Shopify High Risk Orders: Fulfill, Cancel, or Verify First?

On this page 8 sections

1. How Shopify Fraud Analysis Scores an Order
2. Reading Each Risk Indicator on the Order Page
3. Low, Medium, High: A Decision Framework for Every Shopify High Risk Order
4. How to Verify a Suspicious Customer Without Losing the Sale
5. How to Cancel and Refund While Limiting Fees
6. Using Shopify Flow to Cancel High Risk Orders or Hold Them
7. Shopify Fraud Protection Options and When Paid Protection Is Worth It
8. Next Steps for Your Store

Key takeaways

• A "High risk" label is a prompt to review the order, not an automatic verdict. Read the individual indicators before you decide.
• Match your response to the stakes: order value, how easily the product can be resold, shipping speed and customer history.
• Pause fulfillment before you investigate, especially if apps or suppliers ship automatically. A shipped fraudulent order usually costs more than a canceled one.
• Shopify Flow can tag, hold and alert on risky orders automatically. Paid fraud protection makes sense when manual review no longer keeps up.

A red banner on an order is stressful. If you cancel it, you may lose a real customer. If you ship it, you may lose the merchandise, the revenue and a chargeback fee. This guide explains how to handle a Shopify high risk order. You will learn what each signal in Shopify's fraud analysis panel means and how to decide between fulfilling, verifying and canceling. It also covers how to contact a customer without driving them away and how to automate holds with Shopify Flow.

Shopify updates its admin, its risk models and its apps regularly. Labels and menu names in your store may differ slightly from the ones described here, so check the details against your own admin and Shopify's help center.

How Shopify Fraud Analysis Scores an Order

When an order comes in, Shopify reviews it and assigns an overall risk level, typically shown as low, medium or high. The level appears on the order details page, usually in a fraud or risk section, along with a short list of the indicators behind the score.

The score combines several kinds of signals:

• Payment checks: whether the card verification code (CVV) and billing address (AVS) matched what the issuing bank has on file
• Location and network data: where the customer's IP address appears to be compared with the billing and shipping addresses, and whether the connection came through a proxy or anonymizing service
• Behavior: how many payment attempts were made, whether the buyer tried multiple cards, and how the checkout session unfolded
• Shopify's broader data: patterns seen across many stores that an individual merchant can't see directly

Keep two points in mind. First, the score is a probability, not a verdict. Plenty of high-risk orders are legitimate, and some fraudulent orders score low. Second, the depth of analysis can depend on how you take payments. Stores on Shopify Payments and stores using a third-party gateway may see different levels of detail. Check what your order page actually shows before you build a process around it.

Reading Each Risk Indicator on the Order Page

Each indicator tells a different story. Read them together instead of reacting to any single one.

The combination matters more than any one flag. A gift order shipping to a different address with a clean CVV and AVS match is ordinary. A first-time order with a CVV failure, a proxy connection, several declined cards and overnight shipping to a freight forwarder fits a classic fraud pattern.

Also look beyond Shopify's panel:

• Customer history: A returning customer with past fulfilled, undisputed orders is a strong positive signal.
• Email address: A random string of characters at a free email provider doesn't prove fraud, but it adds weight to other flags.
• What they bought: Fraudsters favor items that resell easily, such as electronics, sneakers, gift cards and limited drops. They also tend to buy several units of the same high-value product.
• Where it's shipping: Freight forwarders, reshippers and mismatched names on the shipping label deserve a second look.

Low, Medium, High: A Decision Framework for Every Shopify High Risk Order

A consistent framework keeps you from making gut calls when you're busy, such as during a product launch or a holiday weekend. Adjust it to fit your margins and your products.

Then weigh four factors that Shopify's score doesn't know about your business:

1. Order value compared with your average. Losing one inexpensive order is a nuisance. Losing a large one can wipe out a week of profit.
2. Resale risk. Consumable or personalized products appeal less to fraudsters than branded goods that are easy to resell.
3. Shipping speed. Rush shipping shortens your review window. You can tell the customer that the order is pending verification.
4. Customer relationship. Repeat customers, subscribers and buyers you can identify deserve more benefit of the doubt.

Illustrative example: A store selling handmade candles gets a "High risk" order for a small amount from a returning customer. The only flag is an IP address in another state. That customer is probably traveling, so the store should fulfill the order. Later, the same store gets a medium-risk first order for many units of its most expensive gift set. The buyer paid after two declined cards, and the order ships to a forwarding warehouse. The store should hold and verify that order, even though its score is lower.

Don't overcorrect. Canceling good orders costs you revenue and customers, just as false declines at your checkout do.

How to Verify a Suspicious Customer Without Losing the Sale

Verification works best when it feels like customer service instead of an accusation.

Pause Fulfillment First

Before you contact anyone, make sure the order can't ship. Put the fulfillment on hold and tag the order (for example, "risk-review"). Check every app or supplier that fulfills automatically, including dropshipping and print-on-demand integrations. If they pull orders the moment payment clears, your review step won't stop anything.

Reach Out Politely

Send a short, friendly message from your store email:

• Thank the customer for the order.
• Explain that you confirm some orders before shipping to protect customers' cards.
• Ask the customer to confirm a detail, such as the billing ZIP code, the phone number or the items ordered.
• Give a clear deadline, and say what happens if you don't hear back.

Legitimate customers usually reply quickly and appreciate the care. Fraudsters often go silent or push hard for faster shipping.

What Not to Ask For

• Don't ask for a full card number, a CVV or a photo of the card. Collecting that data creates security and PCI DSS exposure, and it proves little.
• Don't change the shipping address on request for a flagged order without verifying the customer again. Last-minute address changes are a common fraud tactic.
• Don't treat a reply as a guarantee. A fraudster with a stolen card and access to the victim's email can answer your questions. Verification lowers your risk, but it doesn't protect you from a chargeback.

Use Stronger Authentication Going Forward

If your store has recurring fraud problems, consider 3-D Secure, which adds an issuer authentication step at checkout. When a transaction is successfully authenticated, liability for certain fraud chargebacks can shift away from the merchant, subject to card network rules. If you use a third-party gateway, ask your provider whether 3-D Secure authentication is available for your setup.

How to Cancel and Refund While Limiting Fees

If you can't verify an order, cancel it before anything ships. The way you cancel affects your costs.

Consider manual capture. Shopify's payment settings may let you authorize payment at checkout and capture it later. With manual capture, canceling a flagged order before capture typically voids the authorization instead of refunding a settled charge. That is usually cleaner for both you and the cardholder. The tradeoff is that authorizations expire after a limited window, so you need a routine for capturing good orders on time. Check your current capture settings and authorization periods in Shopify's payment settings.

If the payment was already captured, cancel the order and refund the full amount to the original payment method. Many processors don't return the original processing fee on a refund, so ask your payment provider how it handles refunds. Even so, a refund almost always costs less than shipping goods that later come back as a fraud chargeback, with its fee and the lost merchandise.

When you cancel:

1. Choose the reason that fits, such as fraud or failed verification.
2. Restock the inventory so the items go back on sale.
3. Decide whether to notify the customer. A brief, neutral message is appropriate for real buyers who simply didn't respond.
4. Never refund to a card or account other than the one charged.

If a chargeback arrives on an order you already refunded, keep the refund records, because you'll need them. Our guide to responding to a chargeback in Shopify walks through the process. Repeated fraud disputes can also affect your account standing, which is one common reason a Shopify Payments payout goes on hold.

Using Shopify Flow to Cancel High Risk Orders or Hold Them

Shopify Flow lets you automate repetitive review steps. Trigger and action names change over time, so design each workflow's logic first, then match it to the options in your Flow editor. Shopify also offers prebuilt templates you can adapt.

Workflow 1: Tag and hold for review (recommended starting point)

• Trigger: An order is created, or its risk analysis is complete.
• Condition: The risk level is medium or high.
• Actions: Add a "risk-review" tag, hold the fulfillment order, and send an internal email or Slack alert to the person who handles reviews.

Workflow 2: Fast-track trusted customers

• Condition: The risk level is high, but the customer has prior fulfilled orders and no disputes.
• Action: Add a "returning-customer-flag" tag so a reviewer can approve the order quickly instead of treating the customer as a new buyer.

Workflow 3: Auto-cancel only the clearest cases

• Condition: The risk level is high and specific strong indicators are present, such as a failed CVV combined with multiple payment attempts.
• Actions: Cancel the order, refund it, restock the items and log the order for reporting.

Be cautious with workflow 3. Automatically canceling every high-risk order will catch legitimate customers. Run a tag-only version for a few weeks and check how many flagged orders turned out to be real. Only then decide whether automatic cancellation is worth it for a narrow set of conditions.

Shopify Fraud Protection Options and When Paid Protection Is Worth It

Manual review works until your order volume outgrows it. When that happens, consider the options below.

A paid app or program is worth considering when:

• Review time is delaying shipments to good customers.
• Fraud chargebacks keep arriving despite manual checks.
• You sell high-value products that are easy to resell.
• You run drops or holiday promotions that bring bursts of card testing and order spikes.
• You're expanding to international customers you can't easily verify.

Read the terms closely. Note which orders are covered, what happens to orders the service declines, how pricing is calculated and what you must do to keep your coverage. Compare the fees against your actual fraud losses, not hypothetical ones.

Next Steps for Your Store

Start simple. Turn on a Flow workflow that tags and holds medium- and high-risk orders, and make sure no app ships an order before review. Use the decision framework above for a month and track which flagged orders turned out to be legitimate. That record will show whether you need stricter rules, more automation or paid protection.

If you're reviewing your payment setup at the same time, our guide to ecommerce payment processing for online stores covers the fundamentals. MannyPay offers Shopify payment integration and online payment processing for ecommerce merchants. To review your options, request a free quote, and a MannyPay specialist will respond within one business day.

This article is general information, not legal or financial advice. Confirm current platform terms with Shopify and your payment provider.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.