How I Helped a Client Recover from a Card Testing Attack — And What You Can Learn
A little while ago, one of our Shopify clients got slammed with a card testing attack. If you’ve never heard of it, it’s when scammers grab a bunch of stolen credit card numbers and run them through your checkout to see which ones still work.
Sounds annoying, right? It is.
What Happened?
In our case, they tried almost 500 transactions in just a few hours. Only about 20 of those went through, but that was more than enough to cause a mess—fees, refunds, wasted time, and worst of all, zero real customers checking out while this was happening.
That was the moment it clicked—this wasn’t just noise in the background. It was stopping legitimate sales from happening. Shopify caught most of the attempts and flagged them as suspicious. But two medium-risk orders still slipped through.
The scammers went after digital products (because no shipping details are needed). They mixed up card numbers, names, emails, and IPs, but every single order used the same sketchy billing address: 77 Greatwood Lane in Villa Rica, Georgia. A quick search showed it’s been used in other fraud cases before.
Most apps can block based on name, email, IP address, shipping address, and phone number. All things that were being changed up for every order.
How We Responded
So here’s what we did:
First, we killed checkout completely. No “add to cart,” no “buy now.” The flood stopped instantly.
Next, we went through and canceled or refunded every fraudulent order. Shopify even said they’d back us up if payment processors raised issues about all the refunds.
Then we pulled in the Blockify app to block that address and filter out anyone hiding behind VPNs.
The attack stopped. A couple of weeks later, the scammers tried again, but this time our new safeguards caught it when the first successful payment went through.
Because third-party apps can block by shipping address, not billing address they were going after digital products. so we made a little tweak—marked them as “physical” with free shipping so customers had to enter a shipping address.
What You Can Learn From This
Card testing attacks can happen to any store — and they often come out of nowhere. Here are some lessons and steps you can take:
- Be alert to sudden spikes in failed checkouts or payment attempts.
- Require shipping info where possible, even for digital products.
- Use fraud prevention tools like Shopify’s fraud analysis, Blockify, or other apps that filter transactions.
- Don’t rely on blocking IP addresses — attackers often rotate them.
- Check support forums — sometimes recurring fraud addresses or patterns are reported by other store owners.
- Contact your payment processor early — so refunds and chargebacks don’t put your account at risk.
Final Thoughts
Fraud like this can be frustrating and time-consuming, but with the right protections in place, you can significantly reduce your risk. The key is to act quickly, add multiple layers of protection, and keep monitoring your store activity.
If you’re running a Shopify store and want help setting up protections like this, or just want someone to walk through your current setup, reach out to me. Better to tighten things up now than scramble during an attack.