> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.omegatheme.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Stop repeated checkout attempts

## Overview

Stop bots and people testing stolen cards from hammering your checkout. They often reuse the same email address, shipping address, phone number or name to start many checkouts within a few minutes. Each checkout looks normal on its own, so a fixed Block checkout rule can't catch them. **Stop repeated checkout attempts** counts how many checkouts share the same value over the last 60 minutes and blocks the one that goes past the limit you set, while the attack is still going on. The card lives in **Fraud Filters**, under **Risk-based actions**.

## What you'll learn

* [Step 1: Turn the feature on](#2-step-1-turn-the-feature-on)
* [Step 2: Choose the signals to count](#2-step-2-choose-the-signals-to-count)
* [Step 3: Set the limit per hour](#2-step-3-set-the-limit-per-hour)
* [Step 4: Write the error message](#2-step-4-write-the-error-message)
* [How counting works](#2-how-counting-works)
* [Who can use this feature?](#2-who-can-use-this-feature)

## Step 1: Turn the feature on

From the Blockify dashboard, open **Fraud Filters**. The **Stop repeated checkout attempts** card sits right under **Risk-based actions**. Click **Turn on**.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/repeated-checkout-card-off_1s2vsxn.png)

| Tip: The first time you turn it on, Blockify asks which value you see repeated most often in suspicious checkout attempts — **Email address**, **Shipping address**, **Name** or **Phone number** — to set up this Beta Early Access for your store. Answer honestly, and our team will confirm the set-up with you if needed.

Once the feature is on, the card shows the **On** badge, the configuration opens below it and the button changes to **Turn off**.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/rca-card-on_17etjm1.png)

## Step 2: Choose the signals to count

Under **Signals to count**, tick the values Blockify should watch. Each signal is counted on its own, and a checkout is blocked as soon as one signal goes past its limit.

* **Email address** — counts checkouts submitted with the same email address.
* **Shipping address** — counts checkouts sent to the same address line, city and zip code.
* **Phone number** — counts checkouts using the same phone number, ignoring spaces and the country prefix.
* **Name** — counts checkouts using the same first and last name on the shipping address, ignoring capital letters and accents.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/rca-signals_iqv3dy.png)

Untick a signal to stop blocking on it; Blockify keeps counting it behind the scenes, so other rules can use the same numbers.

## Step 3: Set the limit per hour

Next to each signal, **Limit per hour** is the number of checkouts allowed for one value within 60 minutes. The default is **3** for every signal; you can enter any number from **2** to **50**. A value outside that range shows "Enter a limit between 2 and 50" and the settings cannot be saved until you fix it.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/rca-limit_1eq5q5i.png)

| Tip: Real shoppers who retry a failed payment (expired card, wrong CVV, failed 3-D Secure) can reach the limit: with the default of 3, their fourth attempt within the hour is blocked. Raise the limit if your store sees many legitimate retries.

## Step 4: Write the error message

**Error message** is the text the shopper sees on the checkout page when their checkout is blocked (up to 255 characters). It is the same field used by Block checkout rules, so keep it short and polite, for example "Order cannot be placed due to suspected fraud. Please contact us."

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/rca-error-message_8ggehg.png)

## How counting works

* A checkout is counted when the shopper submits it to complete the order. Submitting the same checkout again, or opening a new checkout from the same cart, counts again.
* Blockify always looks at the 60 minutes before each new checkout. With the default limit of 3: checkouts at 10:00, 10:10 and 10:20 go through, a fourth at 10:30 is blocked, and one at 11:01 goes through again because the 10:00 checkout has left the window.
* Blockify ignores small differences such as extra spaces, capital letters and accents, so "John Smith", " john SMITH " and "Jóhn Smith" count as the same name. A name is only counted when both first and last name are present.
* **Anyone who has ordered from you before is never counted.** A logged-in customer with at least one previous order always goes through, whatever the limits. Guest shoppers are counted even if their email has ordered before.
* If a checkout goes past the limit of several signals at once, or also matches another Block checkout rule, the shopper sees a single message and Blockify records a single block.
* Changing a limit applies to the next checkouts only; checkouts already blocked are not reopened.

## Who can use this feature?

Available on the **Enterprise** and **Shopify Plus** plans. The feature works through Blockify's checkout check, so it does nothing on plans where that check is not turned on.

## FAQs

1. **Why was a real customer blocked?**
They probably retried a failed payment more times than the limit within one hour, as a guest. Raise the limit for the signal that caught them, or ask them to log in: customers with a previous order are never counted.

2. **Does turning off a signal delete its counter?**
No. Blockify keeps counting every signal; turning it off only stops this feature from blocking on it.

3. **Can I see which checkouts were blocked?**
Blocked checkouts appear in the Block checkout analytics like any other checkout block; there is no per-rule log yet.