How to stop card-testing attacks on Shopify checkout

Short answer: Block tiny guest orders — the classic pattern bots use to test stolen card numbers — while logged-in customers shop normally. In Checkpost, choose “Stop card-testing bots” from Templates, adjust the values, test it, then save and enable the rule.

The problem

Card-testing bots place many tiny orders to check whether stolen card numbers work. Each attempt costs you payment fees, chargebacks and possible processor penalties.

How to set it up

1. Install Checkpost from the Shopify App Store.
2. Open Templates and choose Stop card-testing bots.
3. Set the minimum value for guest orders.
4. Use Try this rule to test a sample cart, then click Save rule.

The rule

Checkout is blocked when all of these conditions are true:

• Customer is not logged in
• Cart subtotal is less than 5

Shoppers see: “Orders under $5 require an account. Please log in or add more items.” at the top of checkout, once they reach checkout.

{
  "name": "Guest micro-orders",
  "match": "all",
  "conditions": [
    {
      "kind": "boolean",
      "field": "customer_logged_in",
      "value": false
    },
    {
      "kind": "number",
      "field": "cart_subtotal",
      "op": "lt",
      "value": 5
    }
  ],
  "message": "Orders under $5 require an account. Please log in or add more items.",
  "target": "cart",
  "runOn": "checkout"
}

Where this rule works

These are cart and checkout validations, including supported accelerated checkouts. They are current-cart policies; they do not track previous purchases of a SKU. Shopify excludes POS, recurring subscription orders and native pre-order/Try Before You Buy flows from this API. See Shopify's validation compatibility.

Tips

• Set the threshold just above your cheapest legitimate product.
• Run it only at checkout to keep the cart frictionless for real shoppers.
• Use it alongside Shopify's built-in bot protection, not instead of it.

Can you do this without an app?

Shopify has bot protection and fraud analysis built in. A checkout rule adds a store-specific barrier that bots can't learn from other stores.

FAQ

Will real customers buying cheap items be blocked?

Only guests below the threshold. Logged-in customers aren't affected, and the message tells guests how to continue.

Does this stop all fraud?

No single rule does. It removes the cheapest attack pattern. Combine it with first-order limits and Shopify's fraud analysis.

Related rules

Add stop card-testing bots to your store