Every order on your Shopify store is flagged medium or high risk. Why, and what to do.

Updated October 14, 2026

Short answer: it is rarely a store setting. Shopify rates each order from the details of that order, using a model trained on transactions across all Shopify stores. If every order is flagged, the orders have something in common. Put them side by side and compare the same lines in each fraud analysis: what they share tells you whether it is your payment setup, where your buyers are, or actual fraud. Don't ship the flagged ones until you know.

How Shopify decides the risk level

Shopify's fraud recommendations are powered by machine learning trained on historical transactions across all Shopify stores. The fraud analysis on an order also lists indicators, such as whether the card passed the address (AVS) check, whether the security code (CVV) was correct, whether the buyer's location matches the payment method, whether the device or network looks unusual, and whether more than one card was tried.

Two points matter here:

The level is not a count of failed checks. Shopify says individual indicators, and how many there are, don't determine the overall risk.
Shopify's documentation doesn't list the age of your store as a factor. A new store isn't flagged for being new. It is flagged because of the orders it is getting.

Check that you're reading a risk level at all

The low, medium or high recommendation is available to stores that use Shopify Payments, or that are on the Grow plan or higher. Fraud indicators are available on the Basic plan or higher. If you are on Basic with another payment provider, you may see indicators with no overall level. With a third-party provider, Shopify also says to check with the provider about fraud analysis limitations.

Compare the orders side by side

Open the fraud analysis on each flagged order and write down the same lines for each. Then look for what repeats.

What the orders share	What it points to	What to do
The address (AVS) or security code (CVV) check didn't pass, or shows as unavailable, on every order	The card checks aren't confirming the buyer. That can be the cards, or what your payment provider checks and reports.	Ask your payment provider whether AVS and CVV checks are switched on and reported back. See the next section.
The buyer's IP is far from the addresses, the billing and shipping countries differ, or the connection is a proxy	A location mismatch. Common with real gift orders and travelers, and common with fraud.	Contact the buyer before shipping. Shopify suggests calling the phone number on the order.
Several cards tried on one order, or many small orders close together with similar details	Card testing: a script trying stolen cards on your checkout.	Don't ship. See our card testing guide.
Different names and billing addresses, one shipping address	Shopify says this can be a sign of fraudulent orders.	Review each one and contact the buyers before shipping.
Nothing in common, and each order fails in its own way	The simplest reading is that the label is right about each of them.	Follow Shopify's recommendation on each order.

If the card checks never pass

This is the cause most often mistaken for a store setting.

Not every bank supports the checks. Shopify notes that not all banks support AVS and CVV checks. Stripe's documentation says address verification is commonly supported for cards issued in the United States, Canada and the United Kingdom, and that an "unavailable" result means the card issuer won't check the data provided. If your buyers pay with cards from elsewhere, the address check may be unavailable on most of your orders.
Your payment provider decides what is checked and reported. If you use a third-party provider, ask them two things: are AVS and CVV checks turned on, and are the results passed back to Shopify?
With Shopify Payments, the settings are in Settings > Payments > Shopify Payments > Manage, in the Fraud prevention section. Declining on AVS is off by default, and Shopify warns that turning it on may increase failed transactions.

An unavailable check is missing evidence, not a failed one. It doesn't make the order fraud, but it does mean you have less to go on, and less to show the bank if the order is disputed later.

What to do with the orders you already have

Don't fulfill a flagged order until you know why it was flagged. Shopify's recommendation for medium risk is to confirm with the customer first, and for high risk to consider canceling.
Switch to manual payment capture while you work it out: Settings > Payments > Payment capture method > Manually. Orders are authorized but not charged until you capture them.
Contact the buyer. Call the phone number on the order and ask a simple question about what they bought. A number that doesn't work is a bad sign. A good answer isn't proof, but no answer is a reason to cancel.
If you dropship, decide before you pay your supplier. If the cardholder disputes the charge later, you lose the product cost, the sale and a chargeback fee.
For orders you already shipped, keep the tracking, the delivery confirmation and any messages with the buyer. That is your evidence if a chargeback arrives.

For the full routine on a single flagged order, see what to do with a Shopify high risk order.

Where FraudPilot fits

We make FraudPilot, a Shopify app for reviewing the orders Shopify flags as risky. It lists the orders Shopify flags as medium or high risk in one queue with the reasons each was flagged, which makes the side-by-side comparison above quicker, and it lets you look up the risk details of any order from the last 60 days. It can also show the AVS and CVV results and payment details on each order, with one-click decisions and a log of them you can export. FraudPilot shows you what Shopify reported; it doesn't change how Shopify rates your orders, block checkouts or cancel orders for you. Read how FraudPilot works. Free and paid plans available. See the FraudPilot listing on the Shopify App Store for features and plans.

Common questions

Does Shopify flag more orders on a new store?

Shopify's documentation doesn't list store age as a factor. Its fraud recommendations come from machine learning trained on transactions across all Shopify stores, applied to the details of each order. If every order on a new store is flagged, look at what the orders have in common.

Why does the fraud analysis say AVS or CVV is unavailable?

Because the check wasn't performed or reported for that card. Not all banks support AVS and CVV checks, address verification is commonly supported for cards issued in the United States, Canada and the United Kingdom, and a third-party payment provider may not pass the results to Shopify. Unavailable means missing evidence, not a failed check.

Why don't I see a low, medium or high risk level on my orders?

Fraud recommendations are available to stores using Shopify Payments or on the Grow plan or higher. On the Basic plan with another payment provider you can see fraud indicators without an overall level.

Is something wrong with my store settings if every order is medium risk?

Usually not. The level comes from each order's details. The one setup issue worth checking is your payment provider: whether address and security code checks are switched on and reported back to Shopify.

Should I ship orders that are all flagged medium risk?

Not until you know why. Shopify's recommendation for medium risk is to confirm with the customer before fulfilling. Compare the orders, contact the buyers, and use manual payment capture so you can cancel without charging the card.

Sources

Questions: support@alpenglowsoftware.com