# How do bots exploit buy-online-pickup-in-store to move stolen cards? | BondProof

Source: https://bondproof.com/blog/2026-11-11-bopis-pickup-fraud-bots.html

[Home](../index.md) / [Blog](index.md)


November 11, 2026 - BondProof

**Short answer:** Stolen cards get tested and spent through pickup orders because there is no shipping address to verify and the goods change hands in minutes. The bot places the order, a runner collects it, and the cardholder's chargeback arrives after the goods are gone.

## Pickup deleted the address check

Buy online, pickup in store grew by 500 percent during the pandemic, and it never went back. Shoppers like it because the goods are ready in an hour and there is no delivery fee. Fraud teams dislike it for the same reason: the order is placed, paid, and collected before any of the usual delivery checks have time to run.

The numbers are blunt. Fraud runs around 7 percent of BOPIS transactions, about 2.4 points higher than other methods. More than 40 percent of retailers say pickup measurably increased their fraud exposure, and a quarter of them report BOPIS losses of 3 to 10 percent of revenue. A channel that was built for convenience turned out to be built for stolen cards too.

A shipped order has to survive the address verification system, the delivery window, and the signature or the porch. A pickup order has to survive a person at a counter looking at a phone screen. The card's billing address is never tested against a delivery address, because there is no delivery address. The cardholder's name is never tested against the person collecting, unless the store checks ID, and many do not for orders under a threshold.

That threshold is the hinge. Most stores check ID on pickup orders above roughly $150 to $300, and wave smaller orders through. A bot operator knows the threshold before the store's own staff do, because the threshold is visible in the pattern of which orders get questioned. The attack is shaped to fit under it.

## The fifty-dollar test order

A stolen card is never spent on a $900 television first. The operator places a $50 order for something easy to collect, a small accessory or a gift card, and watches whether it clears. If it clears, the card is live and the real order follows. If it declines, the card goes back in the pile and the next one is tried.

The test order also probes the counter. Does the store ask for ID? Does it check the name on the order against the card? Does it hold the order for a manager above a value? The answers shape the next order, and the operator runs the test on dozens of cards a day, because the cost of a declined test is nothing and the cost of a cleared one is a television.

## Four patterns at the counter

The stolen-card walk-in is the basic version. One card, one order, one runner who shows the confirmation email and walks out. The runner is often not the operator, and often does not know the card is stolen. They were hired for a gig.

The ID mismatch is the version where the check exists and fails softly. The runner shows an ID with a different name and the associate waves it through because the queue is long and the order is small. The store's own policy was the defence, and the rush hour defeated it.

The multi-location ring is the scaled version. The same card is used at five stores in the same afternoon, each order under the ID threshold, each collected by a different runner. No single store sees a pattern. The card network sees five pickup orders in three hours, and by the time the cardholder reports it, the goods are resold.

Pickup-only targeting is the version where the operator never even tries shipping. The account exists only to place pickup orders, the delivery address field is empty, and the order history is a list of collected goods. An account that has never had anything shipped to it is not necessarily fraudulent, but it is worth a second look before the next pickup.

## The handoff record is the whole defence

When the chargeback arrives, the store's only evidence is the handoff. A pickup chargeback is decided on what the store can prove about who collected the goods, and a confirmation email on a phone is not proof of anything. Stores that win these disputes have a record: the name checked, the ID type and last digits, the time, the associate, and ideally a photo of the handoff.

The controls that work are boring. Check ID on every pickup above the threshold and spot-check below it. Match the name on the order to the ID, not to the email. Hold first-time pickup orders for a short review when the card is new to the account. And treat a pickup-only account with no shipping history as a risk signal, not a loyal customer.

Keep reading: [How does triangulation fraud use real shoppers to hide stolen card orders?](https://bondproof.com/blog/2026-10-19-triangulation-fraud-retail.md), [How does automated refund fraud turn store policies into a payout pipeline?](https://bondproof.com/blog/2026-10-17-automated-refund-fraud-retail.md), and [Gift receipt fraud: the return that was planned at the till](https://bondproof.com/blog/2026-11-01-gift-receipt-fraud-returns.md) cover the nearby cases in this series.

## Frequently asked questions

### Why is pickup fraud higher than shipping fraud?

Pickup removes the delivery address check, the delivery window, and the signature, so a stolen card can be spent and the goods collected in under an hour. Fraud runs around 7 percent of pickup transactions, about 2.4 points higher than other methods.

### What is a test order, and how do I spot one?

A test order is a small purchase, often around $50, placed to check whether a stolen card is live and whether the store checks ID at the counter. A pattern of small first orders followed by a large pickup order from the same account or card is the signal.

### Should stores check ID on every pickup order?

Checking ID on every order above roughly $150 to $300 is the common threshold, with spot checks below it. The record matters as much as the check: a pickup chargeback is decided on what the store can prove about the handoff.

### Can a store refuse a pickup order that looks fraudulent?

Yes. Stores can hold a pickup order for review, ask for the payment card at collection, or cancel and refund the order. A short hold on a first-time pickup from a new account costs a real customer minutes and costs a fraud ring the whole run.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)