Not every bot checkout is a card test. About half of them never attempt payment at all. They fill in a name, an email, sometimes an address, and stop.
CartWatch measured this on 149 Shopify stores where it scored every checkout but blocked no payments, over the 90 days ending 13 October 2026. 36,319 of 74,539 flagged checkouts never attempted payment (49%). 38,220 did (51%). The full count is in How Many Shopify Bots Are Actually Testing Credit Cards?.
The half-and-half average is misleading for any one store. Stores tend to get one pattern or the other.
Two patterns, and most stores see one of them
Across 105 stores with at least 20 flagged checkouts, bots attempted payment on a median of 59% of them. But the stores cluster at the ends:
- On 25 stores, fewer than 5% of flagged checkouts attempted payment. Nine of those stores had none at all. Two stores with more than 3,000 flagged checkouts each saw exactly three attempts.
- On 60 stores, at least half of flagged checkouts attempted payment. On 35 of them it was three-quarters or more.
- Only 20 stores fell between 5% and 50%.
Store size does not decide the pattern. Some of the quietest stores were in the second group and some of the busiest were in the first.
Why a bot stops before payment, the record does not say. A checkout with no recorded payment attempt has a name, an email, sometimes an address, and nothing else. It either never reached the payment step, or reached it and was stopped by Shopify’s own card-testing model before Shopify wrote anything down. The record does not tell those apart. We can see that it stopped. We cannot see why.
What a checkout that never attempts payment costs you
Shopify writes it to Orders → Abandoned checkouts, next to the real shoppers who left. That inflates your abandonment rate. If abandoned checkout recovery is on, it gets a recovery email. If the email syncs to Klaviyo, Omnisend, Mailchimp, or another provider, it becomes a profile you pay for. It can also create a customer record.
Your payment processor never hears about it. There is no decline, no authorization, and no chargeback.
What these rows do to your abandonment rate is in fake abandoned checkouts and your real abandonment rate. What a synced email does to a Klaviyo bill is in how bot profiles raise your Klaviyo bill.
What a checkout that attempts payment costs you
It leaves the same abandoned checkout, and it also reaches your processor. On the 149 stores, the attempts looked like this:
- 98% went through Shopify Payments.
- The median cart was $4. 86% of US-dollar attempts were under $10.
- The checkout’s last update came a median of 9 seconds after it was created. 95% were updated within 30 seconds.
- 33 of 38,220 attempts became an order.
A failed attempt still counts against how banks see your store. A cheap approval tells the attacker the card works, and it can come back as a chargeback. Suppressing the email afterwards does not undo the attempt. This is the pattern merchants mean by card testing.
Checkouts on the same stores that were not flagged looked like shopping: a median cart of $83, about 12 minutes from creation to last update, and 92% of payment attempts became an order.
Side by side
| Never attempted payment | Attempted payment | |
|---|---|---|
| Share of flagged checkouts on the 149 stores | 49% | 51% |
| What the record shows | Name, email, sometimes an address. No payment. | Payment submitted, usually under $10, usually within 30 seconds. Almost never an order. |
| Where it lands | Abandoned checkout list, recovery emails, email provider profiles, customer records | All of those, plus your payment processor |
| What helps | Tag the customer, suppress the email | The same, plus refusing the payment |
What to do about it
If your store sees the first pattern, payment blocking will not help. Nothing reaches a processor. The fix is to keep the junk out of your lists: tag the customer so you can filter them out, and keep the email out of your email provider. CartWatch does both on the Starter plan and above, for Klaviyo, Omnisend, Mailchimp, Drip, and Brevo. On Standard and above, it can also delete the Shopify customer record of a very-high-risk bot. The abandoned checkout itself stays. Shopify keeps that record, and no app can delete it.
If your store sees the second pattern, you want the payment refused before it is submitted. On the Standard plan, CartWatch payment blocking does that: the processor never answers, and the order is never completed. Shopify still creates the checkout, so you still want tagging and suppression for the row it leaves behind.
If you are not sure which pattern you have, look at your payment processor. A card-testing run shows up as a burst of small declined payments. A list-pollution run shows up only in the abandoned checkout list and in your email provider.
A lot of these checkouts never load your theme. A captcha on a contact form never meets them. How they reach checkout is in How Shopify Checkout Bots Actually Behave.
These figures are stores running CartWatch, not Shopify as a whole. Stores usually install CartWatch because the abandoned checkout list already looks wrong.
FAQ
Do most Shopify bots test credit cards? About half of flagged checkouts attempt payment, on stores where CartWatch could see the whole checkout. The other half never do. On a quarter of stores almost none attempt payment. On a third, nearly all do.
Why do so many bot checkouts never attempt payment? The record does not say. A checkout with no recorded payment attempt has a name, an email, and sometimes an address. It may have stopped on its own, or Shopify’s own card-testing model may have stopped it before anything was recorded. We can see that it stopped. We cannot see why.
Do bot checkouts ever become orders? Rarely. On the 149 stores, 33 of 38,220 flagged payment attempts became an order. The Shopify Bot Checkout Benchmark counted 63 completed flagged online checkouts from 24 June through 22 September 2026, which was 0.01%.
Why are bot payment attempts so small? The median US-dollar attempt was $4, and 86% were under $10. A small charge is easy for a cardholder to miss, which is the point of a card test.
Can I delete these checkouts from Shopify? No app can delete Shopify’s abandoned checkout records. CartWatch can tag the customer, suppress the email, delete the customer record on Standard and above, and refuse the payment on plans with payment blocking.
Does payment blocking stop the checkouts that never attempt payment? No. Payment blocking refuses a payment when a bot submits one. A checkout that never reaches payment is unaffected, and Shopify writes it either way.
CartWatch scores Shopify checkouts as they arrive. On the Starter plan and above, it can tag the customer and keep the address out of Klaviyo, Omnisend, Mailchimp, Drip, and Brevo. On the Standard plan, payment blocking blocks bots from attempting payment. Install CartWatch from the Shopify App Store.