A symptom is a reason to investigate.
A change in cart activity or checkout progression can have many causes: shopper behaviour, integrations, retries or unwanted automation. First establish which metric changed, its denominator, the time range and whether collection changed at the same time. Avoid adding page events, sessions and orders into one attack count.
Shopify describes card testing as misuse of card details and notes that its suspected card-testing or bot checkout attempts are excluded from abandoned checkouts. An abandoned-checkout report is therefore not a complete payment-attempt feed, and an abandoned cart does not establish card testing. Shopify fraud-prevention guidance.
Use the evidence available at each layer.
A storefront script can report a page observation. A checkout pixel can report a supported progression event when privacy permits it. An order webhook can establish that Shopify delivered a later platform event. None of those alone provides a raw view of payment attempts or proves an attempted payment was prevented. Web Pixels API scope.
Review existing payment controls.
Shopify documents integrated card-testing protection for Shopify Payments, alongside fraud-analysis and payment-review tools with their own eligibility. Review the controls and support path available to your store. A new storefront app should explain how its intervention complements these mechanisms and which evidence it cannot access. Shopify’s fraud-prevention tools and eligibility.
Demand a bounded prevention claim.
For any proposed checkout control, ask which step is intercepted, which input drives the decision, which checkout paths are supported and what occurs on missing or stale evidence. Shopify validation Functions have explicit capabilities and restrictions; remote fetch is not generally available to an ordinary public app. A later order cancellation cannot retrospectively establish that a payment attempt never happened. Cart and Checkout Validation reference.
Keep the response reversible.
Start with review and narrow controls. A broad geography or network rule can affect legitimate customers as well as unwanted activity. Document the rule logic, expiry, exception path and stop control. Check the ordinary and accelerated customer journeys in an authorised test environment before activation.
Record an unresolved case as unresolved. Keep the later finding separate from cancellation, refund or suspension. Never place card numbers, CVC, passwords or customer case files into a detector or a general support form.
What Blokk currently claims
Blokk’s Shopify work is an early monitoring alpha. Its static quantity-validation source has no demonstrated live interception yet and is not a card-testing detector. We do not claim raw payment-attempt visibility or completed card-testing prevention.