%201.svg)
Shopify High Risk Orders and a Review Workflow
Contracargos?
Ya no es problema tuyo.
Recover 4x more chargebacks and prevent up to 90% of incoming ones, powered by AI and a global network of 20,000+ merchants.
Más de 600 opiniones
En resumen:
- A Shopify high-risk flag is a prompt to review the order before it ships, not proof of fraud.
- Ship a flagged order only when the expected fraud loss (product, shipping and the $15 U.S. chargeback fee) is below the margin lost by cancelling a good order.
- Test, free, gift card, Point of Sale, B2B and subscription renewal orders get no recommendation, so record them as unassessed.
- Build risk workflows on the Order risk analyzed trigger and test them with Shopify's shopify.test.high email.
- Shopify Protect repays fraud chargebacks only on eligible U.S. Shop Pay orders fulfilled within 7 days.
A high-risk Shopify order is an order that Shopify's fraud analysis flags as likely to end in a fraud chargeback. The flag is a prompt to review the order before it ships. It is not proof of fraud and not an order to cancel.
The "high risk of fraud detected" Shopify message usually points to signals such as an AVS or CVV mismatch, an IP address far from the billing address, or repeated card attempts. The flag does not mean the order is a fraudulent order. It means a person should check it first.
If you run an eCommerce store on Shopify, you have likely seen a high risk order on Shopify already. That high risk fraud alert starts a familiar pattern. The fraudulent order meaning is simple: an order paid with stolen card details or another unauthorized payment method.
A scammer places the fraudulent order. The real cardholder spots the charge days or weeks later. You are left with a chargeback plus the cost of goods you already shipped. Our guide to how chargebacks work covers that process step by step.
Shopify fraud orders and fraudulent orders on Shopify are easy to confuse with legitimate high-value purchases. This guide covers:
- What the high fraud risk flag means on Shopify and what each analysis message tells you.
- How to deal with high risk orders on Shopify based on payment state.
- When to cancel, capture, or fulfill, with the cost math behind the call.
- How to use fraud analysis on Shopify to identify fraudulent e-commerce orders without turning away good customers.
Entre los motivos habituales de devolución que se originan en pedidos de alto riesgo se incluyen:
- Pago no autorizado
- No he recibido el producto
- El producto no se ajusta a la descripción
- Crédito no procesado
{{cta}}
¿Qué factores activan la alerta de «alto riesgo» de Shopify?
Shopify's documentation on fraud analysis lists the indicators it checks on each order. Our guide to Shopify fraud analysis explains how to read each signal. This page focuses on what to do with the flagged order. Indicators Shopify describes include:
- AVS and CVV checks: whether the card passes the Address Verification System check and the customer entered the correct CVV.
- Location and IP address: whether the customer's location matches the payment method. Our guide to IP address analysis shows what an IP can and cannot prove.
- Device and network activity: whether the order came with unusual device or network behavior.
- Multiple card attempts: whether the customer tried more than one card before the order went through, a classic card testing signal.
Shopify does not list order size, shipping address changes, or phone orders as indicators. These patterns still deserve your own manual review alongside the recommendation, especially where identity mismatch checks fail:
- Billing versus shipping mismatch: a common sign of a stolen card.
- Shipping address changed after the order was placed: a common way fraudsters reroute a package once a stolen card clears.
- A large order from a first-time visitor: fraudsters who have tested a stolen card often cash out in one large purchase.
- Phone orders: an order taken by phone skips the automated IP checks of an online checkout.
La tabla siguiente resume las señales de alerta más habituales y qué hacer ante cada una de ellas.
| Señal de alerta | Por qué es importante | Qué hacer |
|---|---|---|
| Discrepancia entre el código AVS y el CVV | Card details do not match what the issuer has on file | Considerarlo una señal clara de fraude; verificarlo antes de tramitar el pedido |
| La dirección de facturación no coincide con la dirección de envío | Common sign of a stolen card | Verificar la identidad antes de tramitar la solicitud |
| La dirección ha cambiado después de realizar el pedido | El desvío de paquetes es una táctica de fraude habitual | Revisar de nuevo la orden por fraude |
| Un pedido importante de un cliente que visita la tienda por primera vez | Fraudsters often cash out fast on tested cards | Confirmar la identidad antes del envío |
| Pedidos por teléfono | Skips the automated IP checks of online checkout | Aplicar una verificación adicional |
| Varios intentos fallidos de pago con tarjeta | Pruebas con tarjetas con diferentes números de tarjeta | Marcar y retener el pedido |
How Shopify's Fraud Analysis Recommendation Works
Eligible orders show a low, medium, or high risk recommendation of a chargeback due to fraud. Not every order gets one. Per Shopify, recommendations need the Grow plan or higher, or Shopify Payments. Stores on Basic see the indicators only.
These orders get no recommendation at all:
- Test orders and free orders.
- Orders paid in full with a gift card.
- Point of Sale orders.
- B2B orders and subscription renewal orders.
An order with no recommendation is unassessed, not low risk. Do not treat the recommendation as autopilot. Auto-shipping every low risk order and auto-cancelling every high risk one loses money both ways. Good high-value customers get cancelled, and some fraud still passes. The recommendation only reflects what Shopify can see, not what you know about your own customers.
What Each Shopify Fraud Analysis Message Means for the Order
The table below maps the guidance text Shopify shows, plus messages merchants commonly report, to a next step. The actions are suggested review steps, not Shopify rules.
| Message on the order | How to read it | Suggested merchant action |
|---|---|---|
| "You can fulfill this order" (low risk) | Shopify found no major indicators on this order | Atender los pedidos con normalidad; no obstante, realizar controles aleatorios de los pedidos inusualmente grandes o de los clientes nuevos. |
| "Confirm with the customer before fulfilling" (medium risk) | Some indicators are present, but they are not conclusive on their own | Contact the customer through the phone number or email on file and run identity mismatch checks on billing and shipping details |
| "Consider canceling this order" (high risk) | Indicators suggest elevated risk and the order warrants review | Complete a manual review before fulfilling, and cancel if the order cannot be verified |
| "Characteristics of this order are similar to fraudulent orders observed in the past" | The order matches patterns Shopify has linked to earlier fraud, even if other checks passed | Weigh it with the other indicators; verify identity before shipping a high-value order |
| "A high risk internet connection (web proxy) was used to place the order" | The buyer used a proxy or VPN that hides their real location | Ask the buyer to confirm the order; a proxy alone is not proof of fraud |
| "Shopify Protect is active for this order" | The order is covered for fraud chargebacks if you meet the fulfillment rules | Fulfill within 7 days with supported tracking and do not change the address |
| No recommendation shown | The order may be ineligible, such as a subscription renewal or B2B order | Use your own documented review policy; do not record it as low risk |
Reviewing every flag by hand also creates false positives, meaning good orders marked as fraud. Our guide to fraud false positives explains how to measure the cost of declining legitimate customers.
Quick Cost Check Before Releasing a Flagged Order
Use the high-risk warning to start a review, then compare the margin from a legitimate sale with the net cost of a fraudulent shipment. Include merchandise, shipping, applicable fees and the cost of delaying or losing a legitimate customer. The Shopify risk label is not a calibrated fraud probability.
Before you release the flagged order
Check the evidence
Resolve payment-state, identity and delivery inconsistencies using the checklist below.
Check the economics
Use the worked order decision model for assumptions, break-even risk and verification costs.
Enforce the decision
Use the Shopify hold and release workflow to ensure the warehouse follows the outcome.
Record the result
Keep the assessment, review decision and later refund or dispute as separate records.
Sources and further reading: Shopify's chargeback process guide.
Patrones habituales de estafas en los pedidos dirigidas a las tiendas de Shopify
"High risk of fraud detected" and "scam order" are related but not identical questions. The recommendation flags single orders using generic indicators. The patterns below are specific tactics scammers run against Shopify stores, and each one leaves a slightly different fingerprint.
| Patrón de estafa | Cómo se refleja en tus pedidos | La mejor defensa |
|---|---|---|
| Pruebas con tarjetas (carding) | Una ráfaga de pedidos pequeños y similares en cuestión de minutos, a menudo procedentes de la misma dirección IP o del mismo dispositivo, en los que se utilizan diferentes números de tarjeta. | Limitar el número de intentos de pago; exigir el código CVV en cada transacción |
| Fraude por triangulación | Un anuncio de un tercero «demasiado bueno para ser verdad» redirige el pedido de un comprador real a tu tienda, pagado con una tarjeta robada | Watch for shipping addresses that do not match any marketing channel you actually run |
| Suplantación de identidad | A returning customer's saved details are used to place a large order that does not match their order history | Señaliza cualquier cambio repentino en la dirección de envío o en el volumen del pedido en las cuentas existentes |
| Fraude en las devoluciones y los reembolsos | Compra auténtica, seguida de una reclamación falsa por daños o por falta de entrega con el fin de obtener un reembolso por duplicado | Exigir fotos o una confirmación de seguimiento antes de realizar reembolsos |
| Fraude por parte de personas conocidas | El cliente recibe el pedido, pero aun así lo disputas como no autorizado o «no recibido». | Conserva la confirmación de entrega, los registros de IP y los registros de comunicación de cada pedido |
Friendly fraud, also called first-party fraud, is a dispute filed by the cardholder on an order they did place. A claim alone does not show intent. A strong evidence trail matters as much as catching the order before it ships, particularly for Shopify chargebacks. Return-based schemes are covered in our guide to refund abuse.
Decide From Payment State and Completed Review
The right response to a high risk order depends on where the payment and the order are. Name one owner for the review, such as the person responsible for fraud decisions. That way every flagged order has a single case submission owner, whether the review is manual or automated by a workflow. Use the table to choose the next action.
| State | Review | Next action | Record |
|---|---|---|---|
| Authorized, not captured | Risk assessment plus corroborating facts | Release or capture, or cancel, through the actual order workflow | Authorization state and decision |
| Captured, not fulfilled | Claim context and verification outcome | Hold fulfillment; resolve or refund through a permitted route if needed | Capture and completed credit references |
| Already fulfilled | Delivery and payment history | Preserve evidence and monitor for an actual complaint | Item and payment-linked records |
| No recommendation available | Available indicators and order context | Use the store's documented review policy | No recommendation recorded as unavailable, not low risk |
Cancelling an uncaptured authorization is not the same as refunding a completed payment. Do not assume a canceled authorization-only order needs a refund.
The window between checkout and fulfillment is where a flagged order is cheapest to stop. Our guide to post-purchase fraud prevention covers what to check in that window.
What To Do When Shopify Flags an Order High Risk
Una vez que comprendas por qué se ha marcado un pedido, revísalo siguiendo estos pasos en este orden, en lugar de reaccionar únicamente ante la etiqueta:
- Read the specific reasons, not just the recommendation. Shopify lists the indicators behind the flag. An AVS mismatch on an international order calls for a different response than three failed card attempts in two minutes.
- Verify the customer. Where your policy allows, ask for a government-issued ID and a photo of the card next to it, with matching name and last four digits. For higher-value orders, ask for a recent piece of mail or a utility bill at the billing address.
- Call the phone number on file. A real customer can answer basic questions about what they ordered and where. A disconnected number or a stranger's voice is a strong warning sign.
- Search the email address. An address tied to earlier fraud attempts, or one with no footprint at all, is a meaningful data point either way.
- Decide: verify, cancel, or fulfill with extra protection. If verification checks out, fulfill and keep the evidence on file. If the customer cannot be reached or the story does not hold up, cancel before the order ships, and refund only if the payment was already captured. If you fulfill despite lingering doubt, require signature confirmation on delivery.
- Document the decision. Save every verification step. If the order turns into a chargeback later, these records feed your chargeback evidence sources, and they are what a representment case relies on. For a repeat buyer disputing a Visa order, they can also support Visa Compelling Evidence 3.0. New to disputes? Start with what is a chargeback.
Do not apply this level of scrutiny to every order. Reserve manual review for orders with a medium or high risk recommendation, or with no recommendation. Let low risk orders through without friction. Extra checks that annoy loyal customers cost more in abandoned carts than they save in blocked fraud.
To stop repeat offenders after a cancellation, see how to block fraudulent customers on Shopify.
How to Ask a Flagged Customer to Verify Without Losing the Sale
Most flagged orders come from real buyers. A short, neutral message keeps them on your side while you check. Keep it factual, give a deadline, and never accuse.
- Subject: A quick check on your order #[number]
- Opening: "Thanks for your order. Our payment system asked us to confirm a few details before we ship, which we do to protect our customers' cards."
- The ask: "Please reply to confirm the shipping address and the last four digits of the card used."
- The deadline: "If we do not hear back within 48 hours, we will cancel the order and you will not be charged."
- Never ask for the full card number or CVV by email.
If verification fails, a polite cancellation is cheaper than a chargeback. If it passes, you avoid one of the costly false declines that push good customers to a competitor.
Automate the Review With Shopify Flow
Shopify's guide to fraud workflows with Shopify Flow explains that a workflow relying on the completed fraud analysis should use the Order risk analyzed trigger. The Order created trigger can run before that analysis is available. Tags and notifications are post-order actions, while cancellation, capture, refund, and fulfillment depend on the payment and order state.
Shopify offers ready-made risk templates in Flow:
| Flow template | Para qué sirve | Watch out for |
|---|---|---|
| Capture payment if order is not high fraud risk | Captures low and medium risk orders and leaves high risk ones uncaptured | Only works with manual payment capture turned on |
| Cancel and restock high risk orders | Cancels high risk orders, restocks items, tags the order and customer, and sends a notice | Cancels good high-value orders too, so add a value or customer condition |
| Cancel and tag orders from known bad email addresses | Cancels orders that use emails tied to past fraud | Shopify notes this is easy for fraudsters to work around |
| Cancel orders for customers who frequently return items | Cancels orders from customers with five or more returns in six months | Review policy and customer value before turning it on |
Illustrative example, not a recommended configuration: Order risk analyzed, then an elevated-risk condition, then tag the order for review and notify the named owner. Next, inspect payment and fulfillment state, then release or cancel under your approved policy.
A workflow that decides whether to capture payment requires manual capture. Shopify states that capture workflows do not function if automatic capture is on.
- Place a test order with the email shopify.test.high@shopify.com to simulate a high risk recommendation.
- Use shopify.test.medium@shopify.com and shopify.test.low@shopify.com to check the other branches.
- Give the test order a total above zero, since free orders get no recommendation.
- Replace the placeholder internal email address in Shopify's templates with your own.
{{cta}}
¿Cubre « Shopify » los pedidos de alto riesgo de Contracargos?
Shopify Protect covers eligible Shop Pay orders against fraudulent and unrecognized chargebacks. It reimburses the chargeback amount and the chargeback fee. It is not coverage for all Shopify orders, every payment gateway, or every complaint, so check the protection state on the order itself. The requirements Shopify lists include:
- Availability for merchants in the United States on a U.S. Shopify Payments account.
- Payment through Shop Pay; Shop Pay Installments orders are excluded.
- Physical items that require shipping; digital products and in-store pickup orders are excluded.
- Fulfillment within 7 days and "in transit" status within 10 days, using a supported carrier's tracking.
- No change to the shipping address after checkout, and only the first order in a subscription qualifies.
Those requirements are why the manual review checklist above still matters. An order that misses the fulfillment deadline, uses a non-Shop-Pay payment method, or is not marked as protected has no Shopify Protect reimbursement if it turns fraudulent. Confirm current terms on the Shopify page before relying on the figures above.
AI Shopping Agents and High Risk Flags
Orders placed by an autonomous shopping agent can look different from a typical first-time visitor. A flagged order is not always a bad actor, so review should include whatever context the order carries. This is an exception to the basic workflow above, not a replacement for it.
The AI agent chargeback liability question is still being worked out. Agentic commerce chargebacks need a different evidence trail than a standard dispute, because there is no human browsing history to point to.
Herramientas de detección y prevención del fraude que se adaptan a cualquier escala
Manual due diligence catches plenty, but it does not scale past a handful of flagged orders a day. A broader ecommerce fraud prevention approach layers Shopify's built-in analysis with a chargeback protection layer and a chargeback alert service. Risky orders get flagged, and disputes get intercepted before they become a chargeback.
Chargeflow has recovered $200M+ for 20K+ merchants and backs Automation with a 4X ROI guarantee. Our breakdown of manual vs automated chargeback processing shows where the time goes. The goal is not to replace judgment on single orders. It is to stop spending hours a week on the ones your own review would have caught anyway.
Shopify High Risk Orders FAQ
What does "high risk of fraud detected" mean on a Shopify order?
It means Shopify's fraud analysis found indicators that warrant review before you fulfill the order. It is a decision input, not proof of fraud.
What should I do with a high risk order on Shopify?
Review the specific indicators, check the payment state, and contact the customer before fulfilling a high risk order on Shopify. Cancel the order if the customer cannot be verified, and refund only if the payment was already captured.
Should every high-risk Shopify order be canceled?
Do not automatically cancel every high-risk Shopify order. Review the available indicators, payment state, fulfillment state and corroborating facts under a documented policy.
What does "this order might be fraudulent" mean on Shopify?
It means Shopify's fraud analysis spotted one or more risk indicators on the order, such as an AVS mismatch or several card attempts. Check those indicators and confirm the buyer before you ship.
Which Shopify Flow trigger should a risk workflow use?
A workflow relying on Shopify's completed fraud analysis should use the Order risk analyzed trigger. Order created can run before that analysis is available.
Does every Shopify order get a fraud recommendation?
No. Test, free, gift card, Point of Sale, B2B, and subscription renewal orders do not receive one, and recommendations need the Grow plan or higher, or Shopify Payments. Treat an order with no recommendation as unassessed, not as low risk.
Will Shopify refund me if I get scammed?
Shopify refunds a fraud chargeback only when the order is protected by Shopify Protect. That means an eligible U.S. Shop Pay order fulfilled within 7 days with supported tracking. Other fraud chargebacks are the merchant's loss unless you win the dispute.
Does Shopify protect you from fraud?
Shopify protects merchants from fraud through fraud analysis on every eligible order, Shopify Flow risk workflows, and Shopify Protect for eligible Shop Pay orders. None of these stops every fraudulent order, so a manual review step is still needed.
¿Cómo puedo evitar los pedidos fraudulentos en Shopify?
To stop fraudulent orders on Shopify, review medium and high risk orders before fulfillment, use the Order risk analyzed trigger in Shopify Flow, and block repeat offenders. A post-purchase screening tool and chargeback alerts catch what manual review misses.
Support review of risky orders before fulfillment, and dispute handling after it, with Chargeflow chargeback automation. Get started now.
Review Shopify Orders Before You Ship
Explore Chargeflow Prevent for post-purchase order review before Shopify fulfillment.
Contracargos?
Ya no es problema tuyo.
Recupera cuatro veces más Contracargos y prevención , hasta un 90 % de las entradas, gracias a IA y a una red global de 20 000 comercios.
.png)
