How to Stop WooCommerce Card Testing and Fake Orders

You open your laptop, check your store, and something's wrong.

There are 300 new orders. Every one of them failed. The names are strangers. The emails look like someone mashed the keyboard. Half of them were placed in the same ten minutes, and almost all of them are for the cheapest thing you sell.

Your first thought is that you've been hacked. Your second is to start deleting.

Don't do either yet. Those fake orders are almost certainly a card testing attack, and it's one of the most common problems I see on WooCommerce stores right now. It's fixable, and most of the fix is free.

What is a card testing attack?

A card testing attack is when bots use your checkout to find out which stolen credit cards still work. They run hundreds or thousands of cards through small purchases. Most get declined, which is why you see a wall of failed orders. The cards that go through get sold or used for bigger fraud somewhere else.

Your store isn't the target. It's the tool. The fraudsters need a real checkout connected to a real payment processor, and yours was open.

It's getting more common, too. Signifyd's 2026 fraud report found card testing attacks rose 175% year over year in North America in the first four months of 2026.

What card testing and fake orders look like in WooCommerce

Card testing has a pattern. If you see three or more of these, you're looking at one:

A burst of failed orders, dozens or hundreds, packed into a short window. Often overnight.
Customer names and emails that don't match anything. Random strings, mismatched names, throwaway email domains.
The same cheap product over and over. Testers want the smallest possible charge, so they go for your lowest-priced item, a sample, or anything under $5.
Billing addresses all over the map, often in a different country from the IP address that placed the order.
A spike in declines in your Stripe or PayPal dashboard that matches the failed orders.
New customer accounts nobody remembers creating, or saved cards being added to accounts through My Account.

You might also get an email from your payment processor before you notice any of this yourself. That's the bad version, and I'll get to why in a minute.

Is my store hacked?

Probably not. Card testing doesn't need to break into anything. The bots use your checkout the same way a customer does, only thousands of times faster.

The support forums are full of these threads. One store owner on WPMU DEV posted that WooCommerce had generated almost 500 failed orders. Support found no sign of a breach. It was bots hammering checkout.

That said, "probably" isn't "definitely." If you also see admin users you don't recognize, files changed that you didn't touch, or strange code in your checkout page, treat it as a possible compromise and get help. That's a different problem with a different fix, and it's the work our WooCommerce security service handles.

Why it matters even when the payments fail

A lot of store owners shrug at this. The charges failed, nobody lost money, so who cares?

Your payment processor cares.

Every one of those declines lands on your merchant account. To Stripe or PayPal, a store with a sudden flood of declined cards looks like a store with a fraud problem. Processors can add a reserve, hold your payouts, or pause your account while they review it. And card networks have less patience this year: Visa cut the fraud and dispute level that marks a merchant as "excessive" from 2.2% to 1.5% in April 2026.

Now picture that review landing the week before Black Friday.

There's also the cleanup cost. Junk orders mess up your order screen. Fake accounts end up in your email platform and drag down your sender reputation. And some gateways charge a fee per attempt whether it succeeds or not, so check your processor's fee schedule.

How to stop a card testing attack right now

If an attack is happening right now, work through these in order. The first three stop most attacks.

1. Turn on your payment processor's fraud tools

If you use Stripe, open Radar in your Stripe dashboard and confirm it's blocking high-risk payments. If you use PayPal, check the fraud protection settings in your PayPal business account.

These won't stop the attempts from reaching your store, but they cut down how many get treated as real charges.

2. Put a bot check on checkout

A challenge like Cloudflare Turnstile or Google reCAPTCHA on your checkout stops most scripts cold. Real customers barely notice it. Bots can't get past it at scale.

Put it on account sign-up and login, too. The same bots test stolen passwords against your customer accounts.

3. Limit how fast one visitor can order

A real customer doesn't place 40 orders in five minutes. A rate limit on checkout, sometimes called a velocity check, caps how many orders one IP address or email can attempt in a set window. It goes straight at what makes card testing work: speed.

4. Cover the doors most people miss

This is where most DIY fixes fall apart. Your classic checkout page is one way in, but not the only one:

The block-based checkout and Apple Pay / Google Pay buttons send orders through WooCommerce's Store API, which can skip protections that only watch the classic checkout page.
The "Add payment method" page in My Account lets anyone with an account save a card. Testers use it to check cards without placing an order at all.
Your cheapest products are the bait. If you sell anything under a few dollars, consider hiding it or setting a minimum order amount until things calm down.

If your bot check and rate limit only cover one of these, the bots find the other door. WooCommerce's own documentation says its anti-fraud extension "often needs proper setup to work effectively" against these attacks. Installing it isn't the same as being protected.

5. Block the repeat offenders

Once you can see the pattern, block it. The IP addresses, email addresses, and email domains behind the failed orders go on a blocklist so they get turned away before payment, not after. A good fraud prevention plugin does this automatically, along with the rate limits and country checks above.

6. Turn off account sign-up you don't need

If customers don't need to create accounts from the My Account page, turn that off in WooCommerce's account settings and let them create accounts at checkout only. Every door you close is one less place for bots to work.

Cleaning up after an attack

Once the attack stops, deal with the mess carefully.

Back up before you delete anything. Bulk-deleting orders and customers is easy to get wrong, and you don't want a real order caught in the sweep. Filter by Failed status and by the date range of the attack, spot-check what you're about to remove, then delete.

Remove the junk accounts. Fake customer accounts created during the attack should go too. Then check your email platform and remove those addresses before your next send.

Talk to your payment processor. If you got a warning, reply with what happened and what you've changed. A clear "we were hit, here's what we did" goes over better than silence.

Don't confuse it with real payment failures. If you run subscriptions, some failed orders are real customers whose cards expired. Those are worth recovering failed subscription renewals for, not deleting. Card testing orders come in bursts from strangers. Real failures come from customers you know, spread out over time.

How to keep it from coming back

Card testers come back. Once your store has worked for them, it's on a list. Fixing it once isn't the same as staying fixed.

Here's what staying protected looks like:

Bot checks and rate limits stay on all the time, across every checkout path, not only during an attack.
Someone watches the failed orders and declines so the next wave gets caught in hours, not after 500 orders.
The blocklist keeps growing as new bad actors show up.
Plugins and WooCommerce stay updated, because an outdated plugin is the next door attackers try.
Suspicious orders get held for review instead of auto-canceled, so a real customer with a mismatched billing address doesn't lose their order.

None of this is hard. It does have to happen every week, and that's the part busy store owners skip.

Want us to stop it for you?

We look after WooCommerce stores, and card testing is the problem we've been cleaning up most lately.

If your store is getting hit, or you want to be sure it won't be when holiday traffic picks up, here's what we do:

Stop the attack across every way into your store: classic checkout, block checkout, Apple Pay and Google Pay, and saved cards
Block the repeat offenders before their cards are ever charged
Hold anything suspicious for review, and we do the reviewing
Clean up the junk orders and fake accounts already in your store
Keep watching, so the next wave gets caught early

If you're mid-attack, we can start the same day. If you're not sure whether you've been hit, we'll take a look at your store and tell you what we see.

Talk to us about fraud protection

Sources: Signifyd 2026 State of Fraud Report; Merchant Risk Council on Visa's VAMP thresholds (April 2026); WooCommerce documentation, "Velocity attacks"; WPMU DEV support forums.