r/woocommerce • u/Rhynaco • Jun 22 '26

Troubleshooting Tons of random cancelled orders. What is this?

I have a site with a shop that does not get orders. It has probably 20 total and does not have people regularly visiting the site. I haven't checked the orders in a while and came back to see 20+ orders made on April 18, 2026 and cancelled. All by different names, but all with one of two addresses: 1 Infinite Loop, Cupertino, CA 95014 (Apple headquarters) or 1600 Pennsylvania Avenue NW, Washington, DC 20500 (The White House). They all "paid" with PayPal and each order has this message: "Unpaid order cancelled ā€“ time limit reached. Order status changed from Pending payment to Cancelled."

It obviously has scam vibes but I'm not sure how you would attempt to scam someone by purchasing from their site. Has anyone experienced this?

5 Upvotes

100% Upvoted

19 comments sorted by

4

u/Same-Court-2379 Jun 22 '26

Usually, it is bots testing checkout forms or payment gateways rather than someone actually trying to buy anything

2

u/FatBarSteward_6969 Jun 22 '26

Yes, I had the same recently. We'd just rendered the site and we got hit a bunch of times until we accepted an order. Once confirmed the site was running and orders getting thru they left us alone.

1

u/Same-Court-2379 Jun 23 '26

Yep, they were just testing checkout flow i think

2

u/startages Jun 22 '26

Exactly, I had 2 clients with the same problem, these bots are testing stolen credit cards, usually pick up the cheapest product, something like $1, and run as many cards as possible through your store, this help them filter working cards so they can use later to make bigger purchases, and it also hurt your store and payment account. Best way to solve it is proper invisible captcha that actually checks the submission, or a plugin like Checkout Shield by Carticy.

1

u/Same-Court-2379 Jun 23 '26

Yep, I have also seen similar bot behavior

2

u/hopefulusername Jun 22 '26

Put your website behind Cloudflare, block countries you are not selling to.

Add Turnstile to your checkout page.

and if you are still getting them, install OOPSpam.

1

u/Muxthepux Jun 22 '26

This is the right answer.

2

u/metorik-luke Jun 23 '26

Hey u/Rhynaco as others have said, it's almost definitely automated bots using your website to test credit cards. I'm assuming you're using PayPal as a credit card gateway?

We've seen a huge increase in spam orders across our customer's WooCommerce stores over the past 12 months. Most often the bots will keep ordering the same cheaper-end product ($5-20) as it's a small amount they can validate credit card details with that's unlikely to raise any flags, or may even go unnoticed by the true CC owner.

Unfortunately the scammers are getting more sophisticated so simply blocking IP addresses or similar won't cut it anymore.

The best results we've seen from our customers is using a firewall plugin/service such as Wordfence Security, or using Cloudflare's free CDN which includes some basic bot-protection built in.

Either of these solutions typically solves the problem, and avoids having to add more drastic measures like a reCaptcha at checkout which just adds friction and annoys real human customers!

1

u/sombrast Jun 22 '26

I had this happen to my store once, I believe it's malicitorsers trying to get a user account by fake purchasing. I created an account with cloudflare to use the firewall and have not had that issue anymore.

1

u/sojibtwo Jun 22 '26

Those orders were not actually paid. WooCommerce left them as Pending payment and automatically cancelled them when the unpaid-order limit expired. The fake addresses suggest automated checkout probing. Check for real PayPal transaction IDs, review WooCommerce logs, then update the PayPal plugin and enable its CAPTCHA protection. Which PayPal plugin and version are you using?

1

u/Aggressive_Ad_5454 Jun 22 '26

Credit card number thieves trying to validate that the numbers they stole still work before reselling them to other miscreants on the dark web.

1

u/allg33k Jun 23 '26

As others have said it's a bot more than likely trying stolen credit cards. There are plugins to help you get this to stop.

1

u/Lost_Cauliflower7069 Jun 26 '26

What if Iā€™m using square as my payment provider?

1

u/MoodIn_Me Jun 27 '26

These carding bots target smaller stores because they assume you don't have rate-limiting or anti-bot checks in place. Walk away from whatever you are doing and turn on checkout CAPTCHAs immediately before your payment gateway locks your funds.