Post-Purchase Fraud Prevention: The Window Before Fulfillment

Post-purchase fraud prevention is the review of an order after the customer has paid and before it ships, while the merchant can still approve, verify or cancel it. The same phrase is also used for abuse that appears after delivery, such as refund abuse, return fraud and false not-received claims.

This guide covers the pre-fulfillment review, because it is the only point where a suspect order can be stopped before goods leave the warehouse. Each later stage costs more to unwind and leaves fewer options.

{{cta}}

Two meanings of post-purchase fraud

Refund and policy abuse is the fraud type merchants report most often, affecting 41% of merchants in the Merchant Risk Council 2026 Global eCommerce Payments and Fraud Report, a global survey, and false claims that goods were not received are its most common form, cited by 52% of respondents. Those cases need not-received claim handling, return fraud controls, delivery confirmation and a refund fraud prevention policy, not an order hold.

A pre-fulfillment review is one layer of ecommerce fraud prevention. It sits after checkout controls and before the dispute stage, and it works only while the order has not left your hands.

What a pre-fulfillment review can and cannot catch

Many results for post-purchase fraud describe the second meaning, abuse after delivery. A hold can only stop what a merchant can see before the parcel leaves, so this table sorts the common after-delivery abuse types by what a pre-fulfillment review can contribute.

The rows marked partly or yes depend on linking an order to earlier orders by identity, device or address. That is why a review tends to pay off against repeat abusers and does little against a first-time returner.

What each stop point costs

The cost of stopping an order rises at every stage. The mechanics below come from Shopify and carrier documentation because Chargeflow Prevent runs on Shopify today; other platforms differ in detail, so confirm the equivalent steps in yours.

Sources: Shopify guides to canceling orders and fulfillment holds; Checkout.com on refunds and reversals; UPS Delivery Intercept; USPS Package Intercept.

The difference between a refund and a reversal is why timing matters: the same cancellation incurs no interchange before capture and does after it. Issue the money movement through one path only, because a refund made in two places becomes a double refund.

Use manual capture to set the review window

With manual capture, the authorization period becomes the review deadline. Shopify marks the order Authorized, and you must capture within the period. Check these limits before relying on it, as set out in Shopify's payment authorization guide:

• Shopify Payments authorizations last 7 days. Shopify Plus stores on Shopify Payments can extend Visa and Mastercard to up to 30 days, depending on the issuing bank, but capturing after day 7 adds a 1.75% charge on top of standard card fees.
• Captured amounts use the exchange rate at capture, so cross-border orders carry currency risk.
• Authorization holds can stay on a customer's bank statement for up to 30 days after the original authorization, even after capture or cancellation.
• If a provider does not support manual capture, Shopify captures its orders automatically.

The window is set by the payment method, not by your policy, so check every method you accept:

Sources: Shopify payment authorization guide; Stripe place a hold on a payment method; PayPal authorization documentation. Providers change these windows, so confirm them before you rely on them.

Use the shortest window among the methods you accept as the review deadline. If an authorization expires before you capture, Stripe states that the funds are released and the payment is canceled, so an order that clears review late may have no payment behind it.

Build a connected pre-fulfillment decision

Use the order, payment and fulfillment records together. An order reference alone may not identify the right payment if the customer paid in several parts, and a payment score alone will not show that a replacement is already queued. Log the context available at the time, the policy version, the chosen action and the responsible system, and store later changes separately so the original decision stays intact as chargeback evidence.

1. Confirm the order is paid and still actionable.
2. Review the risk and customer context.
3. Check fulfillment status and any earlier support action.
4. Choose approve, verify or cancel under the merchant's policy.
5. Deliver the action to the fulfillment system and confirm it completed.
6. Tell the customer the next step.

If an essential signal is missing or late, define the fallback in advance. Approving blindly and holding indefinitely are both poor defaults when nobody knows which one applies.

Approve, verify or cancel

Signals that checkout already produced, such as an address match or a 3D Secure outcome, belong in the same decision record. Set a timeout and an owner for unresolved verification, and record abandonment separately from a confirmed fraud outcome. Shopify merchants can compare this process with the Shopify high-risk order review workflow built around Shopify's own risk flag, and read the underlying signals in Shopify fraud analysis.

Check the handoffs before you trust the hold

Map who does what: which system marks the order held, whether the warehouse reads that state before picking, who can override it and which event releases it. On Shopify, holds apply to a specific fulfillment rather than the whole order, a fulfillment can carry up to 10 manual holds, and Shopify Flow workflows or third-party apps can place holds automatically. Overriding a hold placed by an app might breach your agreement with that app. Align the rules with your order fulfillment process, then test the failure cases below.

Re-review orders that change after payment

A score taken at checkout goes stale when the order changes. Send an order back to review when any of these happens before it ships:

For immediate digital fulfillment the control window can be seconds, so a warehouse-style hold does not apply. Design the decision and the service-access process around the product sold, and keep the proof described in digital goods chargebacks.

Weigh friction against prevented cost

A review is worth running only when the loss it prevents exceeds the margin lost on good customers who abandon the step, plus review labor. These benchmarks frame the trade-off.

Sources: LexisNexis Risk Solutions True Cost of Fraud, retail and ecommerce, 2026 (513 risk and fraud leaders, US and Canada); Merchant Risk Council 2026 Global eCommerce Payments and Fraud Report (global survey, linked in the first section).

Report abandonment as its own line and track false positives next to prevented fraud. The cost multiplier above means the example likely understates what a stopped fraudulent order is worth, and the churn figure is the reason to price checkout friction instead of ignoring it.

Measure the recommended action and the applied action separately, because a cancel recommendation that fails to stop fulfillment prevented nothing. Treat staff time released as capacity, not payroll savings, and wait for a full dispute window before comparing losses.

Where Chargeflow Prevent fits

Chargeflow Prevent documentation describes after-payment, before-fulfillment risk review. Prevent scores each order using device, IP, email and payment-behavior signals and recommends approve, verify or cancel; you can apply recommendations automatically under your rules or review them in the dashboard. The documentation states that legitimate customers are never blocked at payment.

Prevent runs today through the Chargeflow app for Shopify and screens orders regardless of payment service provider. Support for other platforms is on the roadmap, and the documentation states that nothing on the Prevent page is callable through an API today. Merchants outside Shopify can start with chargeback alerts, including Ethoca alerts, which act after a cardholder contacts the bank but before the dispute becomes a chargeback. Treat Prevent as one part of a wider merchant fraud protection program.

Run a small pilot

A pilot should prove the holds work before it proves the scores are good.

{{cta}}

Perguntas frequentes

What is post-purchase fraud?

Post-purchase fraud is fraud or abuse tied to an order after the customer has paid. The term covers two cases: a fraudulent order that can still be held between payment and shipment, and abuse after delivery, such as return fraud, refund abuse, false not-received claims and disputes on delivered orders. Only the first can be stopped by a pre-fulfillment review.

What is a fraudulent order?

A fraudulent order is a purchase made with payment details the buyer is not authorized to use, or one the buyer later disputes or abuses after receiving the goods. The first is third-party fraud, usually card-not-present fraud; the second is first-party misuse such as friendly fraud.

How do you stop a fraudulent order before it ships?

You stop a fraudulent order by reviewing it after payment and before fulfillment: place a fulfillment hold, verify the buyer or cancel, then void or refund the payment. Confirm the warehouse acted on the hold. A carrier intercept is a costly fallback once the parcel has shipped.

Is post-purchase review the same as checkout fraud screening?

No. Post-purchase review acts on an order after payment, while checkout controls act during or before payment. The two stages offer different actions, such as holding fulfillment instead of declining a card, and have different effects on the customer.

Can a paid order still be held before shipment?

Yes, if the merchant's fulfillment process supports a hold and the order has not passed the relevant operational boundary, such as carrier collection. Confirm the actual warehouse action rather than relying on a requested status.

Should you void or refund a suspected fraudulent order?

Void it if the payment is only authorized, because a reversal never settles and no interchange is charged. If the payment was captured, you must refund it, which pays interchange and, on Shopify, does not return card transaction fees.

How long can you hold an order before you must capture payment?

It depends on the payment method. Cards on Shopify Payments and Stripe are authorized for 7 days, PayPal authorizations are valid for 29 days with a 3-day honor period, and Klarna through Stripe allows 28 days. If the hold expires before you capture, the funds are released and the payment is canceled, so use the shortest window among the methods you accept as the review deadline.

Can a pre-fulfillment review stop return fraud?

Mostly not. Return fraud, wardrobing and bracketing happen after delivery, so there is nothing to see before shipping. A review helps only where an abuser can be linked to earlier orders by identity, device or address, so pair it with return rules, inspection and dispute evidence.

Does successful verification guarantee no later chargeback?

No. Verification does not guarantee that a later complaint or chargeback will never arise. Delivery proof, service records and evidence controls remain important after an order is approved.

Does Chargeflow Prevent work outside Shopify?

Not today. Chargeflow's documentation lists Shopify as the supported route, states that nothing on the Prevent page is callable through an API yet and places other platforms on the roadmap. Confirm current availability before planning an implementation.

Review order risk before fulfillment with Chargeflow Prevent.