How a card-testing bot moves through a Shopify checkout, and where each defense stops it
A checkout bot opens a cart link and goes straight to checkout, skipping the storefront. It fills in made-up contact details and tries stolen cards one after another. When a card is accepted, a small order goes through and the card is confirmed as live. Checkouts the bot leaves behind are saved as abandoned checkouts with the fake details, and a recovery flow can then email or text a fake or stolen contact. Each step is tagged with the defense that stops it: a login gate, checkout rules, card testing protection, manual capture, a Flow tag and a consent gate.
Login gate
Bot opens a cart link
skips your storefront
Checkout rules
Fills in made-up details
reused phones, generated emails
Card testing
Stolen card
accepted?
Checkout rules
Tries the next card
dozens or hundreds of tries
Manual capture
Small order goes through
the card is confirmed as live
Flow tag
Saved as abandoned checkout
with the fake contact details
Consent gate
Recovery email or text sent
to a fake or stolen contact
Yes
No
Leaves
Legend
Bot step
Where it costs you
Tag = the defense that stops this step