Malicious bots leaving hundreds of abondoned carts

Shopify App Store
1

Hi,

We are a UK business and have a real issue on our site with malicious bots testing credit cards from the USA on our site (shopify basic plan) and leaving abandoned checkouts for low value items. This has been going on for around 6 weeks and it looks like it is impacting out google ranking, therefore traffic and therefore sales have now significantly dropped. I have turned of automated abondoned cart emails as our mail is now getting identified as spam. I have tried a few things to combat this to no avail:

  1. MIDA app - we didn’t see any impact from its bot protection
  2. Melon minimum order quantity app - since they target low value items we set a minimum order value of £30 for all international orders, this seemed to pause activity for a while and then the abandoned carts started appearing again at sub £30 value.
  3. Our current solution has been to put our low value items as out of stock, which stops the activity - but this is not a long term solution.

I have just been on the chat with shopify and am still none the wiser. I asked if i could add recaptcha to the checkout but this is not possible, though they said it would be possible to add recaptcha to the cart with some coding, then advised to come to the forum for help with this.

Have others been though this? / able to advise other solutions? / if coded recaptcha for cart themselves able advise if this helps and is worth doing? Please help

Simon

2

Hi Simon,

Really sorry to hear about this — what you’re describing is a classic card testing attack, and you’re right that it can quietly tank your search rankings (Google sees the bot spike, the bounce rate, the spam-flagged emails, and starts treating the site as low quality). Six weeks is a long time to be living with it.

A few thoughts on what you’ve already tried and what tends to actually work:

The reCAPTCHA-on-cart route Shopify suggested is hit-or-miss. Card testers often hit the checkout API directly and never load your cart page, so reCAPTCHA there can end up doing nothing while adding friction for real customers. I wouldn’t prioritise it.

A few things that tend to move the needle more:

1. In Settings > Checkout, consider enabling “Require the customer to log in to their account before checkout” (under Customer contact method). It often reduces low-effort bot attacks because it adds friction, but it won’t stop advanced attackers and may hurt conversion rates — so it’s a reasonable defensive move during an active attack rather than a permanent setting.

2. If you’re on Shopify Payments, the Fraud Control app lets you write checkout rules to block suspicious orders by IP, email, or address attributes before they become orders. Blunt but effective during an active attack. (If you’re not on Shopify Payments, this one won’t be available to you.

3. Check Google Search Console for any manual actions or security warnings. If your rankings have dropped, it’s worth confirming nothing’s been flagged there.

4. The pattern you described (low-value items, US traffic, abandoned checkouts) is exactly what IP intelligence catches — VPN/proxy detection plus repeat-offender tracking.

Now, the reason I’m writing; full disclosure, my team and I are building a Shopify store protection app called StoreGuard that’s specifically designed for this kind of attack (IP intelligence, VPN/proxy detection, customizable rules, checkout-time validation, manual review queue). We’re in development right now, working towards an App Store launch.

Your situation is exactly the kind of real-world case we want to learn from, and honestly your feedback would be incredibly valuable to us as we finalize the product. If you’d be open to it, we’d love to give you early access now and a lifetime-free Pro plan once we are ready to launch. No catch, no upsell, just our way of saying thanks for helping us build something that actually solves the problem you’re living with.

If that sounds useful, you can reach us through the contact form of our website or just reply here. Either way, hope the suggestions above help in the meantime.

Good luck — you’ll get past this.

Chris

3

Hi Chris,

Thanks for taking the time to reply. It seems that shopify help only goes so far and these forums are where the real problems get solved - I had wondered about what you mention re adding reCAPTCHA to the cart so thanks for clearing that up.

I’ll make sure to go through your other points and check those also.

From looking around the community forums I’d say there is a big demand for what you are offering - I’ll check out your website and carry on the conversation through your contact form.

Thank You

Simon

4

Hi Simon,

There is a newly released app in the Shopify App store that was built to address this issue. It detects and flags bot created checkouts and suppresses them from your email providers (although it does not prevent the checkouts from being created)

5

What you are describing sounds more like a card-testing/fraud-checkout pattern than a generic abandoned-cart bot. The tell is that they target low-value items: the bots are testing stolen card numbers against the cheapest SKU on the store. Shopify Basic plans do not have Bot Protection (that ships with Plus), so the layered approach is the only thing that works.

A few things that have helped people in similar threads:

  1. Add reCAPTCHA / Cloudflare Turnstile on the cart and checkout pages. This kills most automated checkout attempts. Shopify Plus has this native; on Basic you need a checkout-extension app or a theme-level injection.
  2. Block the specific IPs in Cloudflare. Most card-testing bot traffic comes through a small set of cheap residential proxies. Pull the IPs out of your fraud-analysis report and add them to a Cloudflare firewall rule.
  3. Block disposable and obvious-typo emails at the checkout email step. It will not stop the determined attacker but it removes a layer of low-effort traffic. I built MailShield ‑ Email Validator - Stop bad emails at checkout before they become bad orders. | Shopify App Store for exactly this; free tier should be enough for the volume you are seeing.
  4. Contact your payment processor. They have a real “card-testing alert” channel and can throttle authorisation requests from your store while the attack is active.

The Google ranking impact is real - Search Console treats sudden traffic spikes from bot patterns as a quality signal. If the abandoned-cart noise is also throwing off your conversion metrics in GA4, exclude those checkouts from your audience segments while you fix it.

6

Hi Simon

We developed an app - Kairos - to solve the issues being mentioned here. Happy to provide details.