Alpenglow Software · Guides

Shopify flagged an order as high risk. What to do before you fulfill.

Updated October 11, 2026

What the flag means

For eligible online credit card orders, Shopify's fraud analysis rates the risk that the order ends in a chargeback because of fraud, and recommends an action:

Two things merchants often miss:

• Nothing happens automatically. A high risk order sits in your admin like any other order, and an automatic fulfillment or 3PL integration can ship it.
• The recommendation follows the overall assessment, not any single indicator. One failed check doesn't make an order fraud, and all checks passing doesn't make it safe.

Test orders, free orders, gift card purchases, point of sale orders, B2B orders and subscription renewals aren't analyzed.

How to read the indicators

Open the order and look at the fraud analysis section. The indicators you'll see include:

• Address verification (AVS): whether the billing address matches what the card issuer has on file.
• Card security code (CVV): whether the code entered was correct.
• Location: whether the buyer's location fits the payment method and addresses.
• IP address and network: where the order was placed from, and whether the device or network looks unusual.
• Payment attempts: several cards tried before one went through.

Read them together. A billing address mismatch plus a far-away IP plus several card attempts is a very different order from a returning customer whose IP location simply couldn't be found.

Step by step: deciding on a flagged order

1. Stop it from shipping. If you use automatic fulfillment or a 3PL, hold the order first so nothing ships while you look.
2. Read which checks failed and note them.
3. Look at the buyer's history. Earlier orders from the same email or address that were delivered without disputes are a good sign. A brand-new account placing a large first order to a different shipping address is not.
4. Contact the buyer on medium risk orders, and on high risk ones you'd like to save. Ask them to confirm the order details from their side, using the email on the order. A real customer usually answers quickly; a fraudster usually doesn't.
5. Decide. Fulfill if the answers fit. Cancel and refund if they don't, or if you get no answer and can't afford the loss.
6. Record the decision: what you checked, what the buyer said, and why you decided. Keep it with the order.

If it becomes a chargeback anyway

You usually have 7 to 21 days to respond. With Shopify Payments, your response is submitted on the due date even if you added nothing, and in the US there's a $15 chargeback fee. For a fraudulent (unauthorized) dispute, you win by showing the real cardholder placed the order. Shopify recommends:

• AVS and CVV results showing the billing address and security code matched.
• Device and IP data consistent with the customer's earlier orders.
• 3D Secure authentication, if the customer completed it.
• Earlier successful orders from the same customer, email or shipping address.
• Delivery confirmation to the customer's verified address.
• Messages where the customer acknowledged the order.

Most of this is easy to collect on the day you decide and hard to rebuild a month later. That's the real value of step 6.

Preventing repeats

• Manual payment capture lets you check an order before you take the money.
• Shopify Flow can hold high risk orders for review, or capture payment automatically for low risk ones.
• A consistent review routine matters more than any single rule: same checks, same order, same record, every time.

Where FraudPilot fits

We make FraudPilot, a Shopify app built around the routine above. It puts the orders Shopify flags as medium or high risk in one queue and shows why each was flagged. It also handles the decision itself: approve, cancel or tag in one click, each logged with a timestamp next to the buyer's history and your earlier decisions on them, and a CSV export of the log for chargeback responses. Tag adds a fraudpilot-review tag to the order in Shopify, so a Flow or 3PL rule can hold it; approve and cancel are recorded only, so you still cancel the order in Shopify yourself. FraudPilot doesn't block checkouts or cancel orders for you; you make every call. Read how FraudPilot works. Free and paid plans available. See the FraudPilot listing on the Shopify App Store for features and plans.

Common questions

Does Shopify cancel high risk orders automatically?

No. Shopify's fraud analysis flags the order and recommends an action, but it does not cancel the order for you. Until you act, a high risk order can be fulfilled like any other.

Should I fulfill a medium risk order?

Shopify's recommendation for medium risk is to confirm with the customer before fulfilling. Check which indicators failed, ask the buyer to confirm the order details, and fulfill only if the answers fit. If you can't absorb the loss of the goods plus a chargeback fee, don't ship until you're satisfied.

What evidence wins a fraudulent chargeback?

Evidence that the real cardholder placed the order: matching AVS and CVV results, device and IP data consistent with earlier orders, 3D Secure authentication, earlier successful orders from the same customer, delivery confirmation to the verified address, and messages where the customer acknowledged the order.

How long do I have to respond to a chargeback?

Usually 7 to 21 days. With Shopify Payments, your response is submitted on the due date even if you add no evidence, so add yours before then.

Which orders get a fraud analysis?

Online credit card orders that Shopify can verify. Test orders, free orders, gift card purchases, point of sale orders, B2B orders and subscription renewals are excluded.

Sources

• Shopify Help Center: Reviewing orders with fraud analysis
• Shopify Help Center: Protecting orders
• Shopify Help Center: Responding to chargebacks and inquiries

Questions: support@alpenglowsoftware.com