Shopify Fraud Analysis: How to Detect & Prevent Store Fraud (2026)

{{cta}}

What is Shopify fraud analysis?

Shopify fraud analysis is the process of evaluating an order's risk signals, address verification results, IP and device details, order velocity, and product risk, to estimate how likely that specific order is to be fraudulent before you ship it. Shopify runs this evaluation automatically on every order placed through Shopify Payments and surfaces the result in the Fraud analysis section of the order page, alongside a Low, Medium, or High risk label.

The label is a starting point for a decision, not the decision itself. Reading it correctly means understanding which signals are driving the score, how much weight each one deserves on its own, and which combinations of signals turn a routine order into one that needs a second look before you fulfill it.

What signals does Shopify's fraud analysis check?

Shopify's risk assessment draws on machine learning trained across transactions from every Shopify store, according to Shopify's own documentation, and it weighs a specific set of order-level signals:

• AVS mismatch: the billing address entered at checkout doesn't match the address on file with the card issuer.
• CVV mismatch: the card verification code was missing, incorrect, or not checked at all.
• Billing/shipping distance: the billing address and the shipping address sit in different cities, states, or countries.
• IP address and proxy signals: the order's IP resolves to a different country than the billing address, or routes through an anonymous proxy or VPN.
• Order velocity: the same customer, device, or payment method attempts several orders, or tries multiple cards, in a short window.
• High-risk product categories: electronics, gift cards, and limited-drop items resell quickly, which makes them disproportionately common targets for card-not-present fraud.

None of these signals is disqualifying by itself. A customer shipping a gift to a different address, or ordering from a hotel Wi-Fi network while traveling, will trip some of the same flags as a stolen card. What matters is how many signals stack up, and which ones.

{{cta}}

How to read Shopify's Low, Medium, and High risk levels

Shopify's fraud analysis outputs two things on every order: a plain-language recommendation of Low, Medium, or High risk, and an underlying probability score between 0 and 1 that represents the estimated likelihood of fraud. The closer that score sits to 1, the more confident the model is that the order is fraudulent.

Medium and High risk orders get a visible warning on the Orders page in your Shopify admin, so they're easy to catch before fulfillment. Low risk doesn't mean zero risk, it means the signals available to Shopify didn't cross the threshold that triggers a warning. Treat the label as a triage tool: it tells you where to spend your review time, not which orders are safe to ignore entirely.

Signal severity: what's high risk, what needs a closer look, and what's probably fine

The table below maps common signal combinations to a severity read, so you can prioritize which flagged orders actually need a human to look at them first.

Order velocity deserves particular attention: the Merchant Risk Council found that 33% of merchants surveyed experienced card-testing fraud in 2025, and that pattern shows up in exactly the velocity signal above, several small or similar attempts landing on one store in a short span.

{{cta}}

What should you do with a flagged order?

Reading the signals tells you how risky an order looks. It doesn't tell you whether to fulfill it, hold it for review, or cancel it outright, and treating every Medium or High flag the same way costs you either lost sales or absorbed fraud. Roughly 5% of legitimate orders get incorrectly blocked by automated fraud screening, according to PYMNTS, which is exactly why the next step needs its own framework rather than a blanket rule.

For the full action plan, including which signals warrant an automatic hold versus a quick manual check, and how to decide whether to ship, hold, or cancel that order, see Chargeflow's Shopify fraud and chargeback protection guide.

Want the full prevention strategy?

This page focuses on reading the signals in front of you right now. If you're setting up defenses from scratch, checkout rules, account authentication, refund policy, staff training, start with Chargeflow's guide to help you build a full fraud-prevention strategy for your store. That guide fits inside a broader ecommerce fraud prevention approach that applies beyond Shopify as well.

Shopify's native detection versus third-party tools

Shopify's fraud analysis is free, automatic, and a reasonable baseline, but it only sees data inside the Shopify ecosystem and carries no financial guarantee outside Shopify Protect's narrow eligibility window. If you're deciding whether native detection is enough for your order volume, or which paid tool closes the gap, compare fraud-prevention tools in Chargeflow's breakdown of Shopify's built-in options against the top third-party apps.

{{cta}}

How Chargeflow fits into detection and recovery

Signal-based screening stops a real share of fraud before it ships, but it can't stop friendly fraud, where a legitimate buyer receives the order, then disputes the charge with their bank. That's a volume problem on its own, and it's where a chargeback actually starts costing you money regardless of how clean your fraud analysis looked at checkout.

Chargeflow is a fully automated chargeback management platform, trusted by 20,000+ merchants across 90+ countries and protecting over $50B in annual transactions. Its AI analyzes 1,000+ data points per dispute to build and submit tailored evidence automatically, with no manual work on your side, and its chargeback prevention alerts catch some disputes before they escalate into a formal case. Merchants see an average 4X ROI, and because Chargeflow runs on a success-based model, you only pay when a dispute is won. If you accept payments outside Shopify Payments, your payment service provider may route disputes differently, but the same evidence-first approach still applies. As AI shopping agents start placing orders on customers' behalf, evidence requirements are shifting again; Chargeflow's agentic commerce chargebacks playbook covers what that means for merchants now.

Start for free and let Chargeflow handle the recovery side automatically while you focus on reading the signals up front.