A run of small failed orders appears overnight. Different names, different addresses, tiny amounts, most of them declined.
That is usually not spam in the ordinary sense. It is card testing — someone checking which numbers from a stolen batch still work, using your checkout as the test rig.
Understanding that changes how urgent it is, because unlike contact form spam, this one has a direct financial cost to you.
What card testing costs your shop
Gateway fees on declines. Many processors charge per authorisation attempt, successful or not. A few thousand declines is a real invoice.
Your decline ratio. Processors watch the proportion of failed attempts on an account. A spike gets you flagged, and in serious cases reserved against or terminated. This is the part shop owners underestimate — the fraud is not the main risk, losing your ability to take payments is.
Chargebacks on the ones that succeed. A card that works becomes a real order. The chargeback arrives weeks later, and you pay the fee whether or not you shipped anything.
Server load. Each attempt is a full checkout request — session, cart, gateway call. A sustained run behaves like a small denial-of-service.
Your data becomes useless. Conversion rate, average order value, abandoned-cart figures — all polluted for as long as it runs.
How to recognise it
Card testing has a recognisable shape:
- – Small amounts, often the cheapest item in your shop
- – A burst, dozens or hundreds within a short window
- – Mostly declines, with a few successes scattered through
- – Mismatched details — name, email and billing address with no relationship to each other
- – Guest checkout, no account, no browsing history before the order
- – The same product repeatedly, because the attacker is not shopping
If you see small failed orders clustered in time on one cheap product, that is what you are looking at.
How to stop it
1. Rate limit checkout attempts
The single most effective measure. Card testing depends on volume — a script that can only attempt three checkouts per address per hour is not useful for the job.
Limit per address and per network range. The network part matters: attacks rotate addresses within a block, and a per-address limit alone barely slows them down.
2. Block the endpoint, not just the page
Attackers post directly to the checkout endpoint. They do not load your checkout page, so anything enforced only in the browser — a JavaScript check, a client-side CAPTCHA — never runs.
Protection has to sit where the order is created.
3. Score the submission
The details in a card-testing order rarely hold together. The email domain does not match the name. The billing country does not match the address. The form was completed impossibly fast. Any one of those is weak evidence; together they are conclusive, and none of it is visible to a genuine customer.
4. Country rules, if you ship regionally
If you only ship within one country, checkout attempts from elsewhere are not lost sales. Excluding them removes a large share of automated attempts in a single setting.
Only do this if it is genuinely true of your shop.
5. Talk to your payment provider
Stripe Radar and equivalents have card-testing rules that are off or loose by default. Turning them up costs nothing and works at a layer your site cannot reach.
Do this as well as protecting the checkout, not instead of it — those rules act after the attempt has already reached your gateway, which is after your decline ratio has already been affected.
6. What not to do
Do not add a CAPTCHA to checkout. It is the single most conversion-sensitive page you own. Every puzzle between “I want this” and “paid” costs real orders, and it will not stop a direct post to the endpoint anyway.
If you take one thing from this article: fix checkout abuse with invisible checks, never with friction.
After an attack: what to clean up
Cancel the fake orders rather than deleting them, so your gateway records still reconcile.
Check for successful ones. Any order that went through from the same run is likely a stolen card. Refund before shipping — a refund costs you the fee; a chargeback costs you the fee, the goods and a dispute mark.
Do not delete the customer accounts without checking for orders first. In WooCommerce, deleting a user can orphan order records.
Watch your decline ratio for a few weeks and tell your processor if it looks bad. Providers are far more forgiving of a merchant who reports an attack than one who leaves them to notice.
How to know it has actually stopped
Order volume is noisy. A quiet week proves nothing.
The useful measure is attempts, not orders. GatekeepWP scores every checkout submission and records the verdict — and Monitor Mode does that without blocking anything, so on a live shop you can confirm what it would catch before you let it act. On a checkout, that ordering matters more than anywhere else on the site: you want certainty before anything sits between a customer and paying you.
Frequently asked questions
What is card testing? Someone with a batch of stolen card numbers uses a public checkout to find which still work, usually with small purchases so the charge is less likely to be noticed.
Why did my shop get targeted? Almost never deliberately. Checkouts are found by crawling, and a small shop with a cheap product is an easier test rig than a large one with fraud tooling.
Will a CAPTCHA on checkout stop it? It will cost you real orders and will not stop a direct post to the checkout endpoint. Rate limits and submission scoring are the right tools here.
Should I refund the orders that succeeded? Generally yes, before shipping. A refund costs a fee; a chargeback costs the fee, the goods and a mark against your account.
Can this get my payment account closed? A sustained spike in declines can lead to review, reserves or termination. That is the real risk, and it is why rate limiting is worth doing today rather than next month.
TL;DR — Small failed orders in a burst mean card testing. Rate limit checkout by address and network, score the submission, tighten your gateway’s fraud rules — and keep friction off the checkout page.
Related: How to stop WordPress contact form spam — the same principles, lower stakes.
Try it: GatekeepWP protects WooCommerce checkout, registration and login alongside every form, with no checkout friction. Free, no API key.
