Bot Attacks on Shopify Checkouts: How to Spot and Stop Them

In October 2026 a merchant who sells 3D-printed card storage posted on r/shopify that bots were running stolen cards through their checkout, 50 to 250 tries at a time, until one worked. Refunding the first fake order still cost them $0.81 in fees. Shopify told them to install Flow, and a few hours later another 60 cards came through. Posts like this one have been showing up on r/shopify and the Shopify Community forums all year, and stores that send cart recovery texts are seeing the same pattern in their own checkouts.

This guide covers what these attacks are, how to tell a bot checkout from a real shopper, which Shopify defenses help and what each one misses, and how to keep bot checkouts out of your email and text flows.

What is a bot attack on a Shopify checkout?

Most of them are card testing. Shopify describes it as fraudsters running many small payment attempts at once to find out which stolen cards are active, then using the confirmed cards for bigger purchases or selling them on¹. Visa puts the cost of these attacks, which it calls enumeration attacks, at $1.1B a year in fraud losses, and says that a third of the accounts tested this way saw fraud within five days².

The same bots also create fake customer accounts and newsletter sign-ups, and scalper bots buy up limited drops. All of this sits inside a web where most traffic is no longer human. Thales, which owns Imperva, counted bots as 53% of all internet traffic in 2025 and bad bots alone as 40%³.

Checkout bots also tend to skip your storefront. Merchants in the r/shopify thread on one agency client's attack found the bots opening cart links that drop them straight into checkout, past storefront blocking apps and past the store's own Cloudflare settings.

Why do bots pick small Shopify stores?

A cheap product is what the bot wants. A $5 order that goes through proves the card works, and a small store's cheapest item, a sample or even a shipping protection add-on is an easy target. The reports in the forums follow this pattern:

• A Shopify Plus merchant wrote in the Shopify Community that unfinished checkouts went from about 130 in all of August to more than 11,000 after September 1, peaking near 3,800 in one day. The bot reused a handful of phone numbers, many in the 555 range, and thousands of the fake customers were signed up to the store's marketing list.
• Another merchant deleted over 2,000 fake customers in a few days, all named John Doe, after 15 years on Shopify without the problem.
• An anime and model-kit store reported 500 to 1,500 bots a day trying to buy items priced under 50 cents.

What does a bot attack cost you?

The fake orders are the smallest part. Shopify lists the rest: each chargeback counts toward your chargeback rate whether you win or lose the dispute, a surge of declined payments can raise your decline rate for real customers after the attack stops, and authorization holds can show up on the real cardholder's statement even when no payment is captured¹.

Your chargeback rate matters to your payment provider. In its Fraud Control app, Shopify counts a store as in good standing when chargebacks are under 0.4% of total orders and at elevated risk above 0.6%⁶. On a store with 500 orders a month, that is the difference between two chargebacks and three.

Then there is the cleanup. Bot checkouts fill your reports, and one merchant said their email platform bill went from $55 to $300 after fake sign-ups. Shopify filters some suspected bot checkouts out of its list, but not all automated activity, and you cannot delete a checkout yourself. They clear on their own after three months⁵.

How do you spot a bot checkout?

Shopify's own guidance points to a high volume of checkout or payment attempts using repeated or suspicious customer details⁴. Stripe adds bursts of small payments with nonsensical customer names and emails⁷. In practice, look for:

• A spike in unfinished checkouts with no matching rise in orders. If you are not sure how Shopify counts those, see abandoned cart vs abandoned checkout.
• The same cheap item, quantity one, as a guest checkout.
• Reused phone numbers, 555 numbers, generated emails and names like John Doe.
• Billing ZIP codes that do not match the card, and visits from several countries at once.
• Strings of declined payments for small amounts.

Then check one more thing: whether the bot checkouts carry phone numbers. A flood with no contact details clutters your reports but never reaches a shopper. A flood with phone numbers goes straight into your recovery flows, which is where it starts costing you message spend and sender reputation.

How do you protect your store, step by step?

1. Use Shopify Payments if you can. Its card testing protection, and the option to block high-risk checkouts, only come with Shopify Payments¹.
2. Turn on manual payment capture during an attack. You review each order before any money moves, and cancel the fake ones. This was the top suggestion in the r/shopify thread, and the merchant had not turned it on.
3. Cancel high-risk orders with Flow. Build the workflow on the "Order risk analyzed" trigger, not "Order created", so the fraud score exists when the workflow runs⁸.
4. Add checkout rules. The Fraud Control app can block checkouts by email, address, IP address or ZIP code. A single rule is not enough, though. Stripe notes that filters based on a single heuristic such as IP addresses rarely stop card testing on their own⁷.
5. Take away the bait. Raise the price of the cheapest item or hide it, make add-ons cart-only, or set a minimum order value.
6. Require login before checkout if it keeps coming. Shopify's newer customer accounts sign in with a 6-digit code sent by email⁹. In the agency thread above, it was the only change that stopped the bots, at some cost to conversion.
7. Keep bot checkouts out of your flows. More on that below.

On Shopify Plus, checkout bot protection is built for product drops. Each event lasts up to 60 minutes, and Shopify says it is not meant to fight fraud¹⁰.

How do you keep bot checkouts out of your texts and emails?

Under the federal rules on marketing calls, a text message counts as a call, and an autodialed marketing text to a mobile number needs the recipient's prior express written consent¹¹. A phone number a bot typed into your checkout is not consent. For how opt-ins and opt-outs should work, see the SMS opt-in and opt-out guide. It may belong to a real person whose details were stolen along with the card, and that person never visited your store.

• Text only shoppers who opted in to texts. Send cart recovery texts only to numbers with a recorded SMS opt-in, not to every phone number entered at checkout.
• Require real site activity. Bots that jump from a cart link to checkout never browse, so a flow that waits for a product view skips them.
• Tag and exclude. Use Flow to tag customers who match the bot pattern, and leave that tag out of every email and text segment.
• Pause automatic marketing sign-up at checkout while an attack is running. Before your big sale sends, run the SMS compliance checklist for holiday sends against your list.
• Watch failed deliveries. Made-up numbers fail far more often than real ones, so a jump in failed texts right after a checkout spike is a sign that bot checkouts are in your flow.

Once the fakes are filtered out, your recovery flow can go back to doing its job for real shoppers. The abandoned checkout recovery guide covers how to set that flow up.