WooCommerce Card Testing Attacks: How to Spot and Stop Them

You open WooCommerce in the morning and something is wrong. 47 new orders. Exciting for half a second, until you see they’re all “Failed”. Different names, different countries, all buying your cheapest product. Some went through.

Your store isn’t suddenly popular. It’s being used as a card testing machine.

What card testing actually is

Criminals buy lists of stolen card numbers cheaply. Before they use a card for a big purchase, they need to know if it still works. So they run tiny transactions on small online stores, often thousands in a night, using bots.

Your store gets picked because:

• It has a cheap product (a $2 sample is perfect for them).
• Guest checkout has no friction.
• There’s no CAPTCHA or rate limit on checkout.
• It’s on WooCommerce, which bots know how to target.

Why this is more dangerous than it looks

It’s tempting to shrug (“they failed, no harm done”). But:

• Payment processors watch your failure rate. A spike of declines can get your Stripe or PayPal account limited, put on hold, or closed. For a store, that’s the real disaster.
• Every attempt can cost you a fee, even declined ones with some providers.
• Successful test charges become chargebacks when real cardholders notice. Each one costs you a fee and hurts your account.
• Your order list fills with junk, stock gets reserved, and your emails go out to fake addresses, which harms your email reputation.

How to spot it (the signs)

• Many orders in a short time, usually at night your time.
• Most are Failed or Pending payment.
• Same low-price product, quantity 1.
• Random names, mismatched billing countries and IP addresses.
• Emails that look generated (random letters @gmail.com).

If you see three or more of these, you’re being tested.

Stop it today: the emergency steps

1. Turn on CAPTCHA on checkout. Cloudflare Turnstile is free and invisible to most real customers. reCAPTCHA v3 also works.
2. Rate-limit checkout. Limit how many orders one IP address can attempt per hour. Many security plugins and Cloudflare rules can do this.
3. Temporarily raise your cheapest price or hide the cheapest product if it’s the target.
4. Turn on your payment provider’s fraud tools. Stripe Radar rules, for example, can block cards whose billing postcode doesn’t match, or block certain countries you never ship to.
5. Tell your payment provider. Seriously. A quick message (“we’re under a card testing attack and have added protections”) shows good faith if your failure rate already spiked.
6. Cancel the fake orders and refund any that succeeded before the real owners raise chargebacks.

Longer-term protection

• Require an account or an email check for very cheap orders, if your store model allows it.
• Block countries you don’t ship to, at checkout or with a firewall rule.
• Watch your WooCommerce logs and payment dashboard weekly, not just your sales.
• Keep payment plugins updated. Gateways regularly add anti-fraud features.

A note for store owners who don’t have time for this

Card testing usually starts on a Friday night or a holiday, exactly when you’re not watching. The cheapest fix is preventing it, not cleaning up after it.

My anti-fraud and security hardening sets all of this up in one go (CAPTCHA, rate limits, firewall rules and payment provider settings) for a fixed price, with a 30-day warranty.

Want to check your store’s weak spots first? The free Website Health Checker takes 20 seconds. If you’re under attack right now, message me and I’ll help you stop it today.