Max IT solutionsShopify App Store

Shopify Fraud Settings: 8 Settings to Check Today

Updated , first published · 5 min read

The Shopify fraud settings worth checking today are: payment capture (automatic or manual), a Shopify Flow rule for medium- and high-risk orders, the AVS and CVV filters and block lists on Shopify Payments, 3D Secure and card testing protection, manual card entry on your POS devices, draft-order invoices for phone orders, two-step authentication for every account, and who has staff access. Most take a few minutes; two use free apps (Flow and Fraud Control).

Facts come from the Shopify Help Center pages on preventing fraud, fraud analysis, preventing chargebacks, the Plus plan and account security, read on October 23, 2026. Points from the Shopify Community are marked as such.

The 8 settings

1. Payment capture. In the Payment capture settings on the Payments page of your admin, choose whether payments are captured automatically or manually. With manual capture, you review an order, then capture the payment, so a high-risk order can be canceled before money moves. Shopify points out that manual capture adds a step to every order, and that for stores on third-party payment providers it also limits transaction fees on fraudulent orders, because those fees are charged on processed payments and not returned on refunds. Card authorizations last 7 days as standard; Shopify Plus stores can get longer periods for some cards, with a 1.75% charge when capturing after the standard 7 days. Merchants on the Shopify Community note that the setting is store-wide, not per order, which is where Flow comes in.

2. A Flow rule by risk level. Shopify suggests using Flow to flag, hold or cancel orders that match high-risk patterns. Flow is available on Basic, Grow, Advanced and Plus. The rule is described below.

3. AVS and CVV filters and block lists (Shopify Payments). Shopify Payments stores can set address (AVS) and CVV fraud filters and use the Fraud Control app to block specific email addresses, IP addresses or billing details you have already seen in fraud.

4. 3D Secure and card testing protection (Shopify Payments). Stores in PSD2 regions use a 3D Secure checkout flow automatically, applied when the card’s bank requires it. Card testing protection and proxy detection are built in for Shopify Payments; there is nothing to switch on, but check you are on Shopify Payments if you want them.

5. Manual card entry on POS. If you sell in person, turn off Allow manual card entry (MOTO) in the payment options of each POS device that does not need it, and use chip or contactless payments instead. Train staff on the risks of typing card numbers.

6. Draft-order invoices for phone and mail orders. Instead of typing a card number you were given on the phone, create a draft order and send the customer an invoice. They pay at checkout, where supported cards can use 3D Secure.

7. Two-step authentication and passkeys. Turn on two-step authentication for your account and ask every staff member to do the same. Shopify requires it on your Shopify account to use Shopify Payments, because it protects against misdirected payouts. You can also add a passkey, which signs you in with your device’s fingerprint, face recognition or PIN.

8. Staff access. Never share your login; give each person their own staff account with only the permissions they need. Remove accounts of people who no longer work with you.

A Shopify Flow rule by risk level

The pattern merchants describe in the Shopify Community, built from Shopify’s Flow actions:

  1. Trigger: Order created.
  2. Condition on the order’s risk level:
    • High: hold fulfillment and send yourself an internal email, or cancel the order if you are confident. Canceling automatically will catch some real customers too, so start with a hold.
    • Medium: add a tag such as review-risk and notify staff to look at it before fulfillment.
    • Low: if you use manual capture, capture the payment so normal orders are not delayed.
  3. Test it on test orders before switching it on, and review what it did after a week.

One limit to know: the card is authorized at checkout before Shopify scores the order, so even a canceled high-risk order can leave an authorization hold on a stolen card, and the cardholder’s bank can still file a chargeback. Shopify says canceling reduces the risk but does not prevent the bank from filing one. Orders that get no recommendation (test orders, free orders, gift-card-only orders, POS, B2B and subscription renewals) will not trigger a risk-based rule.

How the risk level itself is calculated is covered in how Shopify fraud analysis works, and more on Flow conditions in the Shopify Flow guide.

Settings that do not exist, and the workarounds

  • Manual capture for some orders only. Merchants on the Shopify Community describe capture as a store-wide setting. Use the Flow rule above to capture low-risk orders automatically while manual capture is on.
  • Blocking a customer before they pay. Shopify Payments blocks some high-risk checkout attempts on its own, and you can review them in the Blocked view of Orders > Abandoned checkouts. Beyond that, the Fraud Control app’s block lists are the closest setting.
  • Protection for every order. Shopify Protect covers eligible Shop Pay orders of US stores against fraudulent and unrecognized chargebacks; other orders are not covered.

The full review process for a flagged order is in our guide to Shopify fraud prevention, alongside the other running a store guides.

Frequently asked questions

Does Shopify block fraud automatically? Partly. Shopify Payments includes card testing protection and proxy detection and can block some high-risk checkout attempts before an order is created, and fraud analysis flags risky orders. Deciding what happens to a flagged order is up to you, by hand or with a Flow rule.

Should I turn on manual payment capture? Turn it on if you receive a steady number of risky orders and can review orders within the authorization period, 7 days as standard. Combine it with a Flow rule that captures low-risk orders, so normal customers are not delayed.

How do I stop card testing on my Shopify store? Use Shopify Payments, which has built-in card testing protection, cancel suspicious orders before fulfillment, use manual capture, and set Flow rules that hold or cancel orders matching the pattern. Shopify notes that suspected card-testing attempts are not included in your abandoned checkouts.