Tired of Card-Testing Bots? How to Block Pre-Checkout Fraud on Shopify

Dealing with fraud, especially those sneaky card-testing bots that drain our pockets one small fraudulent order at a time, is a common pain point for many Shopify store owners. A recent insightful discussion in the Shopify community highlighted this challenge and offered some solid workarounds.

The conversation, kicked off by a merchant named lovelyworld, brought to light a significant challenge: how do you stop fraudulent orders before they’re even placed, especially when the native Shopify tools don’t quite cut it?

The Problem: Card-Testing Bots and Their Hidden Costs

Lovelyworld shared a frustrating experience: a sustained card-testing bot attack resulting in over 225 fraudulent $2 orders in just one month. The bots were clever, using US billing addresses, which made IP or country blocking ineffective. But there was a clear pattern in the fraud: emails like firstname.lastname###@gmail.com, where the ### represented 2-3 random digits before the @gmail.com domain.

Every single one of these fraudulent orders incurs unrecoverable transaction and processing fees – approximately $0.38 per order. Multiply that by 225 orders, and you're losing around $85 a month in pure, unrecoverable fees. That's money straight out of your pocket.

But it's worse than just the financial hit. These bots are actively validating stolen credit card numbers. Every successful $2 transaction tells the criminals that a card is live and ready for larger, more damaging purchases elsewhere. As lovelyworld eloquently put it, "By not providing effective pre-checkout blocking tools, Shopify is inadvertently serving as a daily card-validation service for fraud bots — at the merchant’s expense." It's an ongoing harm that compounds daily.

Why Native Shopify Tools Fall Short (for Pre-Checkout Blocking)

The core of the issue is that Shopify's built-in fraud prevention tools, while helpful, don't quite offer the granular control needed before an order is finalized:

• Shopify Fraud Control: This tool only supports simple “contains” text matching for emails. It lacks the regex (regular expression) capabilities, order value conditions, or product-level conditions needed to catch these specific patterns.
• Shopify Flow: While powerful with its regex and complex logic, Flow typically triggers after an order is placed. This means those pesky transaction fees are already incurred, and you can't get them back even if you cancel the order.
• Other Third-Party Apps: Even some specialized fraud apps like Beacon or Fraud Judge, as lovelyworld noted, often don't provide regex email matching at the critical pre-checkout stage.

Community Insights: Workarounds and Solutions

The good news is, our community is full of clever people finding ways to tackle these challenges. Here are a couple of insights shared in the thread:

Option 1: The "Authorize Only" Strategy (Post-Order Mitigation)

One suggestion came from tim_tairli, who recommended changing your payment provider settings to “authorize only” instead of “immediate capture.”

The idea is that if you authorize funds first, Shopify Flow can then step in. If it detects a fraudulent pattern, it can cancel the order before the funds are actually captured, preventing refund fees. It’s a smart way to minimize losses after the order is placed but before fulfillment.

Caveat: While this helps with refund fees, the initial authorization itself might still incur a small processing fee, depending on your payment gateway. It doesn't entirely block the initial fraudulent attempt from hitting your system.

Option 2: A Third-Party App to the Rescue (True Pre-Checkout Blocking!)

Sam9516 offered a promising solution that directly addresses the pre-checkout blocking need: the BeSure Checkout Rules app.

This app allows you to create a Validation Rule that can block checkouts based on specific conditions, including email address pattern matching. This is exactly what lovelyworld was looking for!

How to Set Up Pre-Checkout Email Pattern Blocking with BeSure Checkout Rules:

1. Install the App: Head over to the Shopify App Store and install BeSure Checkout Rules.
2. Create a New Validation Rule: Once in the app, look for the option to create a new "Validation Rule."
3. Set the Condition: Choose "Email address" as your condition.
4. Define the Pattern: This is the crucial part. For lovelyworld's specific bot pattern (e.g., firstname.lastname###@gmail.com), you'd use something like firstname.lastname???@gmail.com. The ? acts as a wildcard, matching any single character. So, ??? would catch emails with 3 random characters or digits before @gmail.com. You can adjust the number of ? characters based on the patterns you observe.
5. Set the Action: Configure the rule to "block checkout."
6. Add an Error Message: Provide a friendly message to the customer, like “Checkout not allowed, please contact support.” This helps legitimate customers who might accidentally trigger the rule.

Here's a visual example shared in the thread, showing how that rule might look:

This method offers a direct way to prevent fraudulent orders from making it through checkout, saving transaction fees and stopping card validation dead in its tracks.

Looking Ahead: What Merchants Really Need

While third-party apps provide excellent solutions today, lovelyworld's original request highlights critical features that would greatly benefit all Shopify merchants if implemented natively. These include:

1. Extending Shopify Flow’s powerful logic (including regex) to work as a pre-checkout blocking tool.
2. Adding order value as a condition in Fraud Control checkout rules.
3. Adding true regex/pattern matching to Fraud Control email rules.

These enhancements would empower merchants to fight fraud more effectively right out of the box, without relying on external solutions for fundamental security needs.

Dealing with fraud is an ongoing battle for any e-commerce business. It's fantastic to see our community come together, share experiences, and find creative solutions to protect our stores. Whether it's through clever payment gateway configurations or leveraging powerful apps, remember that staying proactive and sharing your insights is key to staying ahead of the fraudsters. Keep an eye on your order patterns, and don't hesitate to explore tools that give you more control over your checkout process!