Shopify Fraud Prevention: Built-in Tools, Flow Rules, Steps
Shopify fraud prevention starts with tools already in your admin: fraud analysis flags orders with a low, medium or high risk of a fraud chargeback, Shopify Protect covers eligible Shop Pay orders in the US against fraud chargebacks, and Shopify Flow can hold or cancel orders that match patterns you choose. Review every medium- or high-risk order before you fulfill it: once goods have shipped, a chargeback takes both the money and the product.
Everything below comes from the Shopify Help Center pages on preventing fraud, fraud analysis, Shopify Protect and preventing chargebacks, read on October 23, 2026.
Shopify fraud prevention tools by plan
Which tools you have depends on your plan and on whether you use Shopify Payments:
| Tool | Who has it | What it does |
|---|---|---|
| Fraud analysis | Stores on Shopify Payments; stores on most third-party processors on Grow, Advanced or Plus | Indicators and a risk recommendation per order |
| Fraud indicators | Basic plan and higher | Details such as AVS and CVV results to investigate yourself |
| Fraud recommendations | Grow plan and higher, or any plan with Shopify Payments | Low, medium or high risk, with a next step |
| Shopify Protect | US stores using Shop Pay | Free protection of eligible orders against fraudulent and unrecognized chargebacks |
| Shopify Flow | Basic, Grow, Advanced and Plus | Rules, allow lists and block lists for orders |
| Dynamic 3D Secure | Shopify Payments stores in PSD2 regions | 3DS at checkout when the card’s bank requires it |
| Card testing protection | Shopify Payments | Stops automated testing of stolen cards at checkout |
| Proxy detection | Shopify Payments | Flags customers using a proxy service or IP address |
| Blocked checkout attempts | Shopify Payments | Some high-risk attempts are blocked before an order exists |
| Payment capture control | Stores not on Shopify Payments | Capture payment manually, after review |
If you are on Basic with a third-party processor, you get indicators but no recommendation. Shopify Payments is the simplest way to get the full set; our guide to Shopify Payments covers eligibility.
How to review a high-risk order
Medium- and high-risk orders show a warning symbol next to the order number on the Orders page, and they are highlighted in order notification emails if you subscribe to them.
- Open the order and find the Order risk section. The full analysis is labeled Order risk evaluation or About this order.
- Read the recommendation, not single indicators. The guidance is one of You can fulfill this order, Confirm with the customer before fulfilling or Consider canceling this order. Shopify is explicit that one indicator, or the number of indicators, is not the order’s risk level.
- Check the indicators: whether the card passed AVS (address) and CVV checks, whether the customer’s location matches the payment method, unusual device or network activity, and whether the customer tried more than one card.
- Check the details yourself. Is the IP address far from the billing address, or does it belong to a hosting company or proxy? Are billing and shipping addresses on different continents? Several orders with different names and billing addresses but one shipping address are a pattern Shopify names as a warning sign. Search the email address online.
- Contact the customer when the recommendation says so. In the desktop view a Contact customer action opens an email to them; a call to the phone number on the order also works. A real customer knows the addresses and details they used.
- Decide. Fulfill, or cancel and refund. Remember that a gift sent to another address is legitimate, so a mismatch alone is not proof.
If you want time to investigate before money is taken, set payments to manual capture. The order then waits for your review before funds are collected.
Orders Shopify does not score
Some orders get no fraud recommendation at all, including POS, B2B, gift-card-only orders and subscription renewals; the full list and how the scoring works are in machine learning fraud detection. A missing recommendation means the order was not checked.
Block repeat fraud with Shopify Flow
Flow lets you write rules once instead of reviewing each order by hand. Shopify suggests workflows that automatically flag, hold or cancel orders matching high-risk patterns, for example:
- Hold fulfillment for every order Shopify marks high risk, and email you.
- Add a tag to orders from an email address or shipping address you have already seen in fraud, so staff do not ship them.
- Notify you when one order contains an unusually large quantity of a single item.
On Shopify Payments you can also set AVS and CVV filters and use the Fraud Control app to block specific email addresses, IP addresses or billing details. The settings checklist is in our guide to Shopify anti-fraud settings.
Card testing
Card testing means scripts trying many small payments to find which stolen cards work. Shopify leaves suspected card-testing attempts out of abandoned checkouts. Each resulting chargeback counts toward your chargeback rate whether you win the dispute or not, so cancel suspicious orders before fulfillment, use manual capture, and set Flow rules for the pattern. Canceling reduces the risk of a chargeback but does not stop the cardholder’s bank from filing one.
Prevent chargebacks that are not fraud
Some chargebacks are not fraud at all. Shopify’s chargeback reasons, with what prevents each:
| Reason | What it means | Prevention |
|---|---|---|
| Unrecognized | The customer does not recognize your name on the card statement | Make your statement name match your store name |
| Duplicate | The customer believes they were charged twice | Clear order confirmation emails |
| Subscription canceled | Charged after canceling, or without an expected reminder | Send reminders before each renewal |
| Product not received | The customer says it never arrived | Tracking and delivery confirmation |
| Product unacceptable | Defective, damaged or not as described | Accurate descriptions and photos |
| Credit not processed | A return or cancellation was not refunded yet | Refund promptly and tell the customer |
Shopify’s general advice: make your contact details easy to find, answer customers quickly and keep them updated during shipping, so a problem reaches you before it reaches their bank.
In-store and phone orders
On Shopify POS, use chip or contactless payments instead of typing card numbers, and turn off Allow manual card entry (MOTO) on devices that do not need it. For phone or mail orders, send a draft-order invoice so the customer pays at checkout, where 3D Secure can apply. How machine learning scores orders is covered in machine learning fraud detection; more in the running a store hub.
Frequently asked questions
Does Shopify cover chargebacks? Not in general. The decision to reverse a charge is made by the card’s issuing bank, and Shopify does not cover charge reversals. The exception is Shopify Protect, which protects eligible Shop Pay orders of US stores against fraudulent and unrecognized chargebacks for free.
What does high risk mean on Shopify? It is the fraud recommendation for an online card order: Shopify’s machine learning, trained on transactions across all Shopify stores, estimates a high risk of a fraud chargeback. The order shows a warning on the Orders page and the guidance usually says to consider canceling.
Should I cancel a high-risk order? If you cannot verify the customer, yes: cancel and refund before fulfilling. Fulfilling high-risk orders leads to more chargebacks, which can end with payment processing deactivated and removal from Shopify Payments.