How to stop scalpers buying out your Shopify TCG shop

A reseller walks into your store (digitally speaking) and buys every Prismatic Evolutions ETB you just restocked. Twenty minutes later, those same boxes are listed on eBay at triple the price. Your actual customers, the collectors who’ve been waiting weeks for restock, get nothing.

This isn’t hypothetical. It’s happening to trading card shops every single day.

Pokémon TCG products at MSRP are flipping for 200-300% markups. The $50 Elite Trainer Box hits $150 on the secondary market before most collectors even know it’s back in stock. Scalpers use bots, multiple accounts, and coordinated buying to clear inventory in minutes.

The damage goes beyond lost sales. Collectors lose trust in your shop. They stop checking your site because they assume everything’s already gone. The community you’re trying to serve gets priced out of the hobby entirely.

This guide covers exactly how to stop it: what Shopify gives you natively (not much), how to set up real per-customer purchase limits, and how to run a product drop that actually gets inventory into collectors’ hands.

About this guide: This article is written by Dash Checkout, which makes the DC Order Limits app for Shopify. We built our Customer Purchase Limits feature specifically to solve this problem. This guide includes honest coverage of Shopify’s native options and their limitations.

The scalper problem in trading cards is getting worse

Pokemon card values have surged in recent years, driven largely by speculative buying. That price gap between MSRP and market value creates a profit incentive that attracts organized scalping operations.

The pattern is consistent across TCG products:

• Pokémon TCG: Prismatic Evolutions, Crown Zenith, and chase sets sell out instantly
• One Piece TCG: OP-01 through OP-09 booster boxes flip for 2-3x retail
• Magic: The Gathering: Secret Lairs and collector boosters face the same pressure
• Warhammer/miniatures: Limited releases disappear to resellers

Major retailers have responded with strict limits. Walmart caps Pokémon TCG at 5 items per customer. Target limits some stores to 1 per person. GameStop enforces 2 items per account with managers sometimes dropping to 1 on hot releases. The Pokémon Center itself limits premium items to 1 per customer, per order, per account, per credit card, per person, AND per household.

Japanese retailers have gotten creative. Bic Camera requires customers to pass a 15-question Pokémon quiz before purchasing. Some stores remove packaging at point of sale to undermine resale value. Japan is even implementing government ID verification for priority purchases starting August 2026.

If billion-dollar retailers are implementing purchase limits, your Shopify store needs them too.

What Shopify does natively (and why it’s not enough)

Shopify offers one built-in option: add-to-cart limits. You can find this in Settings > Checkout > “Add-to-cart limit” and set a maximum quantity per item.

Here’s the problem: it’s a per-order limit, not a per-customer limit.

A scalper can add 2 units to their cart, check out, then immediately return and buy 2 more. Repeat until your inventory is gone. The limit resets with every completed order.

The bypass methods are well-documented

Shopify Community forums are full of merchants discovering these limitations the hard way:

• Direct checkout access: Customers can disable JavaScript and navigate directly to /checkout, bypassing any cart-side restrictions
• API manipulation: Direct POST requests to /cart/update.js bypass front-end quantity controls
• Cart permalinks: Anyone can construct a URL that adds any quantity at any time
• Multiple accounts: Nothing stops a scalper from creating new accounts with different emails

The Shopify Community has threads going back years asking for true per-customer limits. Merchants have been promised feature requests would be submitted, but there’s been no native solution as of 2026.

What about discount code limits?

Shopify lets you limit discount codes to one use per customer. But this does not help with purchase quantity limits. It only prevents discount abuse, not bulk buying.

What about Shopify Plus?

If you’re on Shopify Plus ($2,300+/month), you can use the Cart and Checkout Validation Function API to build custom server-side validation. This does work, but it requires developer resources to implement and maintain. For most trading card shops, this isn’t practical.

What actually works: per-customer purchase limits that track across orders

The solution is purchase limits that:

1. Track by customer, not by cart: remember what each customer has already purchased
2. Persist across orders: do not reset after checkout
3. Enforce at checkout validation: block the order server-side, not just in the cart UI
4. Work for guests, not just logged-in accounts: tracking happens at the email entered at checkout, so you’re not forced to require accounts

This is exactly what Customer Purchase Limits in DC Order Limits does.

How to set up purchase limits for your trading card shop

Here’s a step-by-step approach for TCG retailers.

Step 1: Decide on your limit structure

Most trading card shops use one of these approaches:

For hot releases like Prismatic Evolutions, most shops start with 2 per customer per product with lifetime tracking. This prevents bulk buying while still letting collectors pick up a sealed copy and one to open.

It also helps to think about limits by product type, since not everything in your catalog needs the same treatment:

• Sealed products (booster boxes, ETBs, special sets): this is where scalpers focus, so limits should be tightest. Premium sets and special editions: 1 per customer. Standard booster boxes and ETBs: 1 to 2 per customer. Booster packs: 10 to 20 per customer.
• Single cards: usually don’t need limits. Scalpers prefer sealed product because it’s easier to resell at scale. The exception is a rare chase card you’re listing well below market price.
• Accessories (sleeves, playmats, deck boxes): rarely need limits, since supply is typically adequate and resale margins are thin. The exception is a limited-edition playmat tied to a specific set.

If you’ve received 6 booster boxes and have 500 customers who want one, a 1-per-customer limit means 6 different customers get one each instead of one buyer taking all 6.

Step 2: Set up customer purchase tracking

In DC Order Limits, navigate to Customer Purchase Limits and create a new rule:

1. Select your products or collection: choose the specific TCG products, or use product tags like “limited-release” to group them
2. Set the quantity limit: start with 2 per customer
3. Choose the time window: “Lifetime” for drops, or “Weekly/Monthly” for ongoing inventory
4. Enable purchase history tracking: this is what makes limits persist across orders

The key setting: “Track purchase history” must be enabled. Without this, you’re just doing per-cart limits like Shopify’s native feature.

For detailed setup instructions, see our help docs:

• Customer Purchase Limits overview
• How to limit purchases to 1 per customer
• Lifetime purchase limits

Step 3: Decide on guest checkout and login

Customer purchase limits track purchase history by the email entered at checkout, so guest orders are tracked automatically. You don’t need to require an account for the limit to work.

If you want stricter enforcement, turn on “Require login” for a rule protecting your hottest products. This adds friction, but it:

• Makes it harder to dodge a limit by typing in a different email each time (a scalper now needs a second Shopify account, not just a second inbox)
• Builds your customer database
• Lets you identify repeat limit violations tied to an account

You can set this per rule, so regular products allow guest checkout while limited releases require accounts.

Step 4: Consider different limits for different customers

Not all customers are equal. You might want:

• Higher limits for verified collectors: customers with purchase history or loyalty program members
• Lower limits for new accounts: first-time buyers get 1 per product, established customers get 2
• Wholesale allocations: separate limits for your B2B customers

DC Order Limits supports different limits based on Shopify customer tags. Tag your VIP collectors and set up rules that only apply to (or exclude) specific tags.

Step 5: Automate with Shopify Flow

For shops with complex needs, Shopify Flow integration enables automation:

• Reset limits after a time period: automatically refresh allocations monthly
• Tag customers after purchase: mark buyers of limited products for future reference
• Trigger notifications: alert yourself when someone hits a limit repeatedly

See the Shopify Flow help docs for setup guides.

Running the drop itself

Limits only do their job if the rest of your drop is planned around them. Here’s how to run a release that feels fair to customers and sustainable for your team.

Before the drop

Set your limits days in advance, not 30 minutes before launch. Configure them, test them, then leave them alone.

Announce 24 to 48 hours ahead. This gives regular customers time to plan without creating a weeks-long window for resellers to organize. Include the date and time with timezone, which products are dropping, the quantity limit per customer, and whether login is required.

Test the whole flow. Add a product to your cart. Try to exceed the limit. Check that the error message is clear. Do this on desktop and mobile.

At launch

Launch day should be boring if the prep work is done:

• Change product status from draft to active, or remove the password if you’re using a collection password
• Post to your social channels and send your announcement email if you haven’t already
• Monitor for unusual patterns: the same address ordering repeatedly, rapid orders from different accounts
• Avoid changing limits mid-drop unless something is clearly broken

After the drop

Some customers won’t get what they wanted. How you handle that shapes whether they come back for the next release.

• Acknowledge the frustration. Something like “We know it’s disappointing when products sell out fast. Our allocation was limited and we wanted more collectors to get a chance” goes a long way.
• Explain why the limit exists. Most collectors understand scarcity. What frustrates them is one buyer clearing the shelf.
• Point to the next opportunity. If you know when more stock is coming, say so, and invite people to sign up for restock alerts.
• Consider a waitlist. Notifying customers in order as new inventory arrives builds loyalty and keeps them engaged between drops.

Best practices for TCG retailers

Based on what we’ve seen from trading card shops using DC Order Limits:

Be transparent about limits

Put your purchase limit policy on your product pages, in your announcement email, and in your FAQ. Legitimate collectors appreciate knowing the rules upfront. Something like:

“Per-Account Purchase Limits: To ensure more collectors get access to limited products, purchases are limited to 2 per customer. This limit is tracked across all orders.”

This messaging actually builds trust. It signals that you’re protecting the community, not just trying to maximize per-order revenue.

Start strict, then loosen if needed

It’s easier to increase limits than to deal with the fallout of scalped inventory. Start with 1-2 per customer on hot releases. If product sits longer than expected, you can always raise the limit.

Monitor for limit violations

Watch for patterns that suggest scalping attempts:

• Multiple accounts from the same IP or address
• Repeated limit blocks from the same email domain
• Bulk orders immediately after limit resets

DC Order Limits logs blocked attempts, so you can see who’s testing your limits.

Consider time-based limits for restocks

If you restock popular products weekly, a “per week” limit works better than lifetime limits. Collectors can buy on each restock, but can’t clear you out in one session.

Combine with other anti-scalping measures

Purchase limits are one layer. Also consider:

• CAPTCHA at checkout: slows down bots
• Delayed inventory updates: do not announce exact restock times publicly
• Local pickup priority: offer first access to customers who pick up in-store
• Community verification: some shops require social media verification or community membership

Preventing common workarounds

Scalpers adapt. A few patterns come up often, and it’s worth knowing what to watch for:

Multiple accounts. A scalper creates several accounts with different emails, each getting the full limit. There’s no perfect fix, but watching for multiple orders to the same address or payment method helps you catch and cancel the pattern.

Different shipping addresses. Orders go to a home address, an office, a family member’s house, and a PO box, each looking legitimate on its own. This is harder to catch automatically; manual review of orders tied to the same name or payment method is usually what works.

Requiring login for your hottest products won’t stop every workaround, but it raises the cost of running them, and most casual repeat buyers won’t bother.

What happens when someone hits the limit?

When a customer tries to exceed their purchase limit, DC Order Limits blocks the checkout with a clear message explaining why. The order does not go through. This is server-side validation, not just a cart warning that can be bypassed.

You can customize the error message to explain your policy and suggest alternatives, like signing up for restock notifications.

The bottom line

Shopify’s native cart limits reset after every order. That is not a purchase limit, it’s a minor inconvenience that any determined scalper works around in seconds.

Real purchase limits need to:

• Track customer purchase history across all orders, for guests and accounts alike
• Persist over time (lifetime, weekly, monthly, your choice)
• Enforce at checkout where it cannot be bypassed
• Pair with a planned drop, clear communication, and a bit of extra friction (like requiring login) on your hottest releases

If you are running a trading card shop and losing inventory to scalpers, Customer Purchase Limits solves this. Setup takes about 10 minutes, and your next restock actually reaches the collectors it is meant for.

Your community is watching how you handle this. The shops that protect their customers from scalpers are the ones building real loyalty in the TCG space.

Install DC Order Limits on the Shopify App Store and set up your first purchase limit rule today.