Shopify high risk orders: what to check before you ship on Black Friday

Shopify high risk orders are orders that Shopify's fraud analysis thinks could end in a fraud chargeback. The flag is a recommendation, not a verdict. Shopify rates each eligible order low, medium or high risk, On high risk orders you choose whether to verify, cancel or refund before anything ships, and medium risk orders are worth a closer look.

Black Friday and Cyber Monday make that choice harder. Order volume jumps, more people buy gifts that ship to someone else, and your team has less time per order. This guide gives you a short routine for reviewing flagged orders with Shopify's own tools, so good orders ship on time and bad ones stop before the stock leaves.

What the high risk flag means, and what it doesn't

Shopify's fraud analysis has two parts:

• Fraud indicators: individual details about the order, such as Address Verification System (AVS) results, whether the card security code (CVV) was correct, whether the customer's location matches the payment method, unusual device or network activity, and multiple credit card attempts.
• The fraud recommendation: an overall rating of low, medium or high risk of a fraud-related chargeback. Medium and high risk orders show a warning symbol on the Orders page.

Shopify's advice is to use the recommendation rather than counting indicators, because the indicators on their own don't show overall risk.

Check availability before the sale. Shopify says fraud indicators are available on the Basic plan or higher, and recommendations need the Grow plan or higher, or Shopify Payments. Recommendations also only apply to online credit card orders Shopify can verify, so you won't see one on test orders, free orders, orders paid fully by gift card, POS orders, B2B orders or subscription renewals.

Where to find the risk details on an order

In your Shopify admin, go to Orders and open the order. Find the Order risk section and open the full evaluation. In the Shopify app, the same Order risk section is on the order page.

The evaluation suggests a next step, such as fulfilling the order, confirming with the customer before fulfilling, or considering canceling. If it says the analysis isn't available yet, check back in a few minutes. Shopify recommends waiting for fraud analysis to finish before you fulfill, which matters during a sale when fast fulfillment is tempting.

If you use Shopify Payments, some high risk checkouts are blocked before an order is ever created. You can see those under Orders > Abandoned checkouts, in the Blocked view. If a real customer tells you their payment failed, look there first.

A five-minute check for a flagged order

Shopify's fraud prevention guidance lists manual checks you can run on any medium or high risk order. Work through them in order:

1. IP address. Compare the IP location in the risk section with the customer's area. A location far from the customer, a web hosting company or a proxy IP is worth a closer look.
2. Billing and shipping addresses. Map both. A very large distance, such as different continents, is a red flag.
3. Shared shipping address. Search your orders for the same shipping address. Several orders with different billing names and states that ship to one address can point to fraud.
4. Email address. Search it online to see whether it appears in fraud reports or belongs to a real person.
5. Phone number. Call it. Shopify notes that fraudulent customers often use invalid numbers. Ask a simple question about the order and note whether the person can answer.

Shopify points out that a legitimate gift purchase can have different billing and shipping addresses, so a mismatch alone doesn't prove fraud. In November and December, look for a mismatch combined with other signals, not a mismatch by itself.

Decide: fulfill, verify or cancel

Once you have the evidence, pick one of three paths:

• Fulfill when the recommendation and your checks agree the order looks normal.
• Verify when the signals are mixed. Contact the customer using the details from checkout. On desktop, the Order risk evaluation can show a Contact customer option when the order has an email address. It opens an email for you to write and doesn't send anything automatically.
• Cancel when the order still looks wrong. Shopify recommends canceling high risk orders before you fulfill them, and refunding if needed.

When you cancel, the default refunds the full amount to the original payment method and restocks the items. Cancel flagged orders one at a time rather than in bulk, because Shopify warns the refund prompt might not appear, and then every selected order is refunded immediately, even ones already refunded. Also know that canceling doesn't stop the cardholder's bank from filing a chargeback, and card transaction fees aren't returned when you refund.

Hold payment while you review with manual capture

If you expect a lot of flagged orders, you can authorize payment at checkout and capture it later. Go to Settings > Payments, find Payment capture method, choose Manually and save. Shopify's payment authorization guide explains that this lets you review the fraud analysis before you capture the payment or cancel the order.

The trade-off is time. With Shopify Payments, the authorization period is 7 days. If you don't capture within that time, you can't collect the payment. On Shopify Plus, some cards allow longer authorizations, and capturing after the standard 7 days adds a 1.75% charge on top of standard card fees. Shopify Payments stores can turn on a warning email 1 day before an authorization expires. Manual capture applies to every online store order, so plan who captures the low risk ones each day.

Automate the easy cases with Shopify Flow

Shopify Flow is a free Shopify app for stores on the Basic plan or higher. Its fraud prevention templates include:

• Capture payment if order is not high fraud risk: captures low and medium risk orders, skips high risk ones, and you can add a tag or internal email for the ones it skips.
• Cancel and restock high-risk orders: cancels high risk orders, restocks the items, tags the order and customer, and sends an internal email.

Two settings decide whether these work. Use the Order risk analyzed trigger, not Order created, because fraud analysis takes time to finish. And set payment capture to manual, because Shopify warns that capture workflows don't work with automatic capture on.

Shopify Protect and chargebacks

Shopify Protect is free chargeback protection for eligible Shop Pay orders. If an eligible, protected order gets a fraudulent chargeback, Shopify reimburses the chargeback amount and fee and handles the process.

The rules are strict, and holiday rushes break them:

• Your store must be in the United States with a US Shopify Payments account.
• The order must be paid with Shop Pay, not Shop Pay Installments.
• Every item must be physical and shipped. Orders with digital products or local pickup items aren't protected.
• The order must be fulfilled with valid tracking from a supported carrier within 7 days, and be in transit within 10 days.
• Changing the shipping address after checkout voids coverage.

If an order isn't protected and a chargeback arrives, Shopify alerts you with a deadline to respond. Answer with the evidence you collected during your review: matching addresses, your notes from contacting the customer and delivery confirmation.

A worked example

Say you sell leather wallets and it is the Saturday after Black Friday. This is a hypothetical example with made-up details.

Before: Your team ships everything in order of arrival. A $480 order for four wallets is flagged high risk. It ships to an overseas address that two other orders this week used with different billing names, and weeks later the real cardholder disputes the charge.

After: Payment capture is set to manual. A Flow workflow captures low and medium risk orders and tags high risk ones "review". Each morning one person opens the tagged orders, runs the five checks, and finds the shared shipping address. They cancel the order individually, refund it to the original payment method and restock the wallets. A separate high risk order with a gift message, a billing address in Texas and a shipping address in Oregon passes the phone check, so they capture the payment and it ships the same day.

Where Atomato fits

Fraud review happens in your admin, but some chargebacks start with a confused or worried customer rather than a thief. Shopify's chargeback prevention advice includes telling customers about your store's policies and keeping them updated on shipping. A NotiFeed message on your store, opened from the bell on your store, can carry your holiday shipping cutoff or a link to your return policy, so shoppers can find it before they buy. NotiFeed is on every plan, including one active campaign with one message on the free Starter plan. It shows on your Online Store theme pages, not on Shopify checkout. Our post on holiday shipping cutoff messages has examples.

What this won't fix

This routine won't stop every chargeback. Banks decide chargeback outcomes, and disputes about products not arriving or not matching the description need clear product pages, tracking and a return policy shoppers can find. Our return policy guide covers that side.

High risk order checklist

• Know which plan and payment provider you use, and whether you get fraud recommendations.
• Decide if payment capture should be manual during the sale, and who captures each day.
• Set up Flow with the Order risk analyzed trigger.
• Run the five checks on every medium and high risk order.
• Fulfill Shop Pay orders with tracking within 7 days if you rely on Shopify Protect.
• Check the Blocked view when a customer says a payment failed.

Common questions

Should I cancel all high risk orders on Shopify?

Not automatically. Shopify says you can verify, cancel or refund a high risk order. Check the details, contact the customer if signals are mixed, and cancel the orders that still look wrong.

Can I test how high risk orders look?

Yes. Shopify supports test orders with special test emails or apartment field values that produce low, medium or high risk results on an order with a total above zero, with Shopify Payments in test mode or on the Grow plan or higher with another gateway.

How long does Shopify fraud analysis take?

Shopify doesn't give a fixed time. If the order says fraud analysis isn't available yet, Shopify suggests refreshing or checking back in a few minutes, and waiting for it to finish before you fulfill.

Next step

Before your sale starts, place one test order of each risk level, decide whether to switch to manual capture, and set up the Flow capture template. Then, while the sale runs, keep Live View and your reports open next to your flagged orders queue.

Install Atomato free on Shopify