Shopify has a new fraud problem. Please fix it.
We've had a store for 9 years with very few problems. All of a sudden we're getting fraudulent orders for our cheapest items, all with clearly fake addresses. These orders appear to have been placed via the Shopify API, as some of the items purchased are not…
We've had a store for 9 years with very few problems. All of a sudden we're getting fraudulent orders for our cheapest items, all with clearly fake addresses. These orders appear to have been placed via the Shopify API, as some of the items purchased are not available through our website and alternate channels are turned off. I can tell we're not alone as there are other mentions of this issue on this sub. My theory is that someone has built a credit card tester that's using the Shopify API to scan for cheap products and place orders to test stolen cards. There is a relatively easy fix to this problem — allow store owners to restrict api orders to specific domains natively. Please implement this or give us another way to prevent these orders that doesn't require paying for an app. Is your store getting more fraudulent orders than usual? What have you done to fix it?
Collected discussion
We had the same issue. Chatted with Shopify support. I was going to post my full reply but I decided to create a post to help the community: https://www.reddit.com/r/shopify/comments/1u711mu/psa_bots_creating_fake_accounts_and_placing/
This
This… and create a Flow that automatically charges low risk orders. You can also create an additional Flow that will halt low risk orders for a specific low cost item that’s being ordered. Had support help my set all of this up today.
relaying this message from a Shopify Payments PM who is actively watching this thread: hey I'm a PM on the payments team at Shopify, this is very frustrating and we are actively working on solutions to help. We will be blocking more of this bad traffic so even as bot volumes increase (in the world that we're in), your checkouts are still protected.
Thanks for the helpful reply, we're giving flows a try now. I still think that store owners should have some control over api access. We got some orders via Amazon's 'Buy For Me' service, which also uses the api. We had to go through Amazon's customer service gauntlet to get them to delete the scraped products.
Setting those products as "unlisted" will remove them from the Shop app while keeping the product published.
So awesome to see them jumping in. It's one of the best things about Shopify from my time there - their teams are empowered to go understand the problem and solve it.
We have recently seen this in our store. Cheapest item is purchased, same as you describe. All but one of these have come through as high risk orders . We have now set up a flow to automatically cancel all high risk orders. However, it's frustrating to know that the perpetrator has already accomplished thier goal of testing a credit card that doesn't belong to them. This seems like a systemic problem that should be solved at a higher level.
Mods removed my post. Helpful information isn’t allowed in this subreddit.
Agentic commerce asked for this lol
Us too. We switched to manual capture payment . That way we don't get hit with credit card charges, and can cancel for no cost. If it's coming the the Shopify API, why doesn't that show up as a sales channel for us?
Somewhat recently Shopify made a change where all stores are on the shop app regardless of whether or not you want to be on the shop app. Now, you might have products in your catalog that are published but not part of the site navigation, and may be even hidden from search… but will be available for sale in the shop app whether you like it or not. There is not opt out like there used to be (you just didn’t set it up) and there also isn’t a dedicated sales channel for which products are available on the app. If it is in the Online Store sales channel, it is also in the app, and there’s nothing you can do about it. And, in the app, you can go to a store and filter by price = lowest, so that makes that item selection for what you’re talking about straightforward
Two things that I did that helped: set up a Flow activity that rejects orders that are classified as possibly fraudulent. The orders process and are immediately refunded. set up a $25 minimum order quantity. This seems to be the ultimate fix.
It’s almost certainly bots testing stolen or compromised card numbers. Around this time last year we were getting hammered with $1.29 orders originating from major cloud and data center providers. Unfortunately, it’s nothing new and is something most e-commerce stores deal with at one point or another. Luckily the emails used to sign up are always easy to spot.
Same issue
They comes in waves. Improve fraud detection + handling, and they’ll soon disappear.
Had the same issue a month ago on a 4 years old store, nothing worked, tried everything. The only thing that solved it was putting the store on password mode for about 24 hours then it went away. Processing about 100-150 orders a day it was a difficult decision but we had no other choice.
Happened 22 times in the last couple of weeks, they were using the same fake address and as it was flagged got canceled, they were using an IP masking program so hard to identify
This has been going on for a while, and Shopify has zero interest in stopping it. These scammers are looking for very cheap items, like 1 to 2 dollars. Identify which of your products are being used to test stolen carts. Then, only sell them as a bundle with other products or as a multi pack. The problem will stop.
Absolutely have seen this and 100% agree that Shopify needs to give us better tools to combat this. We have a bot blocker from outside the US to block the lazy and dumb hackers, but VPNs clearly used by sophisticated bots. Fraud help should be a default tier in everyone's best interest.
Shopify makes millions from canceled credit card fraud orders, so it's literally the fox watching the hen house (I appreciate Shopify for most things...this is not one of those things)
Happened to me multiples times. Remove your cheap item or raise the price and change to manual capture. We did this and haven’t had issues since.
the issue here is storedomain/products.json -> returns all the inventory status with a lot more info /meta.json -> returns your origin and where you ship where the store belongs to etc etc there are 3 semi graphql api requests that goes Proposal (useful for delivery to tell the store that we want our product here and some other taxes things) PCI session ( here card and card info are being sent and returns a token) SubmitForCompletion ( here this is a final requests which sends all the amount pci token returns a final order process id pollforreceipt -> queries and checks the status of the payments WE can secure it by hardly using multiple checks and ip authentication since they all use rotating proxy there are HCaptcha security but still there are soo many hcaptcha solvers these days turn off /products.json and they will cry like hell cause there will be only one way left after this -- use products scraping in that use cloudflare with hard security. multiple checks and blocking products.json is the best idea so far
Same here, though they come and go. Some days we will get 4-5 a day. Started about 2 months ago.