Shopify High-Risk Orders: Using Fraud Analysis Before You Ship
How Shopify's fraud analysis rates order risk, what to do with medium and high-risk orders, capture timing, Shopify Protect, and a peak-season review routine.
In this guide
A fraudulent order costs you twice: the goods ship, and weeks later the real cardholder disputes the charge. The moment to stop it is before fulfillment, while the order is still a row in your list. Shopify’s fraud analysis is built for that moment, but it only helps if someone looks at it and knows what to do next.
This guide explains what fraud analysis shows, what each risk level means, how to handle medium and high-risk orders, why capture timing matters, where Shopify Protect fits, and a routine for the peak season around Black Friday (November 27, 2026) and Cyber Monday (November 30).
What fraud analysis is
Fraud analysis flags orders that may be fraudulent so you can review them before you fulfill them (fraud analysis). Two points from Shopify’s page set expectations:
- Banks, not Shopify, decide whether to reverse charges, and Shopify doesn’t cover those reversals.
- It applies to online credit card orders that Shopify can verify.
Availability
| Feature | Available on |
|---|---|
| Fraud indicators and third-party fraud apps | Basic plan or higher |
| Fraud recommendations (low, medium, high) | Grow plan or higher, or stores using Shopify Payments |
Some orders don’t get a recommendation: test orders, free orders, orders paid in full with a gift card, Point of Sale orders, B2B orders and subscription renewals. If you use a third-party payment processor, check with it about its fraud analysis limitations.
Risk levels and recommendations
Fraud recommendations rate an order’s risk of a fraud-related chargeback as low, medium or high. Medium and high-risk orders show a warning symbol next to the order number on the Orders page and are highlighted in staff notification emails.
The recommendation is one of three next steps:
| Shopify’s recommendation | What it means for your team |
|---|---|
| “You can fulfill this order” | Normal flow |
| “Confirm with the customer before fulfilling” | Don’t ship until someone has checked |
| “Consider canceling this order” | Owner decides; cancel unless there is strong evidence it’s genuine |
The recommendation reflects the whole order, not individual indicators or how many there are. One red indicator on a low-risk order isn’t a reason to panic; a high-risk order with mostly green indicators still deserves a look.
The indicators
Indicators are individual details about the order. Shopify lists examples such as:
- Address Verification System (AVS) results
- Whether the customer entered the correct card verification value (CVV)
- Whether the customer’s location matches the payment method
- Unusual device or network activity
- Whether the customer tried more than one credit card
The IP address is shown separately. To see all of this, open the order, go to the Order risk section and click Order risk evaluation or About this order. If you use a fraud app from the Shopify App Store, its indicators and recommendations appear alongside Shopify’s on each order.
Fraud analysis usually finishes immediately but can take a few minutes. If you see “fraud analysis isn’t available yet”, wait for it before fulfilling.
What to do with a medium or high-risk order
Shopify’s options for high-risk orders are to try to verify the order, cancel it, or refund it (fraud analysis). Turned into a routine:
- Hold it. Put the fulfillment on hold with a reason, so it drops out of your Unfulfilled list and can’t be shipped by accident. See fulfillment holds and split shipments.
- Read the evaluation. Which indicators are red? Does the shipping address make sense for the billing details? Has this customer ordered before?
- Contact the customer if needed. When Contact customer is available on the order, it opens an email dialog without sending anything, so review the message before sending. It needs an email address on the order.
- Decide. Release the hold and ship, or cancel.
- Record why. A note on the order explains the decision if a dispute arrives later.
Cancelling a suspected fraud order
When you cancel, you choose how to refund: original payment method, store credit, or later. Restock inventory and Send a notification to the customer are both selected by default, and you pick a cancellation reason. If the payment wasn’t captured, cancelling changes the payment status to Voided. Credit card transaction fees aren’t returned to you when you refund (canceling orders).
For a suspected fraud order, refund to the original payment method. Store credit makes no sense for a card that may be stolen. After an order is partially fulfilled, you can’t cancel it; refund the remaining items instead.
Don’t edit and re-charge a suspicious order to “fix” it: Shopify notes that collecting payment after an edit can change fraud analysis indicators and fraud protection status (editing considerations). More on edits in our order editing guide.
Capture timing: buy yourself time
If payment is captured automatically at checkout, a fraudulent order is already charged when you look at it, and cancelling means a refund. Shopify suggests manual capture when you want time to investigate before accepting payment. Manual capture lets you review an order’s fraud analysis before you capture or cancel (payment authorization).
The capture options under Settings > Payments:
- Automatically at checkout
- Automatically when the entire order is fulfilled
- Automatically when fulfilling (Shopify Plus, with capture per fulfillment)
- Manually
The trade-off is the deadline. Shopify Payments provides an authorization period of 7 days for credit card payments, and after it ends you might be unable to collect any money (capturing payments). With manual capture you can select Send a warning 1 day before an authorization expires, which works only with Shopify Payments. Our holiday rules for refunds and captures has the 2026 capture calendar.
Blocked checkouts
Shopify Payments can block some high-risk checkouts before an order is created. You’ll find them under Orders > Abandoned checkouts in the Blocked view. If you know the customer, create a draft order and send an invoice.
Fraud analysis can also temporarily block a customer’s IP address after many orders or failed payments in a short time. The block is removed automatically within 6 to 24 hours, can’t be removed sooner, and each new attempt resets the timer.
Shopify Protect, where it applies
Shopify Protect for Shop Pay provides chargeback protection from fraud, is free, and helps protect eligible orders against fraudulent and unrecognized chargebacks (Shopify Protect). If a protected order receives a fraudulent chargeback, you’re reimbursed for the chargeback amount and the fee, and the chargeback is handled for you. Eligibility is narrow (protecting an order):
| Requirement | Rule |
|---|---|
| Merchant | Located in the United States with a United States Shopify Payments account |
| Payment | Orders processed through Shop Pay |
| Not eligible | Shop Pay Installments orders; orders with digital products or items bought online and picked up in store; subscription orders after the first |
| Fulfillment | Fulfilled with valid tracking within 7 days of the order being placed |
| Transit | In transit to the customer within 10 days |
| Status | All non-refunded line items fulfilled, by supported carriers |
| Address | Changing the shipping address after checkout voids coverage |
To see which orders are covered, filter Orders by Shopify Protect: Protection active, Protected or Not protected (filtering by protection status). Combine it with Fulfillment status to find protected-eligible orders still waiting to ship. For orders with Shopify Protect information, review the protection status separately from the fraud indicators.
In practice: a Black Friday order on November 27 needs to be fulfilled with tracking by December 4 to keep protection. And an address change request on a Shop Pay order is a reason to pause, since it voids coverage.
If you aren’t eligible, every fraud chargeback is yours to answer; see our chargeback and dispute process.
A peak-season review routine
More orders means more orders to review. A routine that fits into a busy day:
Every morning and early afternoon
- Filter Orders to unfulfilled orders and look for the risk warning symbol.
- Hold every medium and high-risk order before the packing batch starts.
- Review held orders one at a time; release or cancel.
- Check orders with Payment status: Authorized against their capture deadline.
- If you’re eligible for Shopify Protect, check Protection active orders that aren’t fulfilled yet.
Weekly
- Look at the cancelled-for-fraud orders: same product, same shipping region, same email pattern?
- Check the Blocked view in abandoned checkouts for genuine customers who need a draft order.
Who decides
| Decision | Who |
|---|---|
| Hold a risky order | Anyone who packs or reviews orders |
| Contact the customer | Support lead |
| Release a hold on a high-risk order | Owner or a named reviewer |
| Cancel and refund | Owner; Shopify’s Cancel and refund permissions are separate, so give them only to named people |
| Capture | Whoever owns the authorized list, daily |
Shopify’s store permissions list Cancel, Capture payments and the two refund permissions separately (store permissions). Seasonal staff rarely need any of them; see seasonal staff access.
Checklist before BFCM
- Capture method chosen per store: automatic or manual
- Authorization warning turned on if you capture manually with Shopify Payments
- A hold reason agreed for fraud review
- Named people who can release holds, cancel and refund
- Shopify Protect eligibility checked, and the 7-day fulfillment window in your shipping plan
- Address change requests on Shop Pay orders flagged to a reviewer
FAQ
Does Shopify cancel high-risk orders automatically?
Fraud analysis flags orders and recommends a next step, such as “Consider canceling this order”; the decision is yours. Shopify Payments can block some high-risk checkouts before an order is created, and those appear in the Blocked view of abandoned checkouts.
Should I ship a medium-risk order?
Check the recommended next step on the order; it may be “Confirm with the customer before fulfilling”. Hold it, read the indicators, and contact the customer if anything doesn’t add up.
Does fraud analysis work on all orders?
No. Test orders, free orders, orders paid fully with a gift card, POS orders, B2B orders and subscription renewals don’t get a recommendation. Recommendations need the Grow plan or higher, or Shopify Payments.
What voids Shopify Protect on an order?
Changing the shipping address after checkout voids coverage. An order also isn’t protected if it isn’t fulfilled with valid tracking within 7 days and in transit within 10 days of being placed.
Can I capture payment after reviewing a risky order?
Yes, if you use manual capture. You review the fraud analysis first, then capture or cancel. With Shopify Payments, capture within the 7-day authorization period.
Where Storefleet fits
Fraud analysis is Shopify’s, and you review it in Shopify admin. Storefleet Store Ops helps when the review spans several stores: one order list across your stores, filtered by store, and in its web dashboard cancellations, refunds and payment captures are owner-only, each approved for its own store from one Approvals list and read back from Shopify after writing. If you post order alerts to a team channel, see order alerts in Discord and Telegram. For refunds that follow a cancellation, read partial refunds and restocking.