- Short answer
- Don't decide on the flag alone — verify first. Medium risk estimates chargeback probability, and outside Shopify Protect the loss is yours.
- Before you ship
- Check the four signals below, then contact the customer to confirm the purchase and the delivery address.
- Levels
- Shopify's fraud recommendation has three levels — low, medium and high. Medium is the only genuinely ambiguous one.
- What it measures
- Risk of a chargeback due to fraud, estimated by machine learning across Shopify transactions — not a finding of fraud.
- No published odds
- No Shopify page we have found publishes how often a medium-risk order ends in a chargeback.
- Who absorbs the loss
- Shopify Protect covers fraud chargebacks — US merchants on US Shopify Payments, Shop Pay, physical goods, tracked within 7 days.
- VAMP thresholds
- Visa: merchant Excessive at 150bps, acquirer portfolio Above Standard at 50bps. Shopify prints its own for your store.
- As of
- Shopify Help Center fraud, chargeback, Protect and monitoring pages, plus the Visa VAMP fact sheet, read August 31, 2026.
What does a medium risk flag on a Shopify order mean?
The flag estimates an outcome; it makes no finding about your buyer. Shopify's fraud recommendation sorts an online credit card order into one of three levels — low, medium or high — and what it rates is the risk of a chargeback due to fraud, not fraud itself.
The score comes from machine learning trained on historical transactions across all Shopify stores. The indicators the fraud-analysis page names are the AVS check on the card, the CVV code, details about the IP address the order came from, and whether the customer tried more than one credit card — a list it introduces with the words "can include".
No Shopify page we have found publishes the full set of signals or how they are weighted: as of August 31, 2026 this answer is read off the order-protection, fraud-analysis and Flow pages in the Help Center plus the fraud-solutions page on shopify.com, and the only indicator any of them adds beyond that partial list is "unusual purchase patterns" on the order-protection page.
What to check before you fulfill a medium-risk order
Medium is the level where a few minutes of your own work beats the model: it scores probability, you can check facts. Start with the four indicators below, and read each for what it does not settle. But the check that usually settles the order is not in the admin: contact the customer on the details they gave and confirm the purchase and the delivery address.
What each signal does and does not prove
| Signal Shopify names | What a bad result suggests | What it does not prove |
|---|---|---|
| AVS check | The billing address on the order is not the one the issuing bank holds. | Only that the two differ — not who typed them. |
| CVV code | The security code from the card was not supplied correctly. | Only that the field failed — a real buyer mistyping the code leaves the same result. |
| IP address details | Where the order was placed from sits oddly against the rest of it. | An address is not an identity, and a connection is not a person. |
| More than one card tried | The buyer put several cards through before one worked. | A shopper hitting a spending limit leaves the same trail. |
None of them decides the order alone. A customer who goes quiet after you ask them to confirm the order has told you what the score could not, and that silence is a reason to cancel rather than ship.
What does getting it wrong cost, each way?
The two ways of getting this wrong are not the same size. Cancelling a good order costs the margin on that order and whatever the customer thinks of you afterwards; the goods stay on your shelf.
A fraud chargeback costs the goods and the money. On Shopify Payments the disputed amount is deducted from your next available payout, and the fee for processing the dispute is debited separately — $15 USD in the United States, €15 EUR in most European countries — and it comes back only if you win. Where that lands before a payout reaches your bank is worth knowing before it happens.
How often a medium-risk order ends in a chargeback is not a number we can give you: no Shopify page we have found publishes that rate — not the fraud-analysis, order-protection or fraud-solutions pages, read on August 31, 2026. So read the asymmetry as a matter of direction rather than probability. The dispute procedure itself belongs to Shopify Payments.
When the loss is not yours, and what a pattern costs
Shopify Protect can take the loss off you, on a narrow set of conditions. If an eligible protected order receives a fraudulent chargeback, you are reimbursed the chargeback amount and the chargeback fee — but eligibility stacks: you must be located in the United States and have a United States Shopify Payments account, the order must be processed through Shop Pay, it must contain only physical items requiring shipping, and it must be fulfilled with valid tracking within 7 days and in transit within 10.
More conditions apply than the ones above, and the fuller list is set out alongside the high-ticket fraud controls.
Ignoring the flag as a habit is a different risk from ignoring it once. A reserve can be initiated on your Shopify Payments account following an assessment that identifies an increased level of risk, and a store that is placed in a chargeback monitoring program and does not bring its chargeback level down may receive fines or lose the ability to process credit card payments.
This article was written entirely by AI under human editorial direction. The editor sets the topic and structure, runs multi-stage validation on facts, links, and interactive elements, and verifies the output is useful from a business perspective. All claims are checked against official Shopify sources. Details may change — always confirm critical data at shopify.com.
Editorial Policy