Cart jacking and fraud: How to protect your Shopify store from fake orders and inventory loss

Picture a trading card shop restocking a hot Pokemon set. The orders come in fast and look normal at first: different names, different addresses, different payment methods. Weeks later the chargebacks start rolling in, and by then the cards are already gone, reselling on secondary markets.

This pattern has a name: cart jacking. Bad actors use stolen credit cards or compromised accounts to place large orders on high-demand products. By the time the fraud is detected, the inventory is shipped and the merchant is left with chargebacks, lost product, and no recourse.

The problem has grown more sophisticated. Fraudsters now use fake identities, rotating residential IP addresses, and prepaid cards that are hard to trace back to a single buyer. Traditional fraud detection struggles because each order, viewed on its own, looks legitimate.

For the technical side of how bots exploit your inventory data, see why you need to protect your Shopify inventory from cart scraping.

How cart jacking actually works

Cart jacking typically follows one of three patterns, each targeting different store vulnerabilities.

Pattern 1: The bulk clearout. A fraudster with multiple stolen cards places several large orders within minutes of a product going live. Each order uses a different card and shipping address. By the time Shopify’s fraud analysis flags them, the inventory is already committed or shipped.

Pattern 2: The slow burn. Instead of bulk orders, sophisticated fraudsters place smaller, spread-out orders over days or weeks. They stay under fraud thresholds, use legitimate-looking checkout behavior, and wait until the chargeback window is almost closed before the merchant realizes what happened.

Pattern 3: The bot swarm. Automated scripts place dozens of simultaneous orders the moment a limited product drops. Some are fraud attempts, others are resellers using bots. Either way, real customers never had a chance. This pattern is especially common for trading cards, streetwear drops, and limited edition collectibles.

Three rules that actually reduce fraud exposure

Here are the specific rules that make the biggest difference for limited or high-value products.

Rule 1: Lifetime purchase limits per customer

This is the single most effective fraud deterrent for limited or high-value products.

Cart limits alone don’t help because fraudsters just place multiple orders. A customer limit of “max 2 per order” means nothing when someone can place 10 orders in 10 minutes.

Customer lifetime limits track purchases across all orders. Set a limit of 2 units per customer for a product, and that limit holds whether they buy today, tomorrow, or next month.

How to set this up in DC Order Limits:

1. Create a Customer Purchase Limit rule
2. Set the maximum quantity (2 for limited items, 1 for ultra-rare products is a common starting point)
3. Apply to your high-risk products using tags or collections
4. Decide whether to also require login for extra friction on your highest-risk products (tracking itself works for guests too, since it’s keyed to the email entered at checkout)

A store that spreads a restock across more unique buyers instead of a handful of accounts is a store that sells through fewer chargebacks and keeps more inventory with people who actually want it.

Rule 2: Login requirements for high-risk products

Guest checkout is convenient, and purchase limits already track guests by the email they enter at checkout, so you don’t need to require login for tracking to work. But requiring login adds a real barrier for fraud: creating and verifying a new Shopify account takes more effort than typing a different email address, and it gives you an account history to review if something looks off.

For limited drops and high-value items, requiring customer accounts adds meaningful friction for bad actors while barely affecting real customers. Most genuine buyers are happy to create an account for products they actually want.

Combine login requirements with customer purchase limits, and fraudsters need to create and verify new accounts for every order they want to place. That’s time, effort, and a higher chance of getting caught.

Rule 3: Segmented limits for new vs. returning customers

Not every customer carries the same risk. A first-time buyer ordering 5 units of your most expensive product is statistically riskier than a customer who’s been shopping with you for two years.

DC Order Limits lets you set different limits based on customer tags. Here’s a setup that several merchants use:

• New customers (no tag): Max 1 unit of any limited product
• Returning customers (tag: “verified”): Max 2 units
• VIP customers (tag: “vip”): Max 4 units

You can apply the “verified” tag automatically using Shopify Flow after a customer’s first successful order with no chargeback inside a set window. This creates a trust ladder: new customers prove themselves before getting higher limits.

For implementation details, see our guide on using customer tags and geolocation to tailor limits.

Two more rule examples worth copying

Capping repeat abuse of free samples

If you offer free or discounted samples, it’s only a matter of time before someone tries to order the same item repeatedly with different emails or fake accounts.

One approach: allow only 1 sample per product per customer, require login, and enforce the limit at checkout.

• Rule type: Quantity limit
• Limit: Max 1
• Grouping option: Product
• Product eligibility: Tagged “sample”
• Customer eligibility: Logged-in customers
• Applies to: Checkout only

Pair this with Shopify Flow to tag customers after purchase, so the limit holds even if they come back later. Genuine customers can still try the product; repeat abuse gets a lot harder.

Restricting spend for flagged accounts without banning them

Some stores see repeat fraud from the same customer pattern: same email style, same behavior, same result. Rather than banning the account outright (which draws complaints and support tickets), apply a price limit instead.

• Rule type: Price limit
• Limit: Max $1
• Grouping option: Product
• Product eligibility: All products
• Customer eligibility: Customers tagged “fraud” (applied manually or via Flow)
• Applies to: Cart and checkout

The account can still browse and shop, but it can’t place the large orders that cause real damage, and nothing about the restriction is visible to other customers.

Blocking common fraud signals before checkout

Purchase limits are your primary defense, but you can layer additional protections that catch fraud earlier.

Minimum order values for international orders

Fraudsters often test stolen cards with small international orders before placing larger ones. A low-value order to an international forwarding address costs you shipping, handling, and payment processing, all for a product that gets bundled with other fraudulent purchases and reshipped.

Set a minimum order value for international orders to filter out card testing and low-value fraud attempts. Legitimate international customers usually place larger orders anyway, since they’re already paying for shipping.

Cart limits as a scraping defense

Bots probe your inventory by adding huge quantities to cart and reading the error message. If they try to add 999 units and you have 47 in stock, they now know your exact inventory level.

Setting a cart maximum of 10-20 units per product variant makes this scraping useless. They’ll hit your limit before they hit your real inventory, and competitors or resellers can’t see your actual stock levels.

Discount and gift card abuse

Purchase limits aren’t only a fraud tool for physical inventory. The same logic stops shoppers from stacking discounts or claiming a gift-with-purchase repeatedly through multiple small orders. A simple “1 per customer” rule on the promotional item closes that loophole without touching the rest of your checkout.

What to do during BFCM and high-traffic sales

Peak shopping periods are when fraud attempts spike. Here’s a pre-sale checklist.

One week before:

• Set customer purchase limits on your top-selling and highest-risk products
• Require login for any limited or high-value items
• Set a minimum order value for international orders
• Review and tag any accounts with previous fraud indicators

Day of sale:

• Monitor orders in real time for clustering patterns, like multiple orders from similar addresses or sequential emails
• Have a process ready to hold suspicious orders for manual review before shipping
• Know your cancellation policy and when you can safely cancel flagged orders

After the sale:

• Review any orders with mismatched billing and shipping addresses
• Check for multiple orders to the same shipping address under different names
• Flag accounts that completed checkout at inhuman speed

For a complete seasonal checklist, see how to use order limits to stay in control during busy sales months.

Building a fraud-resistant store

Fraud prevention works best as layers. No single measure stops all fraud, but combining purchase limits, login requirements, customer segmentation, and order monitoring creates enough friction that most bad actors move to easier targets.

A setup that holds up well in practice looks like this:

• Customer purchase limits on sealed or limited product
• Lifetime limits to cap total units per customer across all orders
• Required login for purchases over a set dollar threshold
• Automatic “verified” tagging after a clean first order
• A minimum order value for international shipping

Stores running this combination tend to see fewer chargebacks and better-distributed restocks: more unique customers get access, and products stay in stock longer because they aren’t disappearing into a handful of accounts in the first few minutes.

DC Order Limits handles the purchase limits and customer tracking. You can install it here and set up your first rule in a few minutes. Start with your highest-risk products, the ones that sell out fast or have high resale value, and expand from there.

The goal is keeping your inventory for the customers who actually want your products. Every unit that goes to fraud is a unit a real customer couldn’t buy.