The decision that matters with a suspicious order is made before you print the shipping label. If the card was stolen, the real cardholder disputes the charge with their bank, the money is taken back from you, and the goods are already gone. Shopify says plainly that it does not cover charge reversals from banks, and that the cardholder's bank also takes a chargeback fee from you. So hold the order, look at a short list of signals, try to confirm what you can, and cancel and refund if the details still don't fit together.
This guide covers the checks and the decision. It isn't legal advice, and your payment provider's own rules on disputes and refunds take priority over anything general written here.
What the signals mean
Payment platforms check a card order against several details. Shopify's fraud analysis shows indicators such as:
- whether the billing address matched the card (the address verification check);
- whether the security code (CVV) was correct;
- whether the customer's location matches the payment method;
- unusual device or network activity;
- whether the customer tried more than one card before one went through.
Shopify adds that individual indicators don't represent the order's overall risk. A gift sent to another city fails the address comparison and is perfectly normal. What should worry you is several signals at once, for example: the CVV failed twice, a third card worked, the shipping address is in another country from the billing address, and the order is for your most expensive item with express shipping.
Two patterns from Shopify's fraud prevention guide and from merchants on the Shopify Community are worth knowing by sight:
- Several orders, different names, one shipping address. Shopify's advice is to review the order details carefully and contact the customers.
- One card, several orders, each to a different address. A merchant described exactly this: three orders for the same item on the same card, sent to addresses far apart, all rated low risk and already shipped by the time they asked.
The second case shows the limit of any automatic rating: a low-risk label means the checks didn't find much, not that the order has been confirmed.
The risk rating and what Shopify suggests
On Shopify, eligible online card orders get a fraud recommendation of low, medium or high, and medium or high orders are flagged on the Orders page. The guidance shown with the order is one of three: you can fulfill it, confirm with the customer before fulfilling, or consider canceling it. Shopify also warns that fulfilling high-risk orders can lead to more chargebacks, and that too many can lead to disabled payment processing and removal from Shopify Payments.
Availability depends on your setup. Shopify lists the fraud indicators from the Basic plan up, and fraud recommendations from the Grow plan up or when you use Shopify Payments. Test, free, POS, B2B and subscription renewal orders get no recommendation. If you take payments through another provider, check what that provider shows you.
Check the order before you decide
Work through these for any flagged order, and for any order that looks odd to you even without a flag:
- Compare the addresses. Put the billing and shipping addresses on a map. Shopify's guide treats addresses far apart as a reason to look closer, while allowing for gifts.
- Look at the IP location. If it doesn't match the customer's area, belongs to a web host or is a proxy, Shopify says to contact the customer to verify the order.
- Search the email address. A search can turn up reports of fraud linked to it, or show a real person and business behind it.
- Check the phone number matches the area of the billing address.
- Contact the customer and ask simple questions about the order: what they ordered, who it's for, when they need it. Shopify calls a phone call "always a good idea".
Keep one limit in mind: if the card was stolen, the email and phone number on the order belong to the person using it, not the cardholder. A friendly reply isn't proof. It counts only when the answers fit the other details: the right name, a reason for the different address, no hesitation about what was ordered.
A request to change the shipping address after payment deserves the same check before you change anything.
A decision rule
Pick one outcome per order and write down why, in the order notes:
| What you found | Outcome |
|---|---|
| No flag, details consistent | Ship |
| One signal with an ordinary explanation (a gift, a new address) | Ship |
| Several signals, customer confirms and the details fit | Ship, and keep the notes and messages |
| Several signals, no reply or answers that don't fit | Cancel and refund |
| You can't decide | Don't ship yet; contact the customer again or cancel and refund |
When you cancel, do it before fulfillment. Shopify recommends canceling high-risk orders before they ship and, if you choose not to fulfill one, canceling and refunding it. Refund to the original payment method only. Don't send money to a different card or account the customer suggests.
Hold the payment while you check
If you get flagged orders regularly, Shopify lets you switch the payment capture method to manual in Settings > Payments. The card is authorized at checkout, and you capture the payment once you've reviewed the order. The window is limited: Shopify Payments gives an authorization period of 7 days, and you have to capture before it ends to be paid. Manual capture adds a step for every order, so it suits a store with a small number of high-value orders better than one shipping hundreds of cheap ones.
Automate only the clear cases
Shopify's fraud prevention guide mentions Shopify Flow workflows that flag, hold or cancel orders matching high-risk patterns. Holding high-risk orders for a person to review is a safe use. Canceling them automatically will also cancel some genuine customers, such as people sending gifts or travelling, so start with a hold and switch to automatic cancellation only if you've been canceling nearly every flagged order by hand anyway.
If you've already shipped
Contact the carrier straight away and ask whether the parcel can be stopped or returned; carriers handle this differently, so ask yours. Keep everything about the order: the fraud analysis, your messages with the customer, tracking events and proof of delivery. If a chargeback arrives, that's what you'll submit. Shopify's chargeback pages explain how a dispute is decided: the bank that issued the card reviews the evidence and decides the outcome.
Then use the order to tighten your checklist. Which signal did you see and ignore? Add it to the list you check before every high-value order.