Card testing bots run stolen card numbers through checkout to find ones that still work, costing you processor fees and fraud-score damage. Tripwire tells bots from shoppers before a card is charged: shoppers earn a signed token by browsing; bots that jump straight to checkout don't have one. Two Shopify Functions remove card payment or block the order for tokenless low-value checkouts, while wallets stay available. It fails open, so uncertain cases are never blocked.

• Invisible storefront challenge mints a signed token while real shoppers browse
• Two Shopify Functions block tokenless low-value checkouts; wallets stay open
• Fails open automatically if tokens stop, so real sales are never blocked
• Admin dashboard shows protection status and prevented attempts
• Usage billing charges only for attempts actually prevented, via App Events API