How to Block Fake and Test Orders

Fake and test orders are more than an annoyance. A single card-testing run can push hundreds of authorization attempts through your checkout in minutes, spike your processor fees, trigger chargebacks weeks later, and leave your fraud analytics useless. The good news: most fake orders follow recognizable patterns, and you can block them before they turn into real losses.

What "fake" and "test" orders actually look like

Not every suspicious order is the same. Learning the categories helps you pick the right control.

• Card testing (carding). Fraudsters buy stolen card numbers in bulk and need to know which still work. They run tiny purchases — often your cheapest product, a $1 tip, or a $0 digital item — through automated scripts. You'll see dozens of orders in a short window, sequential email addresses, and a flood of declines mixed with a few approvals.
• Low-value probes. A single small order placed just to confirm a card works before a bigger purchase elsewhere. Easy to miss because it looks legitimate in isolation.
• Bot and stress orders. Automated traffic filling carts and hitting checkout, sometimes to scrape inventory or overwhelm limited drops.
• Internal test orders. Your own team or a developer testing the theme, forgetting to use Shopify's Bogus Gateway, leaving junk data in real reports.

Red flags to watch for

Open your Orders page and scan for clusters. Individually these signals are weak; together they are strong.

• Velocity. Five or more orders from the same IP, device, or card BIN within 10–15 minutes.
• Email patterns. Addresses like johndoe001@, johndoe002@, or long random strings on a disposable domain.
• AVS/CVV mismatches. Billing address doesn't match, or CVV fails, yet the order still gets placed.
• Mismatched geography. Billing country, shipping country, and IP country all disagree.
• Repeated tiny amounts. Multiple orders at your lowest price point, especially $0–$5.
• Odd hours. A burst of activity at 3 a.m. your time from a region you don't sell to.

A practical threshold: if you see 3+ declines followed by an approval from the same source in under 15 minutes, treat it as a card-testing run and shut the door.

Step 1: Turn on the built-in defenses

Before adding tools, close the easy gaps.

1. In Settings → Payments, enable Shopify Payments fraud filters and require CVV and postal code verification.
2. Turn on Shopify's built-in bot protection / hCaptcha for checkout and account creation.
3. Remove any $0 or near-$0 products from your live catalog, or gate them behind a real purchase. Card testers love free items.
4. Set up manual review or hold for orders flagged high-risk so nothing auto-fulfills.

These reduce noise but won't stop a determined script that rotates emails and cards.

Step 2: Block at the checkout, not after the sale

The core problem with Shopify's native fraud analysis is timing — it scores orders after they are placed. By then the authorization already happened and the damage to your processor metrics is done. To stop fake orders you need to reject the transaction at the checkout step.

This is where a checkout-level tool earns its keep. Shieldy — Fraud Filter is built on Shopify Functions, so its rules run during checkout and can decline an order before it completes. A typical setup for card testing:

• Rate-limit checkouts per IP and per device. Cap attempts at, say, 3 per 10 minutes. Scripts firing dozens of tries get cut off immediately.
• Block known bad signals. VPN, proxy, Tor, and datacenter IPs are heavily used in carding runs. Blocking these categories removes most automated traffic.
• Use AI fraud-order scoring. Orders that combine velocity, geo mismatch, and disposable email get scored high and blocked or held automatically.
• Country and IP rules. If a burst is coming from a region you don't ship to, block that country or the specific IP range.

Step 3: Keep your own tests clean

Don't create your own fake-order problem.

• Always use Shopify's Bogus Gateway (Settings → Payments → for testing) or enable test mode in Shopify Payments before running theme or app tests.
• Tag internal test orders with a clear tag like internal-test so they're easy to filter and refund.
• If you must place a real transaction to verify a flow, refund it the same day and note it, so it doesn't pollute your fraud baseline.

Step 4: Verify your rules are working

After configuring blocks, confirm they behave as intended.

• Place a test order from a VPN to confirm it's declined at checkout.
• Watch your checkout attempts vs. completed orders ratio for a few days; a sudden drop in junk attempts means the filters are biting.
• Review anything that was held rather than blocked. If legitimate customers land in review, loosen the specific threshold — for example raise the velocity limit or allowlist a trusted corporate IP.

A simple starting ruleset

If you want a starting point that stops most fake and test orders without hurting real customers:

• Block Tor, proxy, and datacenter IPs outright.
• Rate-limit to 3 checkout attempts per IP per 10 minutes.
• Auto-hold any order where billing country ≠ IP country ≠ shipping country.
• Auto-block repeat $0–$5 orders from the same source within an hour.
• Route AI-scored high-risk orders to manual review.

Tighten from there based on what you actually see. Card testers move on quickly once your store stops being an easy oracle for validating stolen cards.

Ready to stop fake orders before checkout instead of cleaning them up after? Explore Shieldy — Fraud Filter or compare plans on the pricing page.