Shopify Fraud Analysis: Order Risk and When to Add an App

A warning symbol has appeared next to an order number on your Orders page, and the order is waiting to ship. Shopify has rated its risk of fraud as medium or high, and the decision is yours: ship it, check it or cancel it. Or a fraud chargeback has already landed on an order you shipped, and you are deciding what to change.

This guide goes from that flag to the decision. It covers how to read the fraud analysis on the order, what to do at each risk level, how to collect payment only after you have looked, what Shopify Flow can automate, and when a third-party fraud app with a chargeback guarantee is worth its fee. Order waiting now? Go straight to what to do at each risk level. No recommendation on the order at all? Start with which stores and orders get one. Paying for fraud chargebacks already? See whether a guarantee pays for itself.

What Shopify Fraud Analysis Is, and the Names Around It

Shopify's fraud analysis exists for one job: to identify orders that can be fraudulent so that you can review them in your admin before you fulfill them. Its recommendations come from machine learning trained on historical transactions across all Shopify stores.

On Shopify Payments you don't set it up. Shopify's Shopify Payments configuration guide says it performs enhanced fraud analysis automatically on checkout transactions and shows the results as indicators on the order. None of the Help Center pages we read describes a step to switch it on (the pages are listed in the box under the accuracy question).

Four Shopify names sound alike and do different things. Only two of them pay anything when a chargeback arrives.

Which Stores and Orders Get a Risk Recommendation

Two separate things decide what you see: what your store qualifies for, and whether a given order qualifies. A store can pass the first and still show no recommendation on an order that fails the second.

Does Your Plan and Payment Provider Get Fraud Analysis?

Your plan and your payment provider set the ceiling. Find your row:

The Starter plan is not named in either plan sentence on the fraud analysis page, and the Starter plan page we read does not mention fraud analysis at all, so check a real order before relying on it there.

On a third-party gateway there is one more caveat: if the gateway reviews an order for fraud itself, the review status might not update in your admin, because some gateways don't send review updates back to Shopify.

Which Orders Get No Fraud Recommendation?

Even on a qualifying store, fraud analysis works only with online credit card orders that Shopify can verify. Shopify names these orders as receiving no fraud recommendation:

• test orders, although Shopify lets you simulate a recommendation on one, as the Flow section below explains;
• free orders;
• orders paid in full with a gift card;
• Point of Sale orders;
• B2B orders;
• subscription renewal orders.

Shopify introduces that list with the word "including", so treat it as examples rather than the full set. Since a 2024 update the order page itself tells you when a recommendation is not available, so a missing recommendation is not a fault you need to chase.

Zoom

How to Read the Fraud Analysis on a Shopify Order

The analysis has two layers that answer different questions. The recommendation tells you what to do; the indicators tell you why, and give you something to check.

Where the Risk Shows Up

You meet the flag in two places before you open anything. If an order has a medium or high risk, the Orders page shows a warning symbol next to the order number, and flagged orders are highlighted in order notification emails when you subscribe to them.

Inside the order, the Order risk section holds the analysis. Depending on the view, the full analysis is labelled Order risk evaluation or About this order. The analysis is usually instant but can occasionally take a few minutes, so wait for it to finish before you fulfill.

Fraud Indicators Versus the Recommendation

Indicators are the evidence. Shopify's list of what they can include has five items, and an order shows only the ones available for it:

The temptation is to count red marks. Shopify says individual indicators and group headings don't represent the order's overall risk level, and it is direct about what to do instead:

Some views, including the mobile app, group indicators under High risk signals, Low risk signals and Other details, or mark them with red, green and gray icons. When an order has assessments from more than one provider, such as Shopify and a fraud app, you select the provider whose assessment you want to read.

A missing check is not always a failed one. If the card's bank doesn't support AVS or CVV, the order is processed but that check is not flagged as a risk indicator.

Low, Medium and High Risk, and the Three Guidance Lines

The recommendation has three levels: low, medium or high risk of a chargeback due to fraud. It is a statement about chargeback risk, not a finding that the order is fraud.

The Order risk evaluation view can turn the level into a plain instruction. Shopify lists three guidance lines it can show, and says the guidance follows the order's recommendation, not an individual indicator:

• You can fulfill this order
• Confirm with the customer before fulfilling
• Consider canceling this order

In the updated Shopify view on desktop, an order whose recommendation is to investigate can also show a Contact customer action. It opens an email dialog and sends nothing automatically, and it needs an email address on the order.

Is Shopify Fraud Analysis Accurate?

"How accurate is it" has no published number behind it on the pages we read. What Shopify does say is what the recommendation is: a machine-learning estimate, trained on historical transactions across Shopify stores, of the risk of a chargeback due to fraud. Its developer documentation for the older Order Risk API put it bluntly: "Scores are not probabilities."

So the useful measure is your own. The Fraud Control app, covered further down, shows the share of your orders rated high risk and, on Shopify Payments, the share of your chargebacks marked as fraudulent. If fraud chargebacks arrive on orders the recommendation called low risk, that is the signal to add review or a fraud app, not a reason to stop reading the recommendation.

What to Do With High, Medium and Low Risk Orders

Each level maps to a different amount of work. The rule underneath all three is the same: act on the recommendation, and act before the order leaves your hands.

High Risk: Verify, Cancel or Refund

For a high-risk order, Shopify's options are to verify the order, cancel the order or refund the order. Shipping it anyway has a cost beyond the one order: Shopify warns that fulfilling high-risk orders can lead to more chargebacks, which can result in disabling payment processing and removal from Shopify Payments.

If you cancel, it is More actions > Cancel order on the order. Canceling does different things depending on whether the money was collected:

• Payment not captured: the payment status changes to Voided.
• Payment captured: you refund to the original payment method or to store credit, or choose Refund later, which issues no refund when you cancel.
• Fees: credit card transaction fees aren't returned to you when you refund; on Shopify Payments, Shopify's refund guide says you don't get any card fees refunded.
• The cardholder's statement: an authorization hold can appear on the real cardholder's statement even when no payment is captured.

Zoom

Canceling is still the safer side, with one limit worth knowing before you count the order as closed. The decision to reverse funds is made by the bank that issued the card, not by Shopify:

A Shopify Help Center video walks through the same decision: what a high-risk order means for your business, how to investigate it, and when to fulfill or cancel. It was recorded in 2021, so some screen names have changed since (the analysis is now labelled Order risk evaluation or About this order); the figures and rules on this page come from the current Help Center, not from the video.

Medium Risk: Confirm With the Customer First

Medium risk is where most of the judgement sits. The guidance line for it can read Confirm with the customer before fulfilling, and on desktop a Contact customer action, where available, starts that email for you.

Shopify's fraud prevention guide gives you concrete things to check before you write:

• The IP address. If it is located in a different general area from where the customer claims to be, belongs to a web hosting company or is a proxy service address, Shopify says to contact the customer to verify the order.
• The AVS result on physical shipments. For goods shipped to the United States, the United Kingdom or Canada, Shopify's chargeback prevention guide suggests shipping only orders that pass an AVS check.
• The addresses. Different billing and shipping addresses are not proof of fraud: legitimate shoppers sending a gift or buying for someone else often have them.

What to check, and what each wrong call costs in either direction, has its own answer in what to check before you fulfill a medium-risk order.

Low Risk: Fulfill Once the Analysis Has Finished

A low-risk order can carry the guidance You can fulfill this order, and that is the normal path. Two conditions still apply: the analysis must have finished before you fulfill, and a low score is not insurance: unless Shopify Protect or a guarantee app covers the order, a fraud chargeback on a low-risk order is still yours to absorb.

Stopping Fraud Before an Order Exists

Everything above happens after an order exists. On Shopify Payments, part of the screening happens earlier, at checkout, and it changes what reaches your Orders page. Shopify Payments also includes integrated card testing protection, aimed at credit card fraud at checkout.

Checkouts Shopify Payments Blocks

Shopify Payments can block some high-risk checkout attempts before an order is created. You won't find them among orders: they sit in the Blocked view of Orders > Abandoned checkouts. If an abandoned checkout's timeline includes Blocked due to high risk of fraud, Shopify Payments blocked the payment before an order was created, and no payment was captured.

A block can catch a real customer. If you know the customer and want to complete the sale, Shopify's route is a draft order with an invoice sent to them; how that invoice works is in sending a draft order invoice.

A second kind of block is about the IP address. When many orders or failed payments come from one IP address, Shopify can block it temporarily. The block is removed automatically within 6 to 24 hours, can't be lifted early, and a new attempt from the same address restarts the timer.

AVS and CVV Decline Settings on Shopify Payments

The decline settings live in Settings > Payments > Shopify Payments > Manage > Fraud prevention > Reduce credit and debit card fraud. Keeping Use automated settings active gives you Shopify's recommended settings.

With Shopify Payments, AVS is deactivated by default, because Shopify's fraud analysis authenticates high-risk transactions during the payment process. If you activate the AVS or CVV decline settings, any transaction attempt that fails the check is declined and no order is placed, and Shopify warns that activating AVS checks might increase failed transactions.

Two AVS rules are easy to confuse. The decline setting rejects a payment at checkout. The chargeback guide's advice to ship to the US, UK and Canada only on a passed AVS check is a decision you make about an order that already exists. They do not contradict each other, and you can use the second without the first.

Manual Payment Capture: Review Before You Collect

With automatic capture at checkout, money is collected before you have looked at the order. Shopify recommends manual capture so you can review high-risk orders before funds are collected, and lists reviewing an order's fraud analysis before deciding to capture or cancel as one of its uses.

Which Payment Capture Method Fits a Fraud Review

Shopify's payment authorization guide lists four capture methods. The right-hand column is our reading of what each leaves room for:

To switch, go to Settings > Payments and, in the Payment capture method section, select Manually. The setting applies only to orders placed in your online store, not to Point of Sale.

Zoom

Manual capture matters most on a third-party gateway. Shopify's fraud guide notes that transaction fees are charged on all payments processed through a third-party provider and aren't returned when you refund, so changing your capture settings to stop automatic capture on certain orders reduces what fraudulent orders cost you. Shopify's refund guide narrows that for third-party gateway orders: you get no transaction fee back where Shopify Payments is available in your store's country, and where it isn't, the fee is credited in proportion to the refund, only when you refund through your Shopify admin. What that fee is on your plan is set out in Shopify's third-party gateway surcharge.

One conflict to avoid: Shopify warns that using an automatic capture setting in Shopify together with a third-party app that captures payments automatically can lead to conflicts and unexpected behavior. Pick one of the two.

How Long Can You Hold an Authorized Payment?

Manual capture comes with a clock. You need to capture before the authorization period ends to receive any money from the order. Shopify Payments provides an authorization period of 7 days; with another provider, the length depends on that provider. Shopify also says authorization periods are subject to change.

Shopify Plus stores that use Shopify Payments can have extended authorization periods, which vary with the card's issuing bank. They are not free: capturing after the standard 7 days adds a 1.75% charge on top of standard credit card fees. To avoid it, Shopify suggests canceling the uncaptured order and creating a new one; the authorization expiry date is shown on the Orders page.

The manual capture settings include an option to send a warning 1 day before an authorization expires. It works only with Shopify Payments; on another provider, selecting it sends no warning emails.

Automating High-Risk Orders With Shopify Flow

Reviewing by hand stops working once flagged orders arrive faster than you can open them. Shopify Flow is a free app on the Basic, Grow, Advanced and Plus plans, and Shopify describes using it to check orders for potential fraud automatically.

The first decision is the trigger, and the obvious one is wrong. A workflow that starts when an order is created runs before the risk analysis exists:

The Order risk analyzed trigger has two limits worth knowing. It fires only after the analysis has processed, which takes some time, so the workflow does not start the moment the order is created. And it runs only for Shopify's risk assessments, not third-party ones, so a fraud app's score never reaches a workflow built on it.

To start from a template, open Flow and choose Browse templates, then the Risk category.

Zoom

The Fraud Control app page in your admin offers seven pre-made Flow templates. Four of them cover the jobs most stores start with:

What Flow can do depends on how you capture payment. Shopify's workflow examples spell it out:

• Automatic capture, manual fulfillment: Flow can cancel the order, but you can't prevent the payment from being captured.
• Manual capture: a workflow can check the risk level and capture payment only when the risk is low or medium. Workflows that manage capture don't work while automatic capture is on.

To check the workflow, simulate a flagged order: Shopify's fraud analysis page says a test order with a total value greater than zero gets a simulated high-risk recommendation when its email address is shopify.test.high@shopify.com and the Shopify Payments gateway is in test mode or, on another payment gateway, the store is on the Grow plan or higher (shopify.test.medium@shopify.com and shopify.test.low@shopify.com simulate medium and low). Then confirm that the workflow ran on that order.

Automation does not end the review. For the cancel template, Shopify recommends checking orders by hand after cancellation, which is how a legitimate customer caught by the rule gets their order back. For what else Flow can automate and where it stops, see Shopify Flow compared with Zapier and n8n.

The Fraud Control App: Dashboard and Checkout Rules

Fraud Control is Shopify's own app, listed as free. It is available on all store plans in locations where Shopify Payments is available, and it doesn't conflict with third-party fraud apps or affect how you use them.

What the Fraud Control Dashboard Shows

The Fraud Control dashboard reports your fraud exposure, including:

• acceptance rate;
• high-risk orders;
• fraudulent chargebacks;
• Shopify Protect protection;
• Shopify Protect coverage;
• orders canceled due to fraud.

If your store doesn't use Shopify Payments, you see only acceptance rate, high-risk orders and orders canceled due to fraud. On Shopify Payments the app also shows a chargeback health status, based on chargebacks as a share of all your orders:

Zoom

Fraud Control Checkout Rules, and What They Don't Promise

The second half of the app is checkout rules. The app recommends predefined rules, or you write your own, to block known fraudsters at checkout by email address, address or IP address, before they become orders. Shopify describes them as protection above and beyond what the built-in fraud analysis provides, and they are available only to merchants using Shopify Payments.

A blocked buyer gets an error saying the checkout could not be completed and asking them to reach out to the store owner, and the blocked checkouts appear in your abandoned checkouts. Expect the occasional message from a real customer caught by a rule.

Neither half is insurance. Shopify says Fraud Control can't guarantee that you'll never receive a fraudulent order, that the app doesn't guarantee coverage against chargebacks, and that you are solely responsible for any costs that result from chargebacks on your store. Its own advice is to review an order's fraud analysis before fulfilling it wherever you can.

Shopify Protect, and the Older Fraud Protect

Of the Shopify features in this guide, the one open to new stores that pays for a fraud chargeback is Shopify Protect. It is free and helps protect eligible orders against fraudulent and unrecognized chargebacks, but its gate is narrow. Shopify's order requirements say you must be located in the United States with a US Shopify Payments account, the order must be paid with Shop Pay, and it must be fulfilled with valid tracking within 7 days and in transit within 10 days.

That makes fulfillment speed part of your fraud setup on Shop Pay orders. Which orders Protect covers, what it pays and what it leaves out are set out in our guide to Shopify chargebacks.

When to Add a Third-Party Fraud App

Shopify's analysis tells you the risk; it never pays for a wrong call. Third-party apps fill one or both of two gaps: more screening and automation, or a guarantee that the vendor covers fraud chargebacks on orders it approved.

What a Fraud App Adds to the Built-In Analysis

Support for third-party fraud prevention apps starts on the Basic plan. Once installed, an app's indicators and recommendations show on each order together with Shopify's fraud analysis, and you switch between providers to read each assessment.

The catch is automation. Because the Order risk analyzed trigger runs only on Shopify's assessments, a workflow built on that trigger will not act on the app's verdict. What an app does with its own verdict depends on its kind:

• Screening and automation. The app scores orders and acts on them, for example capturing payment on orders it approves and canceling risky ones.
• A chargeback guarantee. The vendor approves or declines orders and, if a fraud chargeback lands on an approved order, covers it. That is what turns an unpredictable fraud loss into a fee you can plan for.

Five Fraud Apps on the Shopify App Store, as of October 10, 2026

These are five fraud app listings as we read them on the Shopify App Store on October 10, 2026. It is a dated snapshot, not a ranking and not the whole category, and the descriptions are each vendor's own words; we have not tested the apps or checked the terms of any guarantee.

Does a Chargeback Guarantee Pay for Itself?

Only one of the five listings prints a price ladder for its guarantee, so it is the one you can run numbers on without a sales call:

On the lowest guarantee tier, the fee is 1% of revenue with a $250 monthly minimum, so below $25,000 a month in revenue you pay the $250 floor, which is more than 1% of what you sell. That is the number your fraud losses have to beat.

What a fraud chargeback costs you is the disputed amount plus the fee. On Shopify Payments in the United States the fee is $15 per chargeback, and it is not returned if you accept the chargeback. So the break-even is one division: the monthly fee divided by the cost of one fraud chargeback (your average fraud order plus $15) gives the number of fraud chargebacks a month the guarantee has to absorb to pay for itself.

The number to set against that result is your own fraud chargebacks a month, which you count in your dispute list; Fraud Control's Fraudulent chargebacks metric, on Shopify Payments, is the percentage of your chargebacks marked as fraudulent.

Two adjustments keep it honest. Shop Pay orders that Shopify Protect already covers for free are not losses a paid guarantee saves you. And Signifyd, Riskified and ClearSale quote their prices through the vendor, so the same division needs their quote before it means anything.

Fraud-Review Mistakes That Cost Money

Most fraud losses on Shopify come from the order of operations, not from a missing tool. Each of these six traces back to a line in Shopify's own documentation:

Which Fraud Setup Fits Your Store?

The table in the plan and provider section tells you what your store has. This quiz answers a different question: which of those layers to switch on for your combination of payment provider, review time, chargeback history, order value and capture method.

Your Shopify Fraud Setup Checklist

Every route in the quiz uses the same steps; what changes is where the weight falls. Steps one to three apply to every store. If your route was manual capture and Flow, steps three and five do most of the work; if it was a guarantee app, step eight is where the decision gets made. Shopify Payments stores do step four, and everyone else skips it.

The Bottom Line

Shopify gives you a strong first screen for free. What it does not give you is cover for a wrong call, and that is the line between doing it yourself and paying a vendor.

Frequently Asked Questions