What Card Testing Actually Costs a Merchant

What card testing actually is

Card testing is the process of validating stolen card numbers by attempting small transactions. A fraudster acquires a list of card details — bought in bulk, usually from a data breach — and needs to know which ones still work before selling them on or spending against them.

Your Shopify checkout is a convenient way to find out. It is public, it accepts cards, and it returns a clear answer: approved or declined. A working card is worth considerably more than an untested one, so there is a direct financial incentive to run the list somewhere.

This is almost always automated. A human testing cards one at a time would not be economic. Scripts drive a headless browser or hit the checkout endpoint directly, running hundreds or thousands of attempts an hour, which is why the defence has more in common with bot detection than with traditional fraud screening.

The important consequence: the fraudster does not want your products. Card testing is not an attempt to steal goods. Many attempts are for small amounts, on cheap items, and some never complete at all. Merchants who assume fraud means stolen stock often miss it entirely.

How to recognise card testing on your store

The signature is repetition. Individually the attempts look unremarkable; together they form a pattern no normal customer produces.

• A sudden spike in declined or failed payments, often overnight in your timezone
• Many attempts on the same product, usually your cheapest item or a gift card
• Repeated attempts from one IP address, or one device fingerprint across many IPs
• Multiple different cards with the same billing address, or the same card with slight variations
• Email addresses that follow a pattern — random strings, or a single address with plus-addressing
• Orders from countries you do not normally sell to, arriving in clusters
• A conversion rate that looks oddly high in analytics while revenue does not move

Shopify shows failed payment attempts in your admin, but they are not surfaced prominently and there is no alert when the rate changes. Most merchants discover the problem through their payment provider rather than through their own dashboard.

Where the cost of card testing actually comes from

The instinct is to count the fraudulent orders. That is usually the smallest line. Here is the full picture, roughly in order of how much damage each does.

Authorisation and gateway fees. Many providers charge a small fee for every authorisation attempt, including declines. A single fee is negligible; ten thousand attempts is not. This cost accrues whether or not any payment succeeds, which is what makes card testing expensive even when nothing is stolen.

Chargebacks on the ones that go through. Where a test payment succeeds and is later disputed, you lose the transaction value, the goods if they shipped, and a chargeback fee that is typically far larger than the order. A small order that triggers a chargeback fee usually loses money several times over.

Chargeback fees are published, so this one you can pin down. Shopify charges a flat fee per chargeback for US merchants, refunded only if you win — and on card testing you rarely do, because the charge genuinely was not authorised. The wider figure the industry uses is from LexisNexis Risk Solutions, whose True Cost of Fraud study puts the full cost at several dollars for every dollar of direct fraud once fees, replacement and staff time are counted.

Your dispute ratio. This is the cost that ends businesses rather than merely annoying them. Card networks monitor the ratio of disputes to transactions, and crossing the threshold moves you into a monitoring programme with additional fees, mandatory remediation, and — if it continues — loss of card acceptance. A store that cannot take payments is not trading.

The thresholds are public and worth knowing before you need them. Visa lowered its Acquirer Monitoring Programme threshold in April 2026, and Mastercard runs an Excessive Chargeback Merchant programme with its own limit and a minimum dispute count. Shopify sets out how both apply to its merchants in its fraud and dispute monitoring documentation. Crossing a threshold can mean monthly fines, a rolling reserve held against your payouts, and in the end the loss of card processing.

Staff time. Someone has to review the flagged orders, contact the customers, cancel the fraudulent ones, and answer the provider. On a small team this is the owner, doing it in the evening, instead of the work that grows the business.

False declines. This is the cost nobody measures. Tightening your rules after an attack rejects genuine customers alongside fraudulent ones, and a declined customer rarely tries again. Industry research has long suggested that false declines cost merchants more in aggregate than fraud itself — which is why blunt blocking is not a solution.

Infrastructure and reputation. High-volume attempts consume server capacity and can slow the store for real customers. Sustained abuse can also affect how your domain is treated by fraud-scoring services further down the chain.

Why card testing is usually spotted too late

The delay is what makes this expensive. Test charges clear, the orders look ordinary, and you may ship. Nothing appears wrong for two or three weeks — then the real cardholders see the charge, call their banks, and the chargebacks arrive together.

By then you have lost the goods, the shipping, the transaction and the dispute fee on each one, and your dispute ratio has moved. Attacks also tend to run overnight in your timezone, precisely because nobody is watching.

This is why detection matters more than reaction. A store that cancels a suspicious order within seconds loses a fee at worst. A store that finds out three weeks later has already shipped the stock and is arguing a dispute it will not win.

Working out your own number

The figures illustrated at the top of this article are an example of how the costs stack up, not a benchmark. Your own numbers will differ, and they are the only ones worth acting on.

General figures are close to useless here, because the cost depends on your provider's fee structure and your order volume. Work it out from your own account instead.

• Find your per-authorisation fee, including on declines, in your payment provider's pricing
• Count failed payment attempts during a suspected attack window in your Shopify admin
• Find your chargeback fee, and count disputes traceable to the same period
• Estimate hours spent reviewing and responding, at whatever that time is worth
• Check your current dispute ratio against your provider's threshold

Multiply the first two, add the third, add the fourth, and the number is usually larger than expected — and that is before counting the customers you declined by mistake in the aftermath.

What you can actually do about card testing

Start with an uncomfortable fact: no Shopify app can block your storefront checkout — a constraint we explain in full on the FlexifyGuard product page. Shopify controls that page, and no third-party app can stand in front of it — Shopify's own fraud documentation describes what the platform does and does not permit. Anything claiming to block fraudulent checkouts outright is describing something the platform does not permit.

What is possible is fast detection and fast reversal — scoring each order the moment it is created and cancelling the ones that fail before anything is fulfilled. That distinction matters when you are comparing tools, because it separates the ones that describe the platform accurately from the ones that do not.

Practical measures, roughly in order of effect:

• Bot detection — card testing is automated, so detecting headless browsers and automation frameworks addresses the mechanism rather than the symptom
• Rate limiting by IP and by device fingerprint, since a fingerprint survives an IP change
• Enable every fraud control your payment provider offers, including 3D Secure and address verification, configured in your payments settings rather than in an app
• Watch failed payments as a metric in their own right, not just successful orders
• Review flagged orders rather than auto-declining everything, so genuine customers are not lost
• Reconsider gift cards and very low-value products as entry points, since these are common test targets

Shopify's own fraud analysis runs on every order and is a reasonable baseline. It is designed to flag risky orders for review rather than to stop automated attempts at volume, so it works best alongside bot detection rather than instead of it.

Why the tooling gap exists

Enterprise fraud platforms handle this well and are priced accordingly, usually with a monthly minimum that assumes substantial volume. That leaves most independent merchants choosing between nothing and something built for a business several times their size. We work with stores in exactly this position — see high-risk and high-volume eCommerce.

We built FlexifyGuard because we kept meeting this gap while running stores for clients. It scores every order the moment it is created and cancels high-risk ones within seconds through Shopify's Admin API, with bot detection aimed specifically at the automation that makes card testing viable. It cannot block checkout, and we say so on its own page — because a tool that misdescribes what it does is worse than no tool at all.

Common mistakes to avoid

Shopify theme selection checklist

Final thoughts

Card testing is not a dramatic event. It is a slow, quiet cost that accumulates in fees and staff time long before anyone loses stock, and its most serious consequence — losing the ability to accept cards — arrives with very little warning.

The useful response is not to block harder. It is to see the attempts, understand what they are costing, and cancel the bad orders quickly enough that they never reach fulfilment, while leaving genuine customers alone.

If you are seeing a pattern like this on your store and are not sure what it is costing you, send us the details and we will look at it with you.

Frequently asked questions