Card-testing bots ("carding") hunt for hidden low-price products, like donation variants, and run tiny checkouts to validate stolen credit cards. Because the donation product must be published to the Online Store channel for checkout donations to work, bots can discover it even though it's hidden from search and the sitemap. Patron can now block these donation-only orders automatically, before they're ever placed.
What's new
Checkout Protection toggle:
A new optional setting on the Online Store page that blocks any order containing only donationsEnforced server-side:
Validation runs on Shopify's servers at the moment of purchase, so bots can't bypass it. This includes express checkouts like Shop Pay, PayPal, Google Pay, and Apple PayInvisible to real customers:
Donations always ride along with a regular purchase. If a cart ever ends up donation-only (say, a customer removes their last item after donating), checkout quietly removes the donation. No error messages, no blocked cartsPOS and Shop Channel are unaffected:
Retail transactions and ShopPay validated customers are exemptHow to enable:
- Open Patron and approve the new permissions when Shopify prompts you
- Head to the Online Store page and switch on Checkout Protection
- Protection is off by default for existing stores. Nothing changes until you turn it on.
Requirements
- Patron Plus plan ($19.99/mo)
- Shopify Plus store with checkout extensibility enabled
- Approve the updated app permissions (Shopify prompts you on your next app open)
- A connected donation product
Special thanks to Dennis at Jocko Fuel for reporting this and helping us prioritize it!