Shopify stops logging abandoned checkouts for bot card-testing sessions
Released on , Shopify will no longer create an abandoned checkout when a bot tests a checkout with stolen card details and fails to complete payment. Read the Shopify Changelog release note here.
Abandoned checkouts are one of the most-used recovery signals in ecommerce. When a shopper reaches checkout, enters their details, and then leaves without paying, Shopify records the session so the merchant can follow up by email or SMS. The problem is that not every incomplete checkout comes from a real shopper. A meaningful share, on stores that attract them, come from automated bots running stolen card numbers through the payment step to see which ones still work.
This update changes how those sessions are handled. Shopify now recognises the pattern of a bot testing a card and failing payment, and it stops writing that session into the abandoned checkout list. For merchants, the result is a cleaner recovery list, a more honest abandoned checkout count, and reporting that reflects genuine buyer behaviour rather than fraud-probing traffic.
How it works
To understand the change, it helps to understand card testing. Fraudsters who hold lists of stolen card numbers need a way to confirm which cards are still active before they attempt larger purchases or resell the details. The cheapest way to do that is to run each card through a live checkout with a small or incomplete transaction. If the card is declined, it is dead. If it processes, it is live. This validation activity is known as card testing, a subset of the wider practice of carding, and it targets any checkout that is publicly reachable.
On a Shopify store, each of those attempts used to behave like a normal customer up to a point: the bot reached the checkout, populated the fields, and triggered a payment that was never completed. Because Shopify creates an abandoned checkout whenever a session reaches checkout without a finished order, every one of those bot attempts was logged as an abandoned checkout. A store hit by a card-testing run could see dozens or hundreds of these sessions appear in a short window, each one indistinguishable, in the report, from a genuine shopper who got cold feet.
The new behaviour adds a filter at the point where the abandoned checkout record would normally be created. When Shopify identifies a session as a bot testing a card that then fails payment, it does not generate the abandoned checkout. The session is simply not written to the recovery list. Genuine shoppers who abandon for ordinary reasons, a delivery cost surprise, a distraction, a change of mind, are recorded exactly as before. The change is targeted at the fraud-probing pattern, not at incomplete checkouts in general.
Examples and use cases
Consider a mid-sized UK store running an abandoned cart recovery flow through Shopify Email or a connected platform such as Klaviyo. The flow sends a reminder one hour after a checkout is abandoned, then a follow-up the next day. Before this change, a card-testing run overnight could inject a hundred bot sessions into that flow. Most carried fake or mismatched contact details, so the reminders bounced, hit spam traps, or simply went nowhere. The merchant woke up to an inflated abandoned checkout count and a recovery report that looked busy but converted nothing.
With the bot sessions filtered out, the same flow now contains only the shoppers worth contacting. The volume looks lower, but the quality is higher. Recovery rate, measured as completed orders divided by abandoned checkouts, becomes a more trustworthy figure because the denominator is no longer padded with traffic that was never going to buy. For an agency reporting on recovery performance, that is the difference between a metric a client can act on and one that needs constant manual caveats.
The change also helps stores that use abandoned checkout data to feed audiences. Some merchants build retargeting or lookalike audiences from people who reached checkout but did not buy. If that audience was contaminated with bot sessions, the signal passed to an ad platform was weaker. Cleaner abandoned checkout data means cleaner inputs for any downstream marketing that depends on it, which matters for UK merchants spending on Google Ads or Meta where audience quality affects cost per result.
What this means for UK Shopify merchants
The first practical point is to expect, and not be alarmed by, a possible drop in abandoned checkout volume. If your store has been a target for card testing, some of your historical abandoned checkout count was never real. A lower number after this change is a sign the report is more accurate, not a sign that fewer genuine shoppers are reaching checkout. It is worth noting the shift so that month-on-month comparisons account for it rather than reading the dip as a performance problem.
The second point concerns recovery economics. Many recovery tools and SMS platforms charge by message volume or contact count. Sending reminders to bot sessions was a small but real waste of that budget, and in the case of SMS it could mean paying to message numbers that were never valid. Filtering those sessions out trims a slice of wasted spend from any recovery programme that bills on usage. For merchants who run abandoned cart recovery as part of a managed service, our digital marketing team treats this kind of list hygiene as a standing part of campaign cost control. That matters most on the paid messaging channels, where Shopify Messaging now runs native SMS automations for abandoned cart and checkout and WhatsApp marketing campaigns, both billed per message.
The third point is about fraud awareness. This update reduces the noise that card testing creates in one report, but it does not stop card testing itself. If you are seeing card-testing activity, the underlying issue is that bots have found your checkout attractive, and that can still produce declined-transaction fees, processor scrutiny, and the occasional successful fraudulent order. The cleaner abandoned checkout list is a helpful side effect, but it is not a fraud defence. Stores under sustained attack should still review checkout protections such as bot mitigation, reCAPTCHA, and rate limiting. If your store is built and maintained with us, our Shopify web design service covers these protections as part of a managed build.
Practical considerations
Shopify has not published the exact detection criteria it uses to identify a bot card-testing session, which is sensible: publishing the rules would help fraudsters evade them. The practical consequence is that merchants cannot configure or tune the filter, and there is no setting to switch it on. It applies automatically. If you rely on abandoned checkout exports for reconciliation or analysis, be aware that the population of recorded sessions has changed, and that very recent historical comparisons will straddle the before-and-after line.
It is also worth separating this change from your fraud-analysis workflow. Shopify's fraud signals on completed orders are unaffected, and a session that never becomes an order was never going to appear in your order-level fraud review anyway. The benefit here is confined to the abandoned checkout report and anything that draws from it, namely recovery flows, recovery reporting, and audiences built from checkout abandoners. Keep your order-level fraud checks and chargeback monitoring exactly as they are, because this update does nothing to address completed fraudulent purchases.
FAQ
What has Shopify changed about abandoned checkouts?
When a bot tests a checkout with stolen card details and does not complete payment, Shopify no longer creates an abandoned checkout for that session. Previously these bot sessions were logged like genuine abandoned checkouts, which inflated recovery lists with contacts that were never real buyers.
Why were bots creating abandoned checkouts in the first place?
Card-testing bots run small transactions through live checkouts to find out which stolen card numbers still work. Each attempt reached the checkout stage and then stopped short of a completed order, so Shopify recorded it as an abandoned checkout even though there was no real shopper behind it.
Will my abandoned checkout numbers drop after this change?
Stores that were targeted by card-testing activity may see a lower abandoned checkout count, because the bot sessions that previously padded the figure are no longer recorded. This is a data-quality improvement, not a loss of genuine recovery opportunities. The buyers worth following up with are unaffected.
Does this affect my abandoned cart recovery emails and SMS flows?
Yes, in a positive way. Recovery automations that fire on abandoned checkouts will now reach a list focused on real shoppers rather than bot sessions. That tends to improve the relevance of recovery messaging and the reliability of recovery-rate reporting.
Do I need to change any settings to benefit from this?
No. The filtering happens on Shopify's side and applies automatically. There is nothing to enable in your admin. It is worth reviewing your abandoned checkout reports over the following weeks so you understand any shift in the baseline numbers.
Is card testing the same as a fraudulent order?
Not quite. Card testing is the validation step fraudsters use to confirm which stolen card numbers are live, often with very small or incomplete transactions. A fraudulent order is a completed purchase made with those details. Reducing bot noise in abandoned checkouts addresses the testing stage, so it is a reporting and data-hygiene change rather than a chargeback control.
