Shopify marks bot test orders as low risk

Executive Brief

Card-testing bots are placing repeated middle-of-the-night orders for a single low-cost item (e.g., one chocolate bar) under different names with fake NYC addresses that come back undeliverable. Shopify's native fraud analysis keeps scoring these orders 'low risk' even though order IPs are Taiwan/Vietnam while shipping is US, so self-fulfilling small stores ship, absorb return shipping and chargeback risk, and must catch each order manually. Three merchants in one r/shopify thread document the identical pattern (same product, overnight window, '123 Main Street' style fake addresses, plus thousands of VPN-driven abandoned carts). The focused direction is a pattern-based card-testing screener that clusters repeated low-value single-item orders by product, time window, fake/undeliverable address, and IP-vs-shipping-country mismatch and auto-holds or cancels them before payment capture. All measured keywords returned no search data, so demand rests on ecosystem concentration rather than visible search volume.