Why am I getting lots of small orders with fake names on Shopify?

That pattern often means card testing: scripts trying stolen cards with small amounts to see which work. Do not fulfil the orders; cancel or refund them and review your fraud settings.

Will cancelling a card-testing order stop a chargeback?

Not always. Cancelling or voiding helps reduce the risk, but the cardholder's bank can still file a chargeback, and an authorisation hold can appear on the real cardholder's statement even when nothing was captured.

Does Shopify protect against card testing?

Shopify Payments includes integrated card testing protection and can block some high-risk checkout attempts before an order is created. You still need to review risky orders, because some attempts become placed orders.

Does card testing hurt my store after it stops?

It can. A surge of declines can increase your decline rate for legitimate customers even after the attack ends, and chargebacks count toward your chargeback rate.

Is Shopify's bot protection a fix for card testing?

Not on its own. It is a Plus feature aimed at auto-checkout bots during flash sales, and Shopify says it is not meant to combat bot-related fraud.

— Fraud and bots on Shopify · Guide

How to stop card testing on Shopify

Published 27 October 2026 · Sources read 27 October 2026 · General information, not legal advice

Short answer

Card testing is when someone runs automated scripts that make many small payment attempts to find out which stolen cards work.^[1] To stop it on Shopify, do not fulfil the suspicious orders, cancel or refund them, switch to manual payment capture while it lasts, and block the emails, IP addresses and billing details involved with Shopify's fraud tools and Flow.^[1]

What card testing is, and why it costs you even when orders fail

Card testing goes by several names: carding, account testing and card enumeration.^[1] The people behind it have lists of stolen card numbers and need to know which still work. A small online store is a convenient place to check, so they point a script at its checkout and try many cards with small amounts at once.^[1] Cards that pass are used for bigger purchases or resold.^[1]

Some attacks only try to save card details rather than buy anything. Those attempts may never appear on a cardholder's statement, so they can go unnoticed for longer.^[1]^[4]

The damage lands on you in three ways:

Chargebacks. The real cardholders later dispute charges they did not make. Every chargeback counts toward your chargeback rate, whether you win the dispute or not.^[1]
A higher decline rate. A surge of declined transactions can raise the decline rate for your genuine customers, even after the attack stops.^[1] Stripe makes the same point: many declines make all of a business's transactions look riskier to card issuers.^[4]
Fees and noise. Card testing can bring extra authorisation and dispute fees, and fake orders muddy your sales data.^[4]

How to tell you are being card tested

Card testing is usually obvious once you know what to look for. The common signs are:

a sudden spike in failed or declined payments;^[4]
many low-value orders or attempts in a short time, often with nonsensical names and email addresses;^[4]
orders that Shopify's fraud analysis marks as medium or high risk, flagged with a warning symbol on the Orders page;^[2]
checkout attempts in the Blocked view of Orders > Abandoned checkouts, with "Blocked due to high risk of fraud" in the timeline.^[3]

Do not rely on the abandoned checkouts list alone: Shopify says checkout attempts it identifies as suspected card testing or bot activity are not included in abandoned checkouts.^[1]

What to do during an attack

1
Stop fulfilment of the suspicious orders
Hold anything that looks like part of the attack. Fulfilling high-risk orders puts you at greater risk of chargebacks, which Shopify warns can lead to payment processing being disabled.^[3]
2
Cancel high-risk orders, and refund what was captured
Use fraud analysis to find the suspicious orders and cancel them before fulfilment.^[1] If an order is high risk you can try to verify it, cancel it or refund it.^[2] Stripe recommends refunding suspicious payments that got through, to avoid disputes.^[4] Be aware that cancelling does not stop the cardholder's bank from filing a chargeback, and that an authorisation hold can show on the real cardholder's statement even if you never captured the money.^[1]
3
Switch to manual payment capture for now
Manual capture lets you review high-risk orders before funds are collected.^[1] It adds a step for your team, so you may want to switch back once the attack ends.
4
Block what the attack is using
If you use Shopify Payments, review its fraud prevention settings: you can configure AVS and CVV filters, and use the Fraud Control app to block specific email addresses, IP addresses or billing details.^[1]
5
Automate the response with Shopify Flow
Flow can run workflows that automatically flag, hold or cancel orders that match high-risk patterns, so you are not reviewing every order by hand.^[1]
6
Watch the Blocked view and your disputes
Check the Blocked view in Abandoned checkouts to see what is being stopped,^[3] and go to Orders to review any open chargebacks and inquiries.^[1]

How to make your store a harder target

Use the tools Shopify already gives you

Card testing protection is built into Shopify Payments.^[1]
Fraud analysis gives each eligible order a low, medium or high risk recommendation, with fraud indicators you can investigate.^[2] It is available to stores on Shopify Payments, and on the Grow plan or higher with most other processors.^[1]
Proxy detection flags customers using a proxy service or IP address, on Shopify Payments.^[1]
The Fraud Control app shows a dashboard of chargebacks, fraud cancellations and risk. Shopify is clear that it gives insight but does not actively protect you or guarantee coverage against chargebacks.^[7]

If you are on Shopify Plus

Plus stores can ask Shopify Plus Support to activate bot protection, which adds a reCAPTCHA or hCaptcha challenge to checkout during an event of up to 60 minutes.^[6] Shopify describes it as a fairness control against auto-checkout bots during flash sales, and says it is not meant to combat bot-related fraud,^[6] so treat it as a supplement, not a card-testing fix.

If you run a custom checkout or payment integration

Stripe's guidance for its own integrations is a good checklist for any custom payment form: require a CAPTCHA that is validated server-side on every request that can save a card or make a payment, require login or a session before payment, add rate limits (for example on new customers created from one IP address in a day), and do not keep retrying cards saved during an attack, because that repeats it.^[4] Simple filters on a single signal such as IP address are usually not enough on their own.^[4]

After the attack

Keep refunding or cancelling stragglers from the attack before they are fulfilled.
Respond to any chargebacks that arrive, with the evidence Shopify lists for fraud disputes, such as AVS and CVV results and delivery confirmation, where you have it.^[5]
Note what the orders had in common (amounts, email domains, shipping addresses, times) and turn it into a Flow rule or a block list entry.^[1]
Decide whether to keep manual capture on for some order types, such as first-time customers or high-value orders.^[1]

Where Estre fits

Estre is a Shopify app from the same company as this site. It checks every new order and customer account as it arrives, holds high-risk orders so they cannot ship until you Approve or Block them, and explains every flag in plain words.^[8] On the Secure Pro plan its checkout guard stops bots and bulk buys at checkout.^[8] It works on the orders and accounts that reach your store, alongside Shopify's own payment-level protections rather than instead of them.

Read more on the Estre page, on Shopify fraud protection, and in our guide to stopping fake customer accounts, which often arrive alongside card testing.

Questions

Why am I getting lots of small orders with fake names on Shopify?: That pattern often means card testing: scripts trying stolen cards with small amounts to see which work.^[1]^[4] Do not fulfil the orders; cancel or refund them and review your fraud settings.
Will cancelling a card-testing order stop a chargeback?: Not always. Cancelling or voiding helps reduce the risk, but the cardholder's bank can still file a chargeback, and an authorisation hold can appear on the real cardholder's statement even when nothing was captured.^[1]
Does Shopify protect against card testing?: Shopify Payments includes integrated card testing protection and can block some high-risk checkout attempts before an order is created.^[1]^[3] You still need to review risky orders, because some attempts become placed orders.^[1]
Does card testing hurt my store after it stops?: It can. A surge of declines can increase your decline rate for legitimate customers even after the attack ends, and chargebacks count toward your chargeback rate.^[1]
Is Shopify's bot protection a fix for card testing?: Not on its own. It is a Plus feature aimed at auto-checkout bots during flash sales, and Shopify says it is not meant to combat bot-related fraud.^[6]

Hold risky orders before they ship

Estre checks every new Shopify order as it arrives and holds high-risk ones until you Approve or Block, with its reasons on the order. The Free plan flags bot sign-ups and risky orders and judges 100 orders a month.

See Estre on the Shopify App Store

Disclosure: Estre is made by Misimi Corp, which also makes Shaewoo and publishes this site.

Sources

Every fact in this guide links to one of these, read on 27 October 2026. Estre is named only where it is relevant; nothing here is a review, a rating or a promise about results.