Shopify marks bot test orders as low risk
Repeated problem · 90-day evidence
Who experiences it
Small, self-fulfilling Shopify store owners (especially shops selling low-cost items like candy or candles) who rely on Shopify's native risk scoring and get hit daily with these undeliverable one-item test orders, often alongside thousands of abandoned carts from VPN-based traffic.
Workflow
Merchant notices recurring single-item orders overnight, each under a different name with a US (NYC) shipping address; Shopify's fraud analysis marks them "low risk" (even though the order IP is Taiwan/Vietnam), so the merchant ships; the package returns undeliverable because the street/address doesn't exist; merchant googles the address, cancels the order, marks it fraudulent one by one, and eats the shipping fees and chargeback risk.
Possible direction
A pattern-based card-testing screener for Shopify that clusters repeated low-value single-item orders by product, time window, fake/undeliverable address, and IP-vs-shipping-country mismatch, and auto-holds or cancels them before payment capture.
Current context
Shopify's native fraud analysis uses generic low/medium/high scoring that misses store-specific patterns (these orders pass as "low risk" despite Taiwan/Vietnam IPs with US addresses). Shopify's Fraud Control and third-party apps (Fraud Judge, CartGate, Storefront Sentry, Blockio, Sensfrx, NoFraud) target card testing via rule engines, cart/minimum-value limits, and VPN/country blocking, but merchants report they require manual rule thresholds or only block high-risk orders, leaving this repeated same-product low-value pattern undetected.
Observed from 3 distinct users across 1 discussion threads in the 90 days ending 2026-08-13. Latest evidence: 2026-07-23.
Keyword suggestions