FraudToad

A Shopify app for card testing

Catch card testers before their orders settle.

Card testers run stolen cards through your cheapest product, one fresh account at a time. Each order looks harmless on its own. FraudToad links them by card, IP address, email, account and browser, and voids the whole burst while the payments are still only authorized.

Coming soon to the Shopify App Store Read how it works

One card, three new accounts, ten minutes
  1. #1041[email protected]$0.99•••• 4242voided
  2. #1042[email protected]$0.99•••• 4242voided
  3. #1043[email protected]$0.99•••• 4242blocked

The third order puts the card on three accounts within an hour. FraudToad blocks it, then goes back and voids the first two, which were still uncaptured.

Void, don't refund

No settled sale

With manual capture, a card payment is only authorized at checkout. A voided authorization never becomes a charge, so there's nothing to refund.

No chargeback

A charge that never settled can't be disputed. Card tests that get voided don't count against your store's fraud ratios with the card networks.

No card fees

Refunding a card test after capture usually leaves you paying the processing fee. Voiding before capture leaves no sale to pay a fee on.

How it works

  1. Every new order is scored

    Rules look at the pattern across orders, not just the order in front of them: one card on several accounts, many cards from one IP or one bank's BIN, the same browser behind several shoppers, throwaway emails, brand-new accounts, CVV and address mismatches, Shopify's own risk analysis, and TOR, VPN and datacenter IPs.

  2. The score decides what happens

    Low scores are allowed. Payment is captured two hours later, after one more check, so a burst that shows up in the meantime can still be stopped. Middle scores are held for you to review. High scores are cancelled and voided, and the highest put the card, IP, email and customer on a blocklist.

  3. The burst is swept up

    When an order is blocked, FraudToad re-scores every other open order that shares its card, IP, email or customer, and voids the earlier orders in the burst while they're still uncaptured.

Voiding needs your store to use manual capture (Shopify admin › Settings › Payments). With automatic capture FraudToad can still cancel a card test, but only by refunding it.

Built so you can trust it before it acts

Shadow mode first

It starts by scoring every order and cancelling nothing. Orders it would have cancelled are held and tagged so you can see exactly what it would have done.

Test on past orders

Run it over your last 60 days of orders to see what it would have flagged, without touching any of them.

A review queue

Held orders wait for you with every rule that fired and why, and the other orders that share their card, IP or email. Approve and capture, cancel and void, or block, one at a time or in bulk.

Known-good customers stay safe

Repeat customers in good standing are allowlisted automatically, and you can allowlist any card or customer yourself. An allowlisted order is never cancelled, only held at most.

Attack mode and sale mode

A store-wide surge of tiny orders tightens the rules until it's over. Planning a sale? Turn on sale mode so a rush of real first orders doesn't look like an attack.

Alerts and a dashboard

Email alerts when an order is held, cancelled or blocked, one when an attack starts and a summary after it, and a dashboard of what it has caught since you installed it.

Your thresholds

Pick Conservative, Balanced or Strict, or tune each rule's points and limits. Choose the strongest action it may take on its own: hold only, cancel and void, or cancel, void and block.

Plain-language help

Every rule is documented with what it catches and what real customers it can catch by mistake. Read the rules.

Pricing

Shadow mode

Free

  • Every order scored
  • Suspected card tests held and tagged for review
  • Review queue, blocklist and allowlist
  • Test on your last 60 days of orders
  • Dashboard and email alerts

Automatic voiding

Paid plan

  • Everything in shadow mode
  • Card tests cancelled and voided before capture
  • Earlier orders in a burst swept up and voided
  • Automatic blocklisting of the card, IP, email and customer

Pricing will be set when FraudToad launches on the Shopify App Store.

What it isn't

FraudToad is built for card testing: bursts of small orders checking stolen cards. A single carefully placed order with a stolen card looks like a real customer, and Shopify's own risk analysis is the main signal for those. It isn't a chargeback tool either; it stops what it can before a sale settles, and works alongside one for what gets through. What it can and can't do.