Card testing on Shopify: what helps and what doesn't

What card testing looks like

Card testing is when someone runs stolen card numbers through a real checkout, usually with small orders, to find out which cards still work. You see bursts of failed payments, small orders from strangers, sometimes the same name or email with different cards, and later chargebacks.

Start with what Shopify already gives you

If you use Shopify Payments, Shopify runs its own card testing and bot protection at checkout (Shopify's article on card testing). Keep it on, review orders that Shopify marks as high risk before you ship, and contact Shopify Support if an attack keeps going: they can see patterns across stores that you cannot.

• Do not fulfill orders flagged as high risk until you have checked them.
• Cancel and refund suspicious orders instead of shipping them.
• If you use Shopify Flow, you can tag or hold orders that match patterns you have seen.

Where checkout rules (Pro) help

Regionly Pro adds checkout rules that stop a checkout when the shipping or billing country, the email domain or the phone prefix matches your list, including Shop Pay, Apple Pay and Google Pay. That helps when an attack keeps coming from countries you don't sell to, from throwaway email domains, or from phone prefixes you never see from real customers. The buyer sees your message and the checkout cannot be completed.

Shopify does not report blocked checkout attempts to apps, so they do not appear in Regionly's block log. Orders that do get through can be tagged for review and optionally held (Flag risky orders, Pro).

Where they don't

Country, email and phone rules only stop checkouts that match them. If testers use cards, addresses and email domains from your own main market, for example US cards with US addresses on a US store, these rules will not catch them. Regionly also does not limit how many attempts a visitor can make. For that kind of attack, Shopify's own protection and Shopify Support are the right tools.

Can an app stop all card testing on Shopify?

No app can promise that. Rules on country, email domain and phone prefix stop checkouts that match them; attacks that look like your normal customers need Shopify's own protection and Shopify Support.

Do checkout rules work with Shop Pay and Apple Pay?

Yes. Regionly's checkout rules (Pro) run as a Shopify checkout validation, so they also apply to Shop Pay, Apple Pay and Google Pay.