Shopify fraud filter: where it went and what to use

If you went looking for Fraud Filter because a rule stopped working, that’s why. Nothing is wrong with your store.

What the App Store page says now

The listing is still there. Open the Fraud Filter page and the developer is still Shopify. There’s no install button, and one line sits where the description used to be:

This app is not currently available on the Shopify App Store. If you have support questions, contact Shopify directly.

That’s the whole announcement, as far as the store is concerned. If you still had rules in it, they went with it.

What Fraud Control does instead

Fraud Control is a separate app, and it’s the closest thing to a replacement. It gives you three things: a fraud dashboard in your admin, checkout rules, and a set of Shopify Flow templates.

The checkout rules are the part worth knowing about. You can filter on an email, on address attributes, or on an IP address. Conditions combine, so an IP and a postcode together can make one rule. Shopify’s own wording is that they block checkouts from becoming orders.

Read that again, because it matters. These rules act before an order exists, not after. That’s the opposite of what most people assume. A blocked checkout shows up in your abandoned checkouts rather than in your orders.

Two limits to know going in. Checkout rules need Shopify Payments. And the Flow templates in the same app work the other way around, after an order is created, holding payment or cancelling or tagging.

The part that catches people out

A rule needs a value. An email, an address, a range of IPs. Something you can type into a box today.

That’s the right tool for a buyer who keeps coming back. You name them once and they stop arriving.

Card testing doesn’t work that way. It’s forty checkouts from forty made-up addresses, on forty different cards, inside an hour. There’s no value to type, because nothing repeats except the behavior itself.

So a rule list and a bot run are a bad match, and not because the rules are bad. They answer a question the bot never asks.

What a rule can say, and what it can’t

It helps to see the shape of it. A checkout rule is a sentence with a blank in it, and you fill the blank in advance.

• This address. A buyer you have had trouble with before.
• This IP, or this range. One machine, or one office.
• This postcode, with that IP. Two conditions, narrowing to a case you have already seen.

Every one of those names something. None of them can say the same email three times in a day. None can say five checkouts from one phone in an hour. Those aren’t values, they’re counts, and a rule has nowhere to put a count.

What you can do about the rules you lost

If Fraud Filter was holding rules you still want, rebuild them in Fraud Control. Email, address and IP cover most of what people used it for, and they now run earlier than they used to.

Keep an eye on your abandoned checkouts afterwards. That’s where blocked checkouts land. A rule that’s too wide shows up there as a pile of people who wanted to buy from you.

If what you had was a run of bot traffic rather than one repeat offender, a rule list won’t hold it. The signs of an attack are worth reading before you spend an evening writing filters.

Where ours fits

Halt matches on repetition instead of identity. Three checkouts from the same email or address inside a day, or five from the same phone. The next one is refused at the payment step. You never name anybody in advance.

It runs before the payment provider is called, so it doesn’t need Shopify Payments, and it works on every plan including Basic. Customers who have ordered from you before are never stopped.

It’s not a replacement for a rule list, and the two do different jobs. If you have one bad buyer, name them in Fraud Control. If you have forty checkouts and no two the same, naming them was never going to work.