Fake orders come from three completely different sources and each needs a different defence - captcha on everything at once costs more than it saves. Before switching anything on, work out which problem you actually have, because defending against a card-testing bot does nothing for a cash-on-delivery parcel nobody collected.
This piece is about fraud and junk in orders and forms. If you suspect somebody has got into the store and is changing things inside it, that is a different matter - covered in the pieces on detecting malware and the recovery plan after a hack.
Three kinds of fake order
| Kind | Who does it | What it costs you |
|---|---|---|
| Card testing | bots checking stolen numbers | fees, chargebacks, a suspended gateway account |
| Cash on delivery, never collected | a person, on impulse or by mistake | courier both ways, stock frozen |
| Form spam | bots distributing content | staff time, a polluted database, sender reputation risk |
Identifying it takes a minute. Orders with a failed payment status, a dozen or more within an hour, all on the cheapest product in the store - that is card testing. A single paid cash-on-delivery order with an uncollected parcel - an operational problem. Form submissions with links in the body and a random name - spam.
Card testing
The mechanism is simple: somebody has a list of card numbers of unknown origin and needs to know which ones work. A store with an open checkout and a cheap product is the perfect tool for that, because a transaction for a few zlotys rarely alerts the cardholder.
What it looks like in the admin:
- A dozen or several dozen orders in a short window, nearly all with a failed payment status
- Always the same, cheapest product
- Random or nonsensical personal details, email addresses on disposable domains
- Attempts arriving one after another, seconds apart
Why it is a problem even when no payment went through: payment providers measure your share of failed transactions. A high ratio can end in higher fees or a suspended account - and that is the real cost, not the few zlotys. On top of that the database fills with failed orders and your advertising conversion data becomes useless.
What actually helps, in order of effectiveness:
- Limiting attempts from one address - the single best measure. After a few failed payments in quick succession, the address gets a timeout
- Invisible verification such as Turnstile or reCAPTCHA on checkout - on checkout only, not across the whole store
- Rules on the payment provider’s side - more on that below
- Raising the minimum order value, or removing the token cheap product from the catalogue if you have one
- Disabling guest checkout in extreme cases - effective, but it costs real sales, so it is a last resort
Strong customer authentication (those confirmations in the banking app) sharply reduces the effectiveness of these attacks in Europe and shifts liability for an unauthorised transaction to the card issuer. It does not stop the bot from trying, though - which is why rate limiting makes sense regardless of your gateway. How different providers handle it I compared in the piece on WooCommerce payment gateways.
The cash-on-delivery parcel nobody collects
A completely different category, and usually not fraud at all but impulse: somebody ordered in the evening, changed their mind by morning and simply did not collect. The cost is still yours - a courier both ways, the work of packing and processing the return, stock frozen for a week.
Four mechanisms that reduce it, gentlest first:
- Confirming the order by phone or text above a certain value. The simplest thing to implement and the most effective
- A value threshold above which cash on delivery disappears and prepayment remains. Set it where the loss on an uncollected parcel stops being acceptable
- Cash on delivery only for customers with history - first order prepaid, later ones however they like
- A list of customers excluded from it after two uncollected parcels. Keep it, even in a spreadsheet - the same people come back
What not to do: do not scrap cash on delivery overnight “because of the losses”. In some sectors it is still the method without which a large group of customers will not buy at all. Work out first what uncollected parcels genuinely cost you, and compare that with the value of the orders paid on delivery.
Spam in forms and registrations
Three ways in, and a different answer for each:
The contact form. Classic promotional text with links. The best fix is a honeypot field - a hidden field a human never sees and never fills, which a bot completes automatically; any message with that field filled goes straight to the bin. No effect on the customer, no extra click, and it filters out most bot traffic.
Account registration. Hundreds of accounts with random names. If the store does not require registration to buy, check under Settings → General whether self-registration is even enabled - in many stores it is on for no reason. If accounts are needed, add verification to the registration form and confirm the email address.
Comments and product reviews. Turn comments off where you do not need them (on pages and posts, if you are not running a discussion), and for product reviews enable moderation and a spam filter.
A separate and often overlooked consequence: bot-created accounts and orders pollute your address database. If you later email that list, you hit addresses that do not exist, which lowers your sender reputation and reduces deliverability to real customers. It is worth clearing out accounts with no orders once a quarter.
Captcha versus conversion
The most common overreaction to spam: switching on a visible captcha everywhere. The effect is measurable and it goes the wrong way - every extra click in checkout means abandoned carts, and the fewer steps there are, the better the store sells; I set that out in the piece on a shorter checkout.
A practical hierarchy, least invasive first:
| Measure | Visible to the customer | Where to use it |
|---|---|---|
| Honeypot field | no | forms, registration |
| Invisible verification | rarely | checkout, registration |
| Rate limit per address | no | checkout, login |
| Click-through captcha | yes | only when the rest has failed |
| Disabling guest checkout | yes, heavily | last resort |
The rule: start with what the customer cannot see and move down the list only if the problem persists. And measure the effect - the number of orders before and after the change, not just the feeling that things are quieter.
Rules on the payment provider’s side
The layer store owners most often do not know exists at all. Gateways and payment providers have their own anti-fraud mechanisms, usually in the provider’s dashboard rather than in your store.
What is worth checking there:
- Attempt limits per card and per address within a time window
- Rules by country of the payment - if you only sell domestically, transactions from far away are a signal
- Manual review thresholds - above a set amount the transaction waits for your confirmation instead of going through automatically
- Alerts on unusual activity - so you do not learn about an attack from the morning order review
These are one-off settings and they defend better than anything on the WordPress side, because they act before a transaction reaches the store at all.
What one fake order costs
Worth calculating once, because only then can you see how much defence is worth:
- Reserved stock - goods blocked from a real customer, sometimes for days
- Human work - packing, the label, handling the return, an accounting correction
- Transport both ways on cash on delivery
- Fees and charges on a chargeback, applied regardless of transaction size
- Distorted data - advertising conversions counted from orders that do not exist lead to bad budget decisions
- Risk on the provider’s side - a high share of failed and disputed transactions can cost you a higher rate
Point 5 is the most insidious, because it never shows up in the till. A campaign optimised towards fake conversions learns to bring in more of the same traffic.
The order to roll it out in
Do not switch everything on at once - you will not know what worked and what cost you sales. The sequence I use:
- Identify the kind of problem from the last week’s order list
- Turn on what the customer cannot see: a honeypot in forms, a payment attempt limit
- Check your payment provider’s dashboard and set limits and alerts there
- Wait a week and compare the numbers - how many fake orders, how many real ones
- Only if the problem persists, add visible measures, one at a time
- Clean up the database: delete failed orders, accounts with no orders, spam submissions
Points 1 to 3 solve most cases and cost you nothing in conversions. It is worth writing this review into ongoing store maintenance, because these attacks come back in waves.
When it has already happened
A short list for an active card-testing attack:
- Turn on the attempt limit immediately - it stops the wave faster than anything else
- Contact your payment provider. Do not hide it; providers see these attacks daily, have tools for them, and a report from you helps if your failed-transaction ratio comes up later
- Do not ship anything from suspicious-looking orders until payment is confirmed on the provider’s side - a status in the store does not always mean a settled transaction
- Keep the evidence - IP addresses, timestamps, order numbers. Useful in a dispute
- Clean the database once the wave is over, so reports and conversion data mean something again
If unusual orders appear alongside other strange symptoms - new administrator accounts, changed files, redirects - this is no longer payment fraud but a break-in, and the priority changes.
Frequently asked questions
Where do fake orders in an online store come from? Most often from automated card testing: a bot places a run of cheap orders to see which stolen cards still work. The second source is impulse cash-on-delivery orders that never get collected, and the third is spam in contact forms and registrations. Each needs a different defence.
How do I block bots in a WooCommerce store without losing customers? Start with what nobody sees: a hidden honeypot field in forms and a limit on payment attempts from a single address. Add a visible captcha only if that is not enough, and only on checkout or registration, never across the whole store - every extra click on the way to a purchase costs orders.
Is it worth switching off cash on delivery? Rarely worth removing entirely, because in many sectors part of your customer base will not buy without it. A value threshold above which prepayment applies, order confirmation by text, and a list of customers excluded after two uncollected parcels all work better. Calculate the real loss from uncollected parcels first and weigh it against the value of those orders.
What should I do when dozens of failed payments appear in the store? That is most likely a card-testing attack. Turn on a per-address attempt limit, add invisible verification at checkout and report it to your payment provider - a high share of failed transactions can end in higher fees or a suspended account. Once the wave is over, delete the failed orders from the database.
Do fake orders distort advertising data? Yes, and that is their least visible cost. Conversions counted from orders that were never real teach a campaign to bring in more of the same traffic and lead to bad budget decisions. After every wave it is worth cleaning the data and checking that your purchase event is not counting unpaid orders.
Running a store where something does not work the way it should? I build and rebuild WooCommerce stores - from a single fix to reworking the whole sales flow. Tell me what you are dealing with and I will send back a scope and a price.