Shopify Fraud Prevention: How to Read Risk and Handle High-Risk Orders

Open the order and look at the Order risk section. From your Shopify admin, go to Orders, click the order, then click Order risk evaluation or About this order. On mobile the same summary sits under Order risk, behind About this order or Order risk evaluation depending on your app version.

Medium and high risk orders are also flagged on the Orders page itself, with a warning symbol next to the order number. You do not have to open every order to find them.

Shopify rates the chargeback risk from fraud as low, medium or high, and shows the indicators behind it:

• Whether the card passes Address Verification System (AVS) checks.
• Whether the customer entered the correct Card Verification Value (CVV).
• Whether the customer's location matches the payment method.
• Whether there is unusual device or network activity.
• Whether the customer tried more than one credit card.

What you get on your plan

This is where stores get caught out. Fraud indicators and support for third-party fraud apps are available on the Basic plan or higher. The fraud recommendation — the actual low, medium or high verdict — needs the Grow plan or higher, or Shopify Payments. Testing with a non-Shopify Payments gateway also needs Grow or higher.

So a Basic store on a third-party gateway sees the raw indicators and no verdict. If you are staring at a list of signals with nothing telling you what they add up to, that is why. Our Shopify payments setup guide covers what changes when you move to Shopify Payments.

The single most common error is reading the indicators instead of the recommendation.

Shopify is explicit about this: an IP address or a location description on its own is not a fraud recommendation, and neither the individual indicators nor how many of them appear tell you the overall risk. Three yellow flags on a legitimate order is normal. One flag on a fraudulent order is also normal. The recommendation is the number that has been weighted; the indicators are the working.

Two more things worth knowing before you act:

• Wait for the analysis to finish. If it shows as pending, refresh or check back in a few minutes. Fulfilling against a pending assessment means you fulfilled against nothing.
• The admin and the API use different words. The admin says low, medium and high. The API returns accept, investigate and cancel. Where several assessments disagree, Shopify takes the most severe one.

If anything you own reads risk programmatically

The REST Order Risk resource was deprecated as of version 2024-04 and risk assessments moved to the Order Risk Assessment API. The REST Admin API as a whole has been a legacy API since 1 October 2024, and new public apps have had to use the GraphQL Admin API since 1 April 2025. If a script, a Flow automation or an agency-built app still reads order risk the old way, that is a conversation to have now rather than after it breaks.

One field to stay away from entirely: the numeric risk score. Shopify marks it for internal use only and says it is not a probability and not guaranteed to be stable. Do not build routing rules on it.

Shopify Protect is free chargeback protection, and it is narrower than most merchants assume. Every one of these conditions has to hold:

• US stores only. Coverage applies to US stores.
• Shopify Payments and Shop Pay. It covers eligible Shop Pay transactions authorized through Shopify Payments.
• Fulfillment and tracking within seven days. Eligibility requires fulfillment and a tracking number for each order within seven days of receiving it.
• An approved carrier. Orders must ship with one.

Where it applies, it covers fraud-based chargebacks including the total order cost and the chargeback fee, and Shopify manages the dispute for you. Shop Pay transactions through Facebook, Instagram and Google are included. Protected orders show as protection active on the order.

Read the gaps honestly

Shopify's own Protect page does not publish a reason code list, an exclusion list, or any order value cap, and points to its full terms for eligibility detail. Treat anything you read elsewhere claiming a specific cap or exclusion list as unverified until you have checked those terms.

Two gaps are stated plainly, though. Protect is scoped to fraud-based chargebacks, not every dispute a customer can raise — an item-not-as-described claim is a different argument. And Shopify does not cover bank-initiated charge reversals.

If you sell outside the US, or your customers do not use Shop Pay, Protect is not your answer and you need a process instead.

For a high-risk order you have three moves: verify it, cancel it, or refund it.

Verification is worth the two minutes on anything with real margin. When the recommendation is to investigate, the desktop assessment can offer a Contact customer action, provided there is an email address on the order. It opens a dialog rather than sending anything automatically, so you write the message yourself. A buyer who wanted the parcel answers. A card tester does not.

What makes this worth doing is the second-order cost. Fulfilling high-risk orders can increase your chargebacks, and a chargeback rate that climbs far enough can get your payment processing disabled. The downside is not one lost parcel; it is the ability to take money at all.

This may not be your problem

One medium-risk order a month is not a fraud problem. If your recommendations come back mostly low, your chargeback rate is healthy and you are not selling the categories fraud rings target, you do not need any of this beyond knowing where the screen is. Spend the time on why the legitimate traffic is not converting instead.

Everything above happens after the money has moved. You can move the decision earlier.

Setting up manual payment capture lets you review orders before accepting payment, which turns a refund-and-argue problem into a simple decline. The trade-off is real: it adds a step to every order, authorizations do not last forever, and someone has to actually work the queue daily. For a store taking twenty orders a day it is sensible. At two thousand it needs automation behind it.

The other lever is the checkout itself — which payment and delivery methods appear, and for whom. Restricting a high-abuse payment method to domestic orders, or putting a cart-value threshold on a method you keep losing money on, stops the order being placed rather than catching it afterwards. That is configuration work rather than a setting you toggle; Shopify checkout customization experts do this routinely.

If your checkout is already behaving oddly before you add rules to it, fix that first — see Shopify checkout not working.

Pricing here comes from the shopexperts directory, pulled 19 October 2026, and the honest answer is that the dedicated fraud and chargeback bench is thin.

Chargeback specialists on shopexperts: 2. One of them publishes a Chargeback Management package and lists a profile starting price of $250. With only two listings there is no meaningful range to quote, so that is the figure rather than an average.

Widening to the category those specialists sit in, 67 experts across Finance, Taxes and Compliance publish a starting price. The median is $195, with the middle 50% between $82.50 and $950. A starting price is the smallest job an expert will quote, not what a typical project costs — do not budget from it.

For what work actually bills at, 894 client-reported project values across published reviews give a better shape: 64% land between $100 and $1,000, and 15% between $1,000 and $5,000. Fraud workflow setup sits at the lower end of that; a full chargeback representment program sits above it.

For ranges across every service type, see Shopify expert cost.

Bring in help when the problem has outgrown a daily review queue:

• Your chargeback rate is rising month on month, or your processor has already been in touch.
• You are losing real revenue to false declines because staff cancel anything flagged medium.
• You sell high-ticket, easily resold goods, and a single bad order costs more than a month of expert time.
• You need manual capture or checkout rules built properly rather than switched on and abandoned.
• Something you own still reads order risk through the deprecated REST resource.
• You are outside the US, so Shopify Protect does not apply and the entire process has to be yours.

A good specialist starts with your actual chargeback reasons and your decline rate, not with an app recommendation. If someone opens by selling you software before looking at your numbers, keep looking.

Not sure which kind of help you need? Read what kind of Shopify expert do I need. For gateway configuration, capture settings and fraud review, browse Shopify payment gateway experts.

If the underlying issue is that payments are failing rather than that orders are risky, start with Shopify payments not working.