WooCommerce fake orders: how to stop card testing attacks

How to recognize it

The signs WooCommerce and Stripe describe, plus the ones I see in stores:

• A spike of orders with the “Failed” status, often with several card-declined notes on the same order.
• Small amounts: the cheapest product, a donation or a pay-what-you-want product.
• Lots of different cards, each with one or two attempts.
• Nonsense names and emails, random combinations or disposable addresses.
• Orders at odd hours and in bursts, dozens in a few minutes.
• In the payment provider's dashboard, a rise in declined or blocked payments. In Stripe it shows as a spike of 402 errors and generic declines.

There is a quieter variant: if you see hardly any failed orders but you do see new customer accounts with saved cards, they may be validating cards by adding them to an account, without ever buying.

Why it is your problem

They do not steal money from you directly, but the damage is real:

• Disputes: some cards go through, the cardholders see the charge and dispute it. Every dispute costs money and time.
• Your standing with the banks: according to Stripe, a high decline rate makes your payments look riskier, and can cause legitimate payments to be declined even after the attack is over.
• Fees: refunding a fraudulent payment may not get you back the payment provider's fee.
• Your payment provider account: with a lot of fraud alerts, the provider may review or restrict your account.

If you use Stripe (or WooPayments)

Stripe has its own protections against card testing (limits, risk models and automatic CAPTCHA in its recommended integrations), and you will see payments marked “Blocked by Stripe”. They work better the more information Stripe receives about the payment (IP, email, name, address), so use the official plugin and keep it updated. With Radar you can add your own rules, such as blocking when the CVC check fails, depending on your plan. WooPayments, which runs on Stripe, also has its own measures, but WooCommerce makes it clear that fraud prevention is still the merchant's responsibility.

If you use your bank's payment gateway

With a bank's virtual POS (Redsys in Spain, for example), the anti-fraud rules are managed by the bank. If you spot the attack, contact your bank: they can see the attempts, adjust the controls on your merchant account and tell you whether it is affecting your account. And tell them before they contact you.

What to do if it is happening right now

1. Refund the fraudulent payments that went through as soon as possible. WooCommerce considers this the most important step to avoid disputes.
2. Set to private, temporarily, the cheap products, the donations and the pay-what-you-want products.
3. Turn off guest checkout while the attack lasts, if your business allows it.
4. Turn off payments with saved cards in the payment methods that allow it, if you suspect cards are being validated through accounts.
5. Turn on the checkout rate limit (next section).
6. Talk to your payment provider or your bank so they tighten their controls.

The block checkout and the Store API

This is what many people do not know. The WooCommerce block checkout works through the Store API, an interface that lets anyone create orders with direct requests, without going through the page. Attackers use it with scripts even if your store uses the classic checkout, because the API is there anyway.

In December 2024, WooCommerce found that some CAPTCHA plugins did not protect the block checkout or the Store API: the CAPTCHA showed on the page, but direct requests to the API skipped it. The affected plugins released fixed versions. If you use a CAPTCHA, check that it is updated and that its documentation explicitly says it protects the block checkout.

Measures that work

1. Rate limit the checkout

WooCommerce ships with a rate limit for the Store API, turned off by default. Since WooCommerce 9.6 there is a strict limit just for the “Place order” step (POST /wc/store/v1/checkout): at most 3 requests every 60 seconds. You turn it on under WooCommerce → Settings → Advanced → Features, with the option “Rate limiting Checkout block and Store API”.

To limit the rest of the Store API, a developer can enable the official filter. If the store is behind Cloudflare or another proxy, proxy_support must be true; otherwise every customer will appear to come from the same IP and you will block real shoppers:

add_filter( 'woocommerce_store_api_rate_limit_options', function () {
    return [
        'enabled'       => true,
        'proxy_support' => false, // true behind Cloudflare or a proxy
        'limit'         => 25,    // requests…
        'seconds'       => 10,    // …per 10 seconds
    ];
} );

2. CAPTCHA on the checkout

WooCommerce recommends a CAPTCHA at checkout. Cloudflare Turnstile is the least annoying option for the customer and has free plugins; reCAPTCHA works too. What matters, as Stripe puts it: the CAPTCHA has to be validated on the server and on every request that can pay or save a card, not just on the page. After installing it, place a complete test order.

3. Anti-fraud extensions

Some extensions limit failed payment attempts per order or per IP and temporarily block whoever exceeds them. Useful if the attacks keep coming back. Configure them carefully: WooCommerce warns that a badly configured anti-fraud plugin protects little or nothing.

4. Take away the easy targets

• No pay-what-you-want products and no donations without a minimum amount.
• Require an account to buy, if your kind of customer will accept it.
• Check whether your hosting provider's firewall or your CDN can rate limit requests to /wc/store/ and /?wc-ajax=checkout.

When the attack stops, do not switch everything off at once. Attackers usually come back to try again days later, and if they find the same gap open, they repeat. Keep the checkout limit and the CAPTCHA, check the failed orders every morning for a couple of weeks and bring the cheap products back gradually.

Email, the collateral damage

A card testing attack also hits your email. WooCommerce sends a notice for every failed order and, if accounts get created, a welcome email to every fake address. Hundreds of emails to addresses that do not exist generate bounces that damage your domain's reputation, and your legitimate order confirmations start landing in spam. While the attack lasts, temporarily turn off the failed order notice under WooCommerce → Settings → Emails, and afterwards check your SPF, DKIM and DMARC setup, which I explain in the blacklist guide.

If you want me to check it

The free scan checks the WooCommerce version and the visible plugins with published vulnerabilities. And the WooCommerce security plan (€69/month) includes a daily scan, file-integrity monitoring and a test purchase every month, which is where checkout problems show up before a customer tells you about them.

Sources

• WooCommerce: how to prevent and respond to card testing attacks
• WooCommerce: Store API rate limiting
• WooCommerce Developer Blog: card testing attacks and the Store API
• Stripe: prevent card testing