Store fraud response

Confirm it is card testing

• Many Failed or Pending orders in a short window, often one cheap product.
• Guest orders with random names, odd billing details and throwaway emails.
• Order notes show declines: card declined, wrong security code, no funds.
• Gateway dashboard shows a spike in failed payments or failed SetupIntents.
• Access log shows bursts of POSTs to ?wc-ajax=checkout or wc/store/v1/checkout.

Slow it down in the first hour

• Tell gateway support you are under a card testing attack. Note the ticket.
• Turn on gateway fraud tools: Radar rules, WooPayments fraud protection, 3D Secure.
• Add CAPTCHA or Turnstile to checkout. Confirm it also protects the Checkout block.
• Block checkout: turn on Store API rate limiting (Advanced, Features).
• Add an edge rate limit (CDN or host firewall) on POSTs to both checkout endpoints.
• Turn off guest checkout and My account sign-ups for now, if real sales allow it.

Clean up

• Export attack order IDs, times, totals and IP addresses before deleting anything.
• Refund any fraud payment that went through, in the gateway. Do not ship.
• Move failed attack orders to the Trash once the export is safe.
• Delete fake customer accounts from the attack, checking each first.
• Check stock levels so items held by unpaid orders are back on sale.

Report and record

• Send the gateway the time window, order IDs, top IP addresses and what you changed.
• Ask if your account is restricted, when payouts resume and about attempt fees.
• Log every step with a time in an incident log.
• Real customers report fraud after buying? Suspect a skimmer, not card testing.

Make the store a poor target

• Keep the checkout challenge on and place a real test order after every update.
• Keep WooCommerce and edge rate limits in place after the attack ends.
• Review gateway fraud rules every month or two. Do not loosen them later.
• Set an alert or daily check for spikes in failed orders and declines.