Shopify fraud analysis assigns every online credit card order a risk level: low, medium, or high. This guide explains how the analysis works, what the risk indicators mean, and exactly what to do when an order gets flagged as medium or high risk.
Why this matters: Fulfilling a fraudulent high-risk order usually means losing the product, the revenue, and paying a chargeback fee on top. Too many chargebacks can even get your Shopify Payments account suspended.
How Shopify Fraud Analysis Works
Every online credit card order goes through Shopify's built-in fraud analysis. Machine learning models compare the order against patterns from millions of transactions across all Shopify stores and assign one of three risk levels. You find the result in the order details page, together with a list of individual risk indicators.
The three risk levels:
- Low risk — the order looks like a normal purchase; fulfill as usual
- Medium risk — some signals are off; verify before fulfilling
- High risk — Shopify believes there is a significant chance the cardholder did not authorize the purchase
What Triggers a Medium or High Risk Flag?
Common risk indicators behind a flag:
- Billing address does not match the shipping address
- The IP address location is far from the shipping address
- Multiple failed payment attempts before the order succeeded
- Unusually large first-time order
- A disposable or brand-new email address
- Characteristics matching previous chargeback fraud
Important: the flag is a probability, not a verdict. Some high-risk orders are real customers using a VPN or shipping a gift to a different address. That is why a quick verification step pays off.
How to Investigate a High-Risk Order
Open the order in your Shopify admin and scroll to the fraud analysis section. Then run through this checklist before deciding anything:
5-minute verification checklist:
- Compare billing and shipping addresses — do they match, and does the address actually exist?
- Check whether the CVV and billing ZIP code were entered correctly
- Look at the distance between the IP address and the shipping address
- Search the email address — a real customer usually has some online footprint
- Contact the customer using the phone number from the order — a fraudster rarely answers or the number is fake
Should You Fulfill or Cancel a High-Risk Order?
✅ Consider fulfilling when:
- The customer responds and can verify the purchase
- Addresses match and payment details check out
- It is a returning customer with clean history
- The order value is low enough that the risk is acceptable
🚨 Cancel and refund when:
- You cannot reach the customer at all
- Multiple cards or failed attempts were used
- The item is high-value and easy to resell
- Several risk indicators stack up at once
When you cancel, choose "Fraudulent" as the cancellation reason and refund the full amount. This voids the transaction before it settles and protects you from a later chargeback on that order.
What About Medium-Risk Orders?
Medium-risk orders are the gray zone: most are legitimate, but they deserve a look before fulfillment. A good policy is to hold them for a quick review — check the risk indicators, and only contact the customer if something genuinely looks off. Cancelling all medium-risk orders costs you real revenue; fulfilling them blindly invites the occasional chargeback.
Automate Your Fraud Analysis Workflow
Manually reviewing every flagged order does not scale. With a rules engine like FraudFalcon you can encode your policy once and let it run on every incoming order:
Example rules merchants set up in minutes:
- Automatically cancel orders Shopify marks as high risk above a certain order value
- Tag medium-risk orders for manual review and hold fulfillment
- Block repeat offenders by email, name, or address after the first fraudulent order
- Get notified instantly when a risky order comes in
This way legitimate orders flow through untouched, while risky ones are stopped before you ship anything.
🎯 Key Takeaways
- ✓ Shopify fraud analysis rates every card order low, medium, or high risk based on dozens of signals
- ✓ A high-risk flag is a strong warning, not proof — verify before you decide
- ✓ Cancel unverifiable high-risk orders with "Fraudulent" as the reason and refund in full
- ✓ Automate the policy with rules so every order is handled consistently, 24/7