How to Stop Fake Orders in WooCommerce (7 Proven Methods)

The first sign of a carding attack usually isn’t a fake order with a silly name. It’s the Failed column in your orders list.

WooCommerce’s own guide to card testing attacks explains it well. Someone has a big batch of stolen card numbers and wants to know which ones still work. The first sign it lists is a large jump in orders with the Failed status, often with notes about declined cards.

Nothing was sold, so it’s easy to scroll past. But each failed order told the attacker something, and the cards that went through get used somewhere else.

That’s the part I’d want every store owner to know first. Bouncer, the CAPTCHA plugin we sell, exists because of this problem, but no single plugin stops all of it. So this post covers every layer I’d put around a WooCommerce checkout, free ones included.

TLDR

Fake orders come from card testing bots, spam registrations, nuisance attacks and synthetic identities made with AI tools. Watch for a spike in Failed orders first. Then stack the defenses: CAPTCHA on checkout and registration, rate limiting, IP and email blocking, fraud scoring, a gateway with AVS and 3D Secure, tighter guest checkout, and a daily look at your orders. CAPTCHA plus rate limiting is the place to start.

Why bots target your store#

Fake orders come from a few different sources, and each one needs a different response.

Carding attacks#

This is the most damaging type. Fraudsters steal credit card numbers in bulk and need to test which ones still work. Your checkout becomes their testing ground. They submit small orders ($0.50 to $5.00) to see which cards go through, and the ones that work get used for bigger purchases elsewhere.

Many of these orders never complete. They show up as Failed or Cancelled in your order list. If you only look for completed fake orders with gibberish names, you can miss an active carding attack entirely.

The cost doesn’t stop at the stolen money. When a stolen card does go through, the real cardholder disputes the charge, and you pay a fee on top of the refund. Stripe, for example, charges $15 for each dispute in the US, according to its pricing page. A high volume of failed attempts can also get your merchant account flagged.

Spam bot registrations#

Bots create fake accounts to test credentials, post spam in reviews, or grab perks for logged-in users like discounts or free shipping. If your store gives registered users different pricing, this becomes a real problem fast.

Competitor or nuisance attacks#

Less common, but it happens. Bots flood a store with fake orders to waste the owner’s time, skew the data, or tie up limited stock. Some attackers do it for fun. Others want to hurt a competitor.

AI-powered checkout bots (2026 trend)#

This is the newest threat. Generative AI tools now create synthetic identities that look realistic: properly formatted names, matching addresses, and automated checkout sessions that copy human browsing.

CAPTCHA alone won’t catch these, because they’re built to pass surface-level checks. You need CAPTCHA for the basic bots, behavioral checks for the synthetic patterns, and fraud scoring for the ones that look human.

SEO spam#

Some bots submit orders or reviews with links to scam sites. If those links show up anywhere public on your store, they can hurt your search rankings.

How to spot fake orders#

Not every odd order is fake. These patterns are red flags:

• A sudden spike in Failed orders. This is the most overlooked sign. Carding bots test dozens or hundreds of stolen cards, most get declined, and your order list fills with failed entries. Don’t ignore them because no money changed hands.
• Perfectly formatted but fake identities. Orders made with AI tools use realistic names and matching addresses. If the order looks too clean, the customer has no history and the IP is suspicious, flag it.
• Billing and shipping addresses in different countries or states.
• Gibberish names or emails like qwerty@example.com or test123@mailinator.com.
• Several small orders ($0.50 to $5.00) from the same IP address in a short time.
• Disposable email domains like mailinator.com, guerrillamail.com or tempmail.com.
• Impossible addresses with random strings instead of street names.
• Repeated failed payments followed by small successful ones, the classic carding pattern.
• Orders at 3 AM in quick succession with no browsing before them.

If you see these, especially a wave of failed orders you didn’t expect, you’re dealing with automated attacks, not the odd prankster.

7 ways to stop fake orders#

There’s no single fix. The approach that works stacks several layers, so a bot has to get past all of them, not just one.

1. Add CAPTCHA to your checkout and forms#

If I could only do one thing, it would be this. A CAPTCHA on checkout stops most automated bots before they can submit an order.

The key word is “most”. Basic bots get stopped. Sophisticated ones pay CAPTCHA-solving services. That’s why CAPTCHA works best as one layer, not your only defense.

What to look for in a WooCommerce CAPTCHA plugin:

• Block Checkout support. WooCommerce’s default checkout is React-based, and many older CAPTCHA plugins don’t work with it. Check compatibility before you install. My HPOS and Block Checkout guide explains why it matters.
• Express payment handling. Apple Pay, Google Pay and Amazon Pay use their own flows with built-in fraud checks. A CAPTCHA that hooks into the normal form submission breaks them. The plugin needs to spot express payments and skip them.
• WooCommerce PayPal Payments compatibility. This trips up a lot of stores. The PayPal Payments plugin has its own built-in reCAPTCHA, and if your CAPTCHA plugin also runs on checkout, the two can reject the same order. Your CAPTCHA plugin should skip PayPal’s protected methods when PayPal’s reCAPTCHA is on. I wrote up exactly where they collide in how to fix WooCommerce PayPal Payments reCAPTCHA conflicts.
• Invisible options. Cloudflare Turnstile and Google reCAPTCHA v3 are invisible to most shoppers. They check in the background, without asking customers to click a box or pick out traffic lights.

I compared 7 CAPTCHA plugins in Best WooCommerce CAPTCHA Plugins in 2026. The short version: for most stores, Simple Cloudflare Turnstile is the best free option.

If you use WooCommerce PayPal Payments or run a multi-vendor marketplace, Bouncer - reCAPTCHA & Fraud Protection for WooCommerce handles those compatibility issues. Full disclosure: it’s our plugin. For the setup itself, follow my step-by-step CAPTCHA setup guide.

2. Turn on rate limiting#

CAPTCHA stops single bot submissions. Rate limiting stops the volume.

Someone who submits 50 checkout attempts from the same IP in 10 minutes isn’t a real customer. Rate limiting blocks the IP after a threshold you set. Even if a bot gets past the CAPTCHA now and then, it can’t hammer your checkout hundreds of times.

Where to set up rate limiting:

• In a plugin. Some CAPTCHA and security plugins include rate limiting. This is the simplest option.
• At the server or CDN. If you use Cloudflare, you can add rate limiting rules that block excessive requests to /checkout/ or /?wc-ajax=checkout before they reach WordPress. Those requests never hit your server.
• At your host. Managed WordPress hosts like Pressable and WordPress VIP often include DDoS protection and request throttling. Check what your host offers before adding another layer.

3. Block suspicious emails and IPs#

Some attack patterns are obvious: the same disposable email domain placing order after order, or the same IP range hitting your checkout every night. You can block those directly.

Free plugins that help:

• Blacklist Manager blocks email addresses, email domains, IP addresses and phone numbers at checkout and registration. Blocking a domain stops a whole disposable email service like mailinator.com. Its free version also includes checkout email verification.
• Fraud Prevention for WooCommerce (formerly Woo Blocker Lite) offers similar blocking, plus blocking by state or zip code. That’s useful when fake orders cluster in specific regions.

If your CAPTCHA plugin already has IP and email blocking, you may not need a separate plugin for those. Bouncer, for example, has an IP blocklist with CIDR notation and wildcard support that it checks before CAPTCHA verification, so a blocked IP never reaches the challenge.

It also has an email blocklist that accepts full addresses, domains and wildcards. You’d still want a dedicated plugin for phone number blocking, which Bouncer doesn’t do.

Consider a web application firewall (WAF) too. Cloudflare, Sucuri and Wordfence include WAF features that filter bad traffic before it reaches WordPress. A WAF doesn’t replace form-level defenses like CAPTCHA, but it blocks a lot of bot traffic at the network level. If you use Cloudflare, even on the free plan, turning on Bot Fight Mode adds another layer.

The limitation: blocking is reactive. You block threats after you’ve seen them, and sophisticated attackers rotate IPs and email addresses. It works best next to CAPTCHA and rate limiting.

4. Use fraud scoring#

Anti-fraud plugins check each order against several risk signals and give it a fraud score. High-risk orders get flagged, held for review, or cancelled.

Signals these plugins check:

• IP location against the billing address.
• Known proxy or VPN use.
• Email reputation (disposable domains, brand-new accounts).
• Order velocity (too many orders too fast).
• Billing and shipping address consistency.
• Device fingerprinting.

YITH WooCommerce Anti-Fraud is one of the more established options. It scores orders with rules you set and can cancel high-risk ones automatically. WooCommerce Anti-Fraud from OPMC is another option on the WooCommerce Marketplace.

When to use it: if carding is your main problem, fraud scoring catches what CAPTCHA misses. Carding bots can solve CAPTCHAs with human solving services, but they struggle to fake a consistent IP location, email reputation and billing address all at once.

5. Require verified payment methods#

The fastest way to cut fake orders is to make payment mandatory and use a gateway with built-in fraud detection.

What I’d do:

• Turn off Cash on Delivery unless your business needs it. COD orders skip all payment checks, which makes them a favorite for spam bots.
• Remove Check Payments and Bank Transfer for new customers. These methods don’t verify anything at checkout.
• Use a gateway with fraud screening. Stripe Radar, PayPal’s fraud protection and WooPayments all check transactions in real time, and they catch a lot of carding attempts before the charge goes through.
• Turn on Address Verification System (AVS). AVS checks whether the billing address at checkout matches the address the card issuer has on file. Most gateways (Stripe, PayPal, WooPayments) support it and let you choose how strict to be. Carding bots often use random addresses that fail it.
• Turn on 3D Secure (SCA). For European customers, PSD2 already requires it. Everywhere else, it adds a check with the cardholder’s bank that a bot holding only the card number can’t complete. Most major gateways support it.

If your store accepts COD and you’re seeing fake orders, turning it off, even for a while, removes a big part of the problem right away.

6. Tighten guest checkout#

Guest checkout lowers friction for real buyers, which is why WooCommerce turns it on by default. It also lowers friction for bots.

I wouldn’t turn guest checkout off for good. In Baymard Institute’s checkout abandonment research, 18% of shoppers said they left because the site wanted them to create an account. Instead:

• Require email verification before the order is processed. Some anti-fraud plugins add this, Blacklist Manager’s free version included.
• Focus the CAPTCHA on guests. Logged-in customers with order history are lower risk, so put the friction on unknown visitors.
• Set a minimum order value. Carding bots usually test with tiny amounts ($0.50 to $2.00). A minimum of $5 to $10 blocks the most common testing pattern without bothering real customers. WooCommerce doesn’t have a minimum order setting built in, so this needs a plugin or a snippet.
• Hide your cheapest open-price products. WooCommerce’s card testing guide suggests temporarily making low-cost donation or “name your price” products private during an attack, because they’re the easiest target.

During an active attack, WooCommerce’s guide also suggests turning guest checkout off for a while. That’s a fair emergency step. Turn it back on once the attack stops.

7. Monitor, respond and adapt#

No defense lasts forever. Bot operators adapt, and what works today can get bypassed next month.

A monitoring routine:

• Check your WooCommerce orders daily for patterns (same IP, same email domain, odd hours).
• Set up alerts for failed payment attempts. A spike in failures often marks the start of a carding attack.
• Read your payment gateway’s fraud reports. Stripe, PayPal and WooPayments all have fraud dashboards.
• Keep plugins updated. CAPTCHA providers update their detection often, and outdated plugins miss new bot techniques.

If you’re under active attack, the fastest responses are:

1. Turn on Cloudflare’s Under Attack mode if you use Cloudflare. It adds a JavaScript challenge for every visitor.
2. Put checkout in maintenance mode while you set up defenses.
3. Contact your payment processor. Stripe and PayPal have fraud teams that help during active carding attacks.

Which approach should you start with?#

Start from what you’re seeing:

What you’re seeing	Start here
Spam bot registrations and junk orders	CAPTCHA on checkout + registration forms
Wave of Failed orders (carding attack)	CAPTCHA + fraud scoring + 3D Secure
Small completed orders testing stolen cards	CAPTCHA + fraud scoring + 3D Secure
Same email or IP submitting repeatedly	Rate limiting + IP and email blocking
Fake COD orders	Turn off COD, require online payment
Synthetic orders made with AI (realistic data)	Fraud scoring + AVS + behavioral monitoring
Everything at once	All of the above, layered together

Most stores should start with CAPTCHA plus rate limiting. That combination stops most automated attacks. Add fraud scoring and blocking if you’re dealing with more sophisticated threats.

Frequently asked questions#

Will CAPTCHA stop all fake orders?#

No. CAPTCHA stops automated bots, which place most fake orders. Sophisticated attackers use human CAPTCHA-solving services, so you need more than one layer. CAPTCHA handles the volume, and fraud scoring catches the ones that slip through.

Should I disable guest checkout?#

Probably not. Asking shoppers to create an account is one of the reasons they leave checkout. Add CAPTCHA to guest checkout and use fraud scoring to flag suspicious orders instead. Turn guest checkout off only as a temporary emergency step during an active attack.

Do chargebacks count as fake orders?#

Not exactly, but they’re often connected. Carding attacks lead to chargebacks when stolen cards are used. Each one costs you the transaction amount plus a dispute fee from your payment processor ($15 per dispute on Stripe in the US). Too many chargebacks can get your merchant account flagged or closed.

How do I know if I’m under a carding attack?#

The clearest sign is a sudden wave of Failed orders in your WooCommerce order list. Bots test stolen cards quickly, and most attempts get declined.

You’ll also see small orders (under $5), fast submissions from the same IP range, and names or addresses that don’t match. Check your gateway’s fraud dashboard too: Stripe, PayPal and WooPayments all show higher decline rates during an attack.

Does Cloudflare stop fake orders?#

Cloudflare’s Bot Management blocks network-level threats, but form-level bots that pass Cloudflare’s checks can still submit fake orders. Think of Cloudflare as the fence around the store and CAPTCHA as the check at the till. Neither replaces the other.

Will adding CAPTCHA slow down my checkout?#

Invisible providers like Cloudflare Turnstile and Google reCAPTCHA v3 add very little. They check in the background without a visible delay. Make sure your CAPTCHA plugin only loads its scripts on pages it protects. If checkout speed is already a worry, my post on why most WooCommerce stores feel slow covers the bigger picture.

What about AI-powered fraud in 2026?#

Generative AI is making fake orders harder to catch. Bots now create synthetic identities with realistic names, matching addresses and human-like checkout behavior. Basic CAPTCHA still blocks the automated volume, but you need fraud scoring to catch the ones that look real.

Pair CAPTCHA with a fraud scoring plugin and gateway checks like AVS and 3D Secure. No single layer catches everything.

Are free CAPTCHA plugins good enough?#

For most stores, yes. Simple Cloudflare Turnstile is free and handles the basics well. You only need a premium option for specific needs like WooCommerce PayPal Payments compatibility, multi-vendor support, or built-in rate limiting. I compared the options in my WooCommerce CAPTCHA plugin comparison.

If you only do one thing today#

Open your orders, filter by Failed, and look at the last seven days. If the list is short and every entry looks like a real customer, you’re fine for now. If it’s long, or full of small amounts and names that don’t match, that’s a card testing attack, and CAPTCHA plus rate limiting is where I’d start.

Then add 3D Secure on your gateway and a fraud scoring plugin if carding keeps coming back. For every other layer, from hosting to monitoring, see my WooCommerce security checklist for 2026.

If you want CAPTCHA that works next to WooCommerce PayPal Payments, skips express payments (Apple Pay, Google Pay, Amazon Pay), and includes fraud scoring, rate limiting and geo-blocking, that’s what we built Bouncer to do.