Dozens of Tiny Failed Orders? You Are Being Card Tested
A run of small declined orders overnight is not a glitch. It is someone checking stolen cards against your checkout. Here is how to confirm it, stop it today, and keep your payment processor happy.
On this page
TL;DR: A burst of small declined orders is card testing: someone is running stolen card numbers through your checkout to find the live ones. It costs you authorisation fees, wrecks your decline ratio, and can put your payment account under review. Fix it in this order: add friction at checkout, cut off the networks the attempts arrive from, and remove the cheap product they are testing against. See what kind of traffic is reaching your store right now, free and without installing anything.
What you are looking at
You open your admin and there are forty orders overnight, all for €1.50, almost all declined, most with email addresses that look like keyboard mashing. Maybe two went through.
That is not a bug and it is not a bad batch of customers. Someone has a list of stolen card numbers and needs to know which ones are still live. Testing them against a real checkout is how they find out, and your store is the test bench.
The ones that succeed get sold on or spent somewhere bigger. You are left with the fees.
Why it is worth acting on today
The failed payments feel harmless because no money left your account. Three things say otherwise.
You pay for the attempts. Most processors charge per authorisation whether it succeeds or not. A few thousand attempts overnight is a real line on your bill for zero revenue.
Your decline ratio is being watched. Payment processors monitor the share of your transactions that fail. A sharp spike looks like a compromised merchant account, and the response can be a review, a reserve, or a hold on your payouts. This is the expensive part, and it lands weeks after the attack when you have forgotten the cause.
The successful ones become chargebacks. Every card that worked belongs to a real person who will eventually notice. That is a chargeback with a fee attached, and enough of them affect your standing too.
Confirm it first
Before changing anything, check the pattern. Card testing has a distinctive shape:
- Small amounts, usually your cheapest product or a single item repeatedly.
- A tight window. Dozens or hundreds of attempts over minutes or hours, not spread across a day.
- Many different card numbers, often with sequential-looking details.
- A high decline rate, frequently above 80%.
- Junk contact details. Random-looking email addresses, or one address with
+1,+2,+3variants. - Billing addresses that do not match the cards, or the same address across many different names.
If instead you have a handful of declines spread over a week from plausible-looking customers, that is ordinary payment friction, not an attack. Leave it alone.
Fix it in this order
1. Add friction at checkout, today
This is the fastest lever and the one with the clearest effect. In your Shopify admin, turn on the checkout protections available to you: enable reCAPTCHA on your checkout and contact forms, and require CVV and postal code verification if your gateway supports it. Automated testing scripts are cheap and volume-based; anything that costs the attacker time per attempt makes your store not worth the trouble.
If you use Shopify Payments, review the fraud analysis settings and consider auto-cancelling high-risk orders while the attack is running.
2. Remove the test product
Card testers need something cheap to buy. If you have a €1 sample, a low-value accessory or a digital item priced near zero, that is almost certainly what they are hitting. Unpublish it for a few days, or raise its price. This sounds crude and it works immediately, because the script is pointed at a specific product URL.
3. Cut off where the attempts come from
Look at the orders and find what they share. In most attacks the attempts arrive from a small number of networks, often hosting providers or VPN exit points rather than home broadband, and frequently from a country you do not sell to.
Three things worth blocking, in increasing order of usefulness:
- Countries you do not ship to. Simple, and it removes a slice of the noise.
- The specific networks. Blocking by ASN takes out an entire hosting provider's address range in one rule, which is far more durable than chasing individual IPs. If the attempts come from a datacenter, the traffic is automated by definition, because nobody shops from a server rack.
- VPN and proxy traffic at checkout. Card testers rarely use their own connection.
This is the part an app like Cordon handles: country, IP, ASN and VPN rules, applied to visitors rather than to orders. Shopify's own fraud tools act on the order once it exists. Blocking acts a step earlier, on the traffic that produces it. Rules take a couple of minutes to set up and there is a free plan, which matters when you are trying to stop something that is happening right now.
One warning, because it is the mistake that costs more than the attack: do not block iCloud Private Relay or mobile carrier networks in the process. Private Relay ships enabled on modern iPhones and looks like a proxy to naive detection, so a blunt "block all proxies" rule turns away a large slice of genuine mobile shoppers. Cordon treats those as ordinary customers by default, and whatever tool you use, check that it does too.
4. Watch for the second wave
Attackers come back, often from a different network. Keep an eye on your orders for a week, and check that the rules you added are catching rather than sitting idle.
What blocking will not do
Being straight about the limits, because the opposite gets sold a lot.
Blocking visitor traffic reduces the attempts that reach your checkout. It does not replace your gateway's own fraud controls, and it cannot undo a chargeback that has already started. A determined attacker with fresh residential IP addresses every few minutes is genuinely hard to stop with rules alone, which is why the checkout friction in step one matters more than the blocking in step three.
Nor is a blocking app a substitute for a conversation with your processor. If your decline ratio has spiked, tell them what happened before they notice it themselves. Processors are considerably more relaxed about an attack you reported than one they discovered.
The quiet version of this problem
Card testing is loud. You notice it because your inbox fills with order notifications.
The same infrastructure runs quieter jobs against Shopify stores every day: price scrapers pulling your catalogue, bots probing for discount codes, automated traffic inflating your session count so your conversion rate reads lower than it is. Those do not send you notifications, which is why most merchants never find them.
If the card testing was your first sign that something automated had found your store, it is worth knowing what else is arriving. Our free store scan reads only public pages, takes about fifteen seconds, and shows you what your store hands over to anyone who asks. No install, no account.