About half of Shopify bot checkouts attempt payment. The other half create an abandoned checkout and stop there.
That is what CartWatch found on 149 stores where it scored every checkout but blocked no payments, over the 90 days ending 13 October 2026. On those stores, 38,220 of 74,539 flagged checkouts attempted payment (51%). 33 of those attempts became an order.
The average hides a split between stores. On about a quarter of stores, almost no bot checkout attempts payment. On about a third, nearly all of them do.
Three terms, so the rest reads plainly:
- A flagged checkout is one CartWatch scored as a bot.
- Attempted payment means Shopify recorded a payment method on the checkout. Shopify only does that when the payment step is submitted. On the same stores, 92% of non-flagged checkouts that reached this point became an order, so it is a reliable marker of a real attempt. One gap: Shopify’s own card-testing model also stops some attempts, and we do not know whether an attempt it stops still gets recorded. If it does not, the attempt rate here is an undercount, and some checkouts counted as never attempting payment were stopped by Shopify.
- Payment blocking off means CartWatch was not refusing payments on that store at any point in the window. Where CartWatch refuses a payment, Shopify never records the attempt, so those stores cannot tell us what the bot tried to do. They are counted separately below.
Half attempt payment, half do not
On the 149 stores, 83,613 checkouts were flagged. 9,074 of them had their payment fields wiped when the customer record was later deleted, so we cannot tell what happened. That leaves 74,539 with a readable record.
- 38,220 attempted payment (51%).
- 36,319 did not (49%).
- 43 became an order (0.06%).
Checkouts on the same stores that were not flagged behaved like shoppers.
| Flagged | Not flagged | |
|---|---|---|
| Checkouts with a readable record | 74,539 | 19,845 |
| Attempted payment | 38,220 (51%) | 15,625 (79%) |
| Became an order | 43 (0.06%) | 14,452 (73%) |
| Of the attempts, became an order | 33 of 38,220 (0.09%) | 14,378 of 15,625 (92%) |
A flagged checkout that attempts payment almost never becomes an order. A non-flagged one usually does.
It depends on the store
Across 105 stores with at least 20 readable flagged checkouts, the median store saw 59% of its flagged checkouts attempt payment. The spread is wide.
| Share of flagged checkouts that attempted payment | Stores |
|---|---|
| None | 9 |
| Under 5% | 16 |
| 5% to 25% | 10 |
| 25% to 50% | 10 |
| 50% to 75% | 25 |
| 75% or more | 35 |
So 25 stores saw almost no payment attempts from bots, and 60 stores saw them on at least half of flagged checkouts. Few stores sit in the middle. A store tends to get one pattern or the other.
Volume does not predict the pattern. Two stores with more than 3,000 flagged checkouts each saw exactly three payment attempts. Counting the 20 busiest stores as well (see how we counted), the three largest held about two-thirds of all flagged checkouts in the window and made about two-thirds of the payment attempts, with rates of 84%, 59%, and 17%.
What a bot payment attempt looks like
The 38,220 payment attempts on the 149 stores were small, fast, and almost never finished.
- 37,452 went through Shopify Payments (98%).
- Where the cart was in US dollars, the median cart was $4. 27,949 of 32,648 USD attempts were under $10 (86%), and 16,817 were under $5 (52%). 176 were over $50 (0.5%).
- The checkout’s last update came a median of 9 seconds after Shopify created it. 36,197 of 38,220 (95%) were updated within 30 seconds.
- 33 became an order.
Non-flagged checkouts on the same stores: a median USD cart of $83, 3% of attempts under $10, 65% over $50, and a median of about 12 minutes from creation to last update.
Shopify does not tell us why an attempt failed. The record shows an attempt and no order. That covers declines, and it covers scripts that stopped after choosing a gateway. The cheap, fast pattern is what merchants mean by card testing.
Stores with payment blocking on are a different count
130 stores had payment blocking on for the whole window. They flagged 1,251,696 checkouts. CartWatch’s own counters show 1,149,836 of those as payments its rules would have refused (92%).
That counter is not a count of bots that pressed pay. CartWatch records a would-be refusal when a checkout matches its blocking rules, whether or not the bot ever reached the payment step. Shopify does not report what the bot did next. So these stores say nothing about how often bots attempt payment, and they are left out of the rate above. An earlier version of this note presented a figure like this as “refused payments”. It is better described as flagged checkouts whose payment CartWatch would have refused.
What this means for your store
If bots on your store attempt payment, your payment processor sees every attempt. Declines count against how banks see your store, and a cheap approval can turn into a chargeback. The only fix that reaches this is refusing the payment before it is submitted. CartWatch does that on the Standard plan. Shopify still creates the checkout, so the abandoned checkout stays in your list.
If bots on your store do not attempt payment, the damage is in the list. They inflate the abandonment rate, trigger recovery emails, and become profiles your email provider bills for. Payment blocking does nothing for these. Tagging the customer and suppressing the address does, on the Starter plan and above.
Most stores see mostly one pattern. Which one you have, and what each costs, is in Many Shopify bots never attempt payment.
How we counted
The window is the 90 days ending 13 October 2026. Checkout records created from 15 July through 13 October are included.
- Stores. 346 stores run CartWatch. 174 had payment blocking off for the whole window, 130 had it on, and 8 turned it on during the window and are left out. Five development or test stores whose checkouts used Shopify’s test gateway are left out.
- Full reads and samples. 149 of the blocking-off stores were read in full. The other 20 were too busy to read every record: together they held about 784,000 checkouts. We read a time-spread sample of about 34,000 of their checkouts and weighted each day by its volume. Their combined attempt rate came out at about 58%, and store by store they ranged from under 1% to 98%. They appear in the store-by-store figures and are left out of the exact counts.
- Left out. Test stores, banned shops, point-of-sale checkouts, and CartWatch’s own audit checkouts. Checkouts with no email address, which CartWatch does not score. Checkouts whose payment fields were wiped by a later customer deletion.
- Attempted payment means the checkout’s gateway field was set. On stores with blocking off, that only happens when the payment step was submitted. Whether an attempt stopped by Shopify’s own card-testing model still sets that field is not something the record can tell us, so the attempt counts are a floor.
- Revision. The first version of this note, published 5 October 2026, covered 12 stores and 17,618 flagged checkouts and reported a 31.5% attempt rate. That sample was too small and too uneven: three stores made 98% of its attempts. This version replaces it.
These figures are stores running CartWatch, not Shopify as a whole. Stores usually install CartWatch because the abandoned checkout list already looks wrong, so a quiet store will come in below these volumes.
Source: CartWatch Bot Intelligence. Analysis of anonymized checkout activity processed by CartWatch across participating Shopify stores.
CartWatch scores Shopify checkouts as they arrive. On the Starter plan and above, it can tag the customer and keep the address out of Klaviyo, Omnisend, Mailchimp, Drip, and Brevo. On the Standard plan, payment blocking blocks bots from attempting payment. Install CartWatch from the Shopify App Store.