Dakaas Fraud Filter, Bot BlockStop bots and card testers at your checkout.
Checkout Abuse Protection watches checkout activity on your store and gives every checkout a risk score from 0 to 100. Depending on your settings, it lets you review suspicious activity or blocks it automatically, without blocking genuine shoppers.
- No code changes
- Start in Monitor mode
- Real shoppers see nothing
Checkout screening
Every checkout scored from 0 to 100
- 0j.m•••@gmail.comNo warning signs · Toronto, CAPassed
- 100qq81•••@guerrilla.comMany cards declined across checkouts · Datacenter · VPNBlocked
- 0k.osei•••@gmail.comNo warning signs · London, UKPassed
- 45test44•••@proton.meStarted too many checkouts · Frankfurt, DEFlagged
Block at 70+
Protect mode
3 allowed
Declined cards
Expire in 24h
Auto-blocks
Illustrative example data
Checkout abuse on Shopify is quiet, and expensive
It doesn’t look like a robbery. It slowly wears down your payment health, your email budget, your analytics and your team’s time.
Card testing
Bots cycle stolen cards through your checkout, pushing up your decline rate.
How we stop itFake checkouts
Hundreds of abandoned checkouts flood your store and skew your analytics.
How we stop itEmail switching
One buyer cycles through identities in a single checkout to dodge limits.
How we stop itWasted recovery emails
Your abandoned-cart emails go to bots and card testers instead of shoppers.
How we stop itEvery checkout gets a risk score from 0 to 100
Warning signs add points. The total decides the risk level, and your mode decides what happens next. Switch the signals below to see how a checkout would be treated.
What happened in this checkout?
Risk score
Why flagged
- Started too many checkouts
- Too many checkouts from the same network
- Network already blocked as a bot
Mode
Block at
Email blocked at checkout for 24 hours
The score is at or above your 70+ threshold, so the buyer’s email is blocked from completing checkout. The block expires on its own, and you can unblock in one click.
Checkout abandonment on its own never raises the score. Only behaviour like the signals above does.
Here’s how it handles each problem
01 · Card testing
Bots can’t keep cycling stolen cards
Card testing shows up as a pattern of declined payments. Checkout Abuse Protection counts declined card payments from the same browser, network or email, across checkouts.
- You choose how many declined payments are allowed, and over what time period.
- Once a buyer goes over the limit, their email is blocked from completing checkout.
- Repeated declines raise the risk score sharply, with clear labels: “Several cards declined (possible card testing)” or “Many cards declined across checkouts.”
- Your decline rate stays healthy.
- Visa •••• 4242Declined · 1 min ago
- Mastercard •••• 5100Declined · 3 min ago
- Visa •••• 0019Declined · 5 min ago
Email blocked from completing checkout
The buyer sees: “There have been too many unsuccessful payment attempts. For security, checkout can’t continue right now. Please contact the store if you need help.”
02 · Fake checkouts & flooding
You set the limits that make sense for your store
A visitor or network that starts too many checkouts in your time window is flagged with a clear reason. If that network is already known to Dakaas as a bot, the score goes up further.
- Checkouts per visitor: how many checkouts one visitor can start.
- Checkouts per IP: how many checkouts can come from the same network.
- Time window: the period these are counted over.
- Reasons are written in plain English: “Started too many checkouts”, “Too many checkouts from the same network” or “Network already blocked as a bot.”
5
Checkouts per visitor
5
Checkouts per IP
60 min
Time window
Black marker = your limit
03 · Email switching
Stop identity cycling in a single checkout
With the Emails per checkout limit, you decide how many different email addresses can be used in one checkout. If someone keeps switching, a clear message appears in checkout and they can’t continue past the limit.
- You set the number of different emails allowed per checkout.
- The buyer sees a clear, neutral message, not an error.
- Genuine typo fixes stay well within the limit.
This limit uses the small Dakaas Checkout Abuse Monitor block in your checkout editor, which is available on Shopify Plus. All other protection works without it.
Emails entered in this checkout
Too many email address changes
You’ve entered more than 3 different email addresses in this checkout. For security, checkout can’t continue. Please contact the store if you need help.
04 · Recovery emails · Most requested
Keep recovery emails going to real shoppers, not bots
Shopify doesn’t let apps mark an abandoned checkout as fake. So Dakaas does the next best thing: it tags the customer behind a suspicious checkout with dakaas-suspicious. Add one condition to your abandoned checkout automation and you’re done.
- Only likely bots, blocked buyers and card testers are tagged. Normal shoppers are never touched.
- Unblock a buyer or mark them as Always allow, and the tag is removed automatically.
- Opt-in: you turn it on when you’re ready.
Tip: Shopify’s built-in abandoned checkout email (Settings → Checkout) can’t use conditions. Send recovery emails from an automation instead, such as Shopify Flow, Marketing → Automations, Klaviyo or Omnisend.
Trigger
Checkout abandoned
Condition
Customer tags does not include
dakaas-suspiciousReal shopper
Recovery email sent
Bot or card tester
Skipped, no email wasted
Monitor mode or Protect mode
Not every merchant wants automatic blocking on day one, so there are two modes.
Monitor mode
Watch first, decide later
- Nobody is ever blocked automatically.
- Every suspicious checkout is scored and shown on your Activity page.
- Great for seeing how much abuse your store gets before switching protection on.
Protect mode
Automatic enforcement
- Turns on the declined-payment limit, the email limit and risk-score blocking.
- Automatic blocks are temporary and expire on their own.
Choose how strict it is
Block at 70+
Blocks medium and high risk
Block at 90+
Blocks high risk only
In both modes, you can always block a buyer manually with one click.
Real customers are never punished
Blocking a real customer is worse than letting a bot through, so the feature includes several safety nets.
Trusted customers
Logged-in customers with past orders (you set the minimum) are never blocked.
Blocks expire automatically
Automatic blocks are temporary, never permanent. You choose how long they last.
One-click Unblock
If a real buyer gets caught, unblock them right away from the Activity page.
Always allow
Mark a buyer as safe and they’ll never be flagged or blocked again.
No CAPTCHA for everyone
Honest shoppers see nothing different. Messages appear only when a limit is reached.
See exactly what happened
Every flagged checkout appears on the Suspicious Checkout Activity page, with a risk level and a plain-English “Why flagged” explanation. No guessing.
Suspicious checkouts
128
Last 7 days
High-risk checkouts
41
Last 7 days
Declined card payments
213
Last 7 days
Currently blocked buyers
17
Last 7 days
| Buyer | Country | Emails used | Declined | Risk | Why flagged |
|---|---|---|---|---|---|
| qq81•••@guerrilla.com | NL | 4 | 9 | High risk | Many cards declined across checkouts |
| buyer93•••@mail.ru | RU | 1 | 0 | Medium risk | Network already blocked as a bot |
| test44•••@proton.me | DE | 2 | 1 | Low risk | Started too many checkouts |
| maria.g•••@gmail.com | ES | 2 | 0 | Safe | Used more than one email |
Click any row for the full story
- A timeline of what the buyer did in checkout
- Device and browser information
- Network details: VPN, hosting provider, ISP and city
- A “Bot or human?” check with a bot score
- The products in the cart
- Repeat activity: how often this buyer, network or shipping address has shown up before
- A direct link to the order, if one was placed
From here you can Block, Unblock or Always allow the buyer.
Timeline
Started checkout
14:02
Entered email (1 of 4)
14:03
Payment declined: Visa •••• 4242
14:04
Switched email, payment declined again
14:05
Email blocked (Protect mode)
14:07
Bot or human?
Likely bot- Network
- VPN · Hosting provider
- ISP / City
- M247 · Amsterdam
- Device
- Headless Chrome · Linux
- Cart
- 2 × Gift card $100
- Repeat activity
- Network seen 14×
- Order
- Not placed
Illustrative example data
Privacy by design
Checkout Abuse Protection collects only what it needs.
- Emails used for blocking are stored as secure hashes, not plain-text lists.
- Shipping addresses are matched using a fingerprint (a hash), never by storing the address itself.
- Works within Shopify’s own checkout tools.
Set up in a few minutes
No developer needed. Sensible defaults out of the box.
- 1
Open the feature
In Dakaas Fraud Filter, go to Checkout Abuse Protection.
- 2
Start in Monitor mode
Turn the feature on. Nothing is blocked while you watch.
- 3
Adjust the limits
Checkouts per visitor or IP, declined payments and time windows, or keep the defaults.
- 4
Add the checkout blockOptional
Optional, Shopify Plus: enables the emails-per-checkout limit.
- 5
Turn on customer taggingOptional
Optional: add the dakaas-suspicious condition to your recovery emails.
- 6
Switch to Protect
Review your Activity page for a few days, then turn protection on.
Why merchants choose Dakaas for checkout abuse protection
Your problem, and how Checkout Abuse Protection answers it.
- Bots testing stolen cards on your store
- Declined-payment limit blocks the buyer’s email after too many failed attempts
- Hundreds of fake abandoned checkouts
- Checkouts-per-visitor and per-IP limits flag and stop checkout flooding
- Someone switching emails in one checkout
- Emails-per-checkout limit with a clear in-checkout message
- Recovery emails going to bots
- The dakaas-suspicious customer tag lets your automation skip them
- Worried about blocking real customers
- Monitor mode, trusted customers, auto-expiring blocks, one-click unblock and Always allow
- No idea what’s actually happening
- Activity dashboard with risk scores, reasons, timeline, device, network and bot check
Frequently Asked Questions
Answered all frequently asked questions. Still confused? Feel free to contact us.
No. Real shoppers see nothing different. Messages only appear when a limit is reached.
Stop letting your checkout be someone else’s testing ground
Get a clear view of what’s happening at your checkout and the tools to stop it, while your real customers check out as normal. Included in the Legend plan.