Frequently Asked Questions
The Basics
What is card testing, and why does it cost me?
Fraudsters use your checkout to find out which stolen card numbers still work, running hundreds of cheap orders through a bot. Each attempt can cost you a payment gateway fee, and the ones that go through bring chargebacks and can get your payment account reviewed or suspended.
How does Card Testing Guard tell bots from customers?
Real customers browse your store before they check out; card-testing bots usually jump straight to checkout with a link. While a shopper browses, CTG quietly gives their cart a short-lived pass. A cheap checkout without a valid pass is treated as a bot. See How Protection Works.
What happens to a checkout without a pass?
Card payment is removed from it, so there is nowhere to enter a card and nothing reaches your payment gateway. A checkout rule blocks it as a second layer. Wallets such as Shop Pay, Apple Pay and Google Pay stay available.
Are expensive orders checked too?
No. Only carts at or below your low-value threshold (10 in your store’s currency unless you change it) are checked, because card testers use the cheapest items. Attack mode and strict countries check larger carts too.
Does it stop all card testing?
No, and it doesn’t claim to. A bot that drives a real browser through your storefront can earn a pass. CTG makes your store an unprofitable target: passes expire within 30 minutes, reused passes and repeated emails or phones are cancelled, and attack mode tightens the rule during a wave.
Your Customers
Will my customers notice anything?
No. The pass is created in the background while they browse: no puzzle, no extra step. Returning customers are never checked, and neither are company (B2B) buyers unless you turn that off.
What if a real customer’s pass doesn’t arrive?
They can still pay with a wallet. To see whether it happens on your store, check Held but ordered in Last 7 days on the Home page: those are held checkouts that still became orders. Common causes are Buy it now, links that skip your store, and a theme that blocks the app’s script.
Does Buy it now work?
Shopify creates a fresh cart for Buy it now, which leaves the pass behind, so a cheap Buy it now order can lose card payment. Turn on Send Buy it now through the cart in the app embed settings. Buy it now then adds the item to the cart and goes to checkout, so the customer checks out everything in their cart. See Protection Settings.
I send links that go straight to checkout. Will those customers be blocked?
They skip your store, so they arrive without a pass. Add a campaign code in Settings and put ?attributes[_ctg_campaign]=YOURCODE on the link, then remove the code when the campaign ends. For products you mostly sell that way, add them to Always allowed instead (up to 50).
What about my mobile app or headless store?
Carts created outside your theme get no pass. Wallets stay available, and card payment follows your settings. Try it on the Test your checkout page before you protect.
Setting Up
Why does it start in monitoring mode?
So you can see what it would do before it does anything. In monitoring mode nothing is blocked, and the Home page counts what would have been held. CTG never switches blocking on by itself.
What threshold should I use?
Just above the price of the cheap items bots pick, and below most of your real orders. If Held but ordered shows real customers, raise or lower it as needed, or allowlist their products.
When should I use attack mode?
While an attack is running and bots are using more expensive items. It checks every cart, so a customer whose pass failed would lose card payment on larger orders too. With Turn attack mode on automatically, it switches on when 20 or more checkouts are held in an hour and off after an hour below 5. Attack mode you turn on yourself is never switched off for you.
What does “Block even if the token list is unavailable” do?
Normally, when CTG is paused or its server is down, every checkout goes through. With this on (only in attack mode), checked carts are held instead. It keeps bots out during an outage, but real customers without a pass lose card payment too. Use it only during a serious attack.
Pauses and Reliability
Why did protection pause?
CTG stops blocking when real shoppers might not be getting passes: the app embed is missing from your storefront, no shopper has received a pass in 24 hours, or its server can’t update your store. The banner on the Home page says which, and how to fix it. It resumes on its own. See Troubleshooting.
What happens if the app is down?
Checkouts go through normally within 10 minutes, and protection resumes when the app is back. An outage never blocks your customers (unless you turned on “Block even if the token list is unavailable”).
How do I stop it right now?
Switch to monitoring on the Home page. Nothing is blocked from that moment.
I deleted the checkout rule or payment customization by mistake.
CTG recreates both within 5 minutes. To stop protection, switch to monitoring instead of deleting them.
Attacks
Can’t a bot just get a pass?
It can, by passing the same invisible check a browser does, which costs the attacker time and money for every pass. Passes expire within 30 minutes, a pass reused on more than 3 checkouts stops working, an email or phone number used on more than 5 checkouts in a day has its passes cancelled, and fake phone numbers (like 555 numbers) cancel the pass at once.
How do I get told about an attack?
The Home page shows a banner while one is running. For Slack, email or anything else, build a Shopify Flow workflow on the “Card testing attack detected” trigger. There are also triggers for attack ended, protection paused and protection resumed. See Dashboard.
My store is being attacked but I was only monitoring.
Monitoring never blocks anything. Turn on protection on the Home page; it takes effect within seconds. If the attack uses pricier items, turn on attack mode in Settings as well.
Does CTG clean up orders from an attack?
No. CTG only prevents and reports; it never cancels, refunds, deletes, or tags orders or customers. Anything already created stays for you to handle.
Pricing
What am I charged for?
Only prevented attempts: checkouts held while protecting that didn’t become an order within 24 hours and arrived during an attack (20 or more held checkouts in the hour before). The first 100 each month are free, then $0.05 each up to 2,500, then free again: at most $120 a month. See Plans & Billing.
Why was a held checkout not charged?
It became an order, it wasn’t during an attack, protection was paused or in monitoring mode, or its 24 hours haven’t passed yet. Quiet days and single mistaken blocks are never charged.
Where can I check my charges?
The Billing page lists each one with its time, reason and cart value, and whether it has been billed.
Privacy
Does Card Testing Guard store my customers’ data?
No names, email addresses, phone numbers or IP addresses. To spot bots reusing the same email or phone, it keeps a one-way code for 24 hours that can’t be turned back into the address or number. Checkout records keep only the pass status, cart value, currency and whether it became an order, for 90 days. See Privacy.
What happens when I uninstall?
Protection stops immediately: an uninstalled app’s checkout functions no longer run. CTG deletes your store’s keys and bot-detection data right away, and the rest (checkout records and test results) when Shopify asks it to, 48 hours later.
Testing
How do I know it works on my store?
Use Test your checkout. It walks you through ten situations, from a bot link to a normal purchase, with your gateway in test mode. The proof is your gateway’s log showing no authorization attempt for the held ones.