-mouse game to stop these bot attacks, with the fraudsters always being one step ahead and everyone else playing catchup to try and stop them. Shopify doesn’t seem to be particularly proactive or useful, from what I’ve read on the help forums.
Shopify has bot protection for its Shopify Plus stores: https://help.shopify.com/en/manual/checkout-settings/bot-protection but it only seems to work for an hour at a time, which I don’t understand, and the Shopify Plus subscription is too expensive for most of us.
Instead, here are four simple measures that might help (though none are guaranteed to work!):
1 Use an app
The first step is to get a blocker app, like BM Country Blocker IP Blocker or Blockify Fraud Filter. Search the Shopify App Store and you will find lots to choose from. You can get them for around $4-$8 a month, so they are not expensive. See the end of this article for another app solution.
Using a blocker app, you can block individual customers, IP addresses, and countries. I don’t see the point in blocking all the IP addresses that have already been used, as the bots will use different ones next time. Blocking countries could be more helpful, and you can block all the countries except the ones you sell to, in the hope that the bots will come from a high risk country you don’t sell to.
2 Review your pricing
You could make sure you don’t have any free or very cheap books in your store. Use discount codes instead to sell books for 0.99. I’ve put this text in the product description for free books and you could do the same for 0.99 books:

I also edited the product image to make it clear when people look at the collection that the book is actually free:

I can’t guarantee that this will make much difference, as ebooks are cheap anyway, even at full price.
3 Set up manual payments
You can change your settings to accept payments manually, not automatically. You have one week to accept the charge and if you do not, it does not go through and cancels automatically. https://help.shopify.com/en/manual/payments/payment-authorization#set-up-manual-payment-capture
If your store is configured to capture funds manually, then make sure that you get paid by capturing every payment that has the Authorized status as soon as possible.
The credit card authorization period for capturing payment varies depending on your payment provider. For example, Shopify Payments provides an authorization period of 7 days for credit card payments. Capture payment within the authorization period, as after the authorization period ends, you might be unable to collect any money for the order.
This will give you time to review orders.
By switching to Manual you will be able to cancel (void) the payments before they are processed and avoid the credit card processing fees you are losing on the transactions. It also prevents any possibility of a chargeback since no money is ever exchanged.
You don’t have to manually approve every payment however! You can create a flow that will assess the risk of the transaction and allow low risk orders to go through automatically and stop high risk orders.
To do this, first, set your payments to manual:
Go to Settings > Payments and select manual payments

Then in Shopify Flow (it’s an app – install it if you haven’t already) there’s a fraud flow already in the templates.

You can install and edit this workflow.
What it will do is analyse the risk of an order. If it’s high risk it will send an email alerting you. If it’s not high risk, the payment will be captured.

I edited the flow to add the email address(es) I want to be notified. I also edited it to ensure that only low risk orders are captured automatically.

This means that low risk orders should take payment as normal, but any medium or high risk orders should not automatically go through and I should get emailed about it.
This Flow is new to me so I don’t have any results or feedback on it yet. When you set this up, keep a very close eye on all orders coming in!
Note: A blocker app may be able to automatically cancel high/medium risk orders for you, so you wouldn’t necessarily need to set up manual payments and the above flow. But setting up manual payments allows you to avoid taking payments from scammers without your approval, so do consider it.
Other Flows
If you get a repeating address or customer name coming up that you know is fraudulent, you can set up flows to tag that address or customer as fraudulent:

Flow can automatically cancel orders for you.
4 Turn on ‘customers must be logged in to order’.
This is probably the most severe method you can use to prevent bots. You can set up your store so that people have to log in / create an account to buy from you. This will affect your sales, but could be a good last-ditch effort if you are being plagued with bots. Go to Settings > Checkout

Select Require customers to log into their account before checkout.
Abandoned Carts
Lots of Shopify sellers are reporting bot attacks where they get thousands of abandoned carts. Bots put items in the cart and then abandon it without checking out. This completely messes up their analytics and the sending of their abandoned cart emails. No credit card details get entered so I can’t figure out what the bots are trying to achieve here, but it’s a nightmare to prevent.
Why These Attacks Are Difficult to Block
These attacks often bypass the Shopify platform entirely. They occur directly through the payment processor’s iframe, the embedded payment form hosted by your processor. Your platform may have no visibility or control because the fraud happens inside the processor’s environment. My understanding is that any bot blocker app you install works on the Shopify pages before the cart/checkout page and so the bots bypass the protection afforded by the apps.
What can you do about this?
- Report to Shopify! This is something that needs to be dealt with by Shopify themselves, so the more people who report it, the more likely they are to do something.
- Turn off abandoned cart emails if you’re sending thousands. Or separate abandon cart from abandon checkout email automations. Since the bots are going direct to checkout, you can still capture people who are abandoning the cart prior to checkout.
- You can create a BOT segment in your email provider with rules – a) have not opened any message, b) have not placed an order, c) have not visited any URL on your website where URL does not contain ‘checkout.’ You can use this to filter out the BOT segment from all sends. If you use Klaviyo, here’s a link to their help page about creating the segment you need.
Potentially the best app solution…?
It’s called Armex: Block Checkout Bots.
From looking at the chat forums and reviews, it appears that this app works. Here is some information I’ve copied from the Shopify Community forum:
- “Blocks bots before they hit your checkout
- Cleans up your analytics & ad performance
- No more fake profiles and messed up Klaviyo data
- No more fake sessions inflating data
- Easy setup, no coding – just follow instructions
Install this app and follow the instructions. This is as close to a plug-and-play fix as it gets — and it actually works.
What Armex Firewall Does:
Acts as a Web Application Firewall (WAF) – It filters and blocks malicious or suspicious traffic before it reaches your Shopify storefront. This includes bot activity, known threat signatures, and other abuse vectors.
IP and Geo-based Filtering – It allows you to block or challenge traffic based on IP address, location, or request pattern – helpful for dealing with spam, fake carting, or scraping.
Reduces Bloat for Downstream Apps – By filtering out junk requests early, it helps lighten the load on your third-party tools (like analytics and chat) and prevents skewed reporting.
What Armex Firewall Does Not Do:
It’s not a replacement for Shopify’s CDN – Shopify already uses a robust global CDN to deliver site assets. Armex doesn’t handle asset delivery – it’s focused on traffic filtering at the request layer.
It won’t fix app-level issues – If you’re dealing with logic bugs, improper tracking setups, or app misuse, a firewall won’t help. That requires fixing the code or the app configuration itself.
It doesn’t work passively – You need to actively configure DNS routing through the firewall. If you’re not ready to manage that layer, results will be limited.
It won’t magically clean up analytics – It can stop new bad data from coming in, but it won’t fix past noise or cover every case, especially when bots behave like users at the JS level.
To summarize:
Armex can be a powerful tool for merchants who understand how to implement and manage it.
It’s not a “one click” solution, and it doesn’t replace fundamentals like proper tracking setup, UX best practices, or app performance tuning.
If you’re clear on your traffic flows, DNS setup, and Shopify behaviour, you’ll likely benefit from the added control and visibility.”
I don’t have an opinion on this app. I haven’t used it. It’s quite new and only has a few reviews. It looks worth a try if you are suffering from bot attacks and the other strategies listed above haven’t worked. There’s a 7 day free trial.