High risk of fraud detected on Shopify: what to do

You opened the Orders page and there’s a warning symbol next to an order number. Shopify puts the same flag in your order notification emails, which is usually where people see it first, often before coffee.

Here’s the part that catches everyone out. The flag is a review, not a gate. The order already exists, which means the card was already charged. Nothing was blocked. You’re being asked to decide what happens next.

What the flag is built from

Shopify scores every order and sorts it into low, medium or high risk. Its fraud analysis builds that score from a handful of signals:

• Address Verification System (AVS) checks, which compare the billing address to the one the bank holds
• The Card Verification Value (CVV), the three digits on the back
• Whether the customer’s location matches the payment method
• Unusual device or network activity
• Whether the customer tried more than one credit card

The IP address is listed separately, with a location description beside it. That one is worth reading closely. A mismatch between the IP and the shipping address is the signal that most often means something.

Two things depend on your plan. Indicators show on Basic and above. The recommendation line needs the Grow plan or higher, or Shopify Payments on any plan.

Why it lands after the money does

This is the bit worth sitting with. Fraud analysis runs on orders, and an order exists because a payment went through. So the sequence is checkout, charge, then flag.

By the time you read the warning, the charge has happened. If you cancel and refund, you’re undoing something that already moved. If the card turns out to be stolen, you may be undoing it twice, once as a refund and again as a chargeback.

That’s not a criticism of the tool. Scoring an order needs an order to score. It just means the label answers a different question than most people think it does. It doesn’t ask whether to accept the payment. It asks whether to ship the goods.

What the recommendation is telling you

When your plan includes it, Shopify gives one of three lines:

• You can fulfill this order. The signals came back clean.
• Confirm with the customer before fulfilling. Something disagrees, but not enough to act on alone.
• Consider canceling this order. Enough signals point the same way.

The middle line asks for contact rather than a verdict. It is the one that expects you to go and find something out.

Shopify also states the consequence plainly:

Fulfilling high-risk orders can result in a higher number of chargebacks, which can result in disabling payment processing and removal from Shopify Payments.

So the stakes sit with the payment processor, not only with the one order.

What each signal on the page means

The order page gives you several readings. Here is what each one tends to indicate.

• The IP against the shipping address. A buyer in one country shipping to another isn’t automatically fraud. It is the strongest single disagreement the page can show.
• AVS. A billing address the bank doesn’t recognize is the next strongest.
• What they bought. Card testing runs small and cheap. Resale fraud runs expensive and easy to move on. An odd basket is a tell either way.
• Whether they answer. A real customer usually replies to a direct message and confirms their billing address.
• Their history with you. Somebody who has ordered three times and moved house reads differently from a first order at 3am.

None of these settle anything on their own, and a single disagreement is common on perfectly good orders. Shopify’s recommendation line is its own reading of the same signals. What happens to the order is your call, and it is worth making it on the whole page rather than one number.

When it’s a run, not one order

One flagged order is a judgment call. Twenty overnight is something else.

If you’re looking at a pile of small orders, different names, addresses that don’t resolve, all within an hour or two, that’s card testing. Somebody with a list of stolen card numbers is using your checkout to find which ones still work. Your store isn’t the target. It’s the test bench.

The tell is the pattern rather than any one order. Same item, tiny totals, made-up names, a burst and then nothing. Each individual order might only score medium.

Reviewing those one at a time is the wrong job. You’d be grading homework a bot filled in, and paying a fee for every piece of it.

Stopping the next one

Fraud analysis is a review step, and it’s a good one. It’s just pointed at a moment that’s already passed.

The thing that actually changes your morning is refusing the checkout before the charge. That’s what we built Halt to do. It runs inside Shopify checkout and refuses repeat attempts from the same email, address or phone within a day. No charge happens, so there’s nothing to refund. Customers who have ordered from you before are never stopped. It starts in watch mode, so you see what it would have caught before it catches anything.

That doesn’t replace reading a flagged order. Real fraud still gets through occasionally on a first attempt, and that’s exactly what the risk score is for. It means the pile is one or two orders that deserve a human, instead of forty that never should have existed.

If you want the longer version of how the attack works, it’s in the announcement.