Shopify Fraud Prevention Before an Order Leaves Your Store

By Milan Dhameliya · · 8 min read

Connect Shopify fraud analysis, payment capture, and fulfillment holds into a tested review process—including split shipments and orders without recommendations.

Shopify fraud prevention works best when you review order risk before releasing goods, use payment capture settings that support that review, and give unresolved orders a named owner. Shopify supplies risk analysis and automation tools; your store still needs a tested procedure connecting the payment decision to every shipment.

This guide is for the person responsible for orders leaving the building: an owner, ecommerce manager, or operations lead. The practical goal is a review process your team can run on a busy morning, including when an order has multiple shipments or no usable risk recommendation.

Start with the decision your team must make

For each order, record three separate answers: may we collect payment, may we release the goods, and who handles the exception? I would put those questions above any list of fraud apps. Buying another signal is useful only when someone knows what action that signal should change.

Open Orders > select the order > Order risk, then open Order risk evaluation or About this order, depending on the view. Review the recommendation alongside the indicators. Shopify's fraud-analysis documentation distinguishes individual signals from the overall assessment: counting warning icons is not a substitute for the recommendation.

Write a short store policy before configuring automation. A reasonable starting proposal is to process low-risk orders through normal checks, send medium-risk orders to a reviewer, and prevent high-risk orders from entering dispatch until a decision is recorded. This is an operating recommendation, not a guarantee that any risk category is safe.

Give the reviewer a backup and a deadline that fits your dispatch schedule. “Someone checks suspicious orders” is too vague for an afternoon when the owner is unavailable. Record the decision and its reason so the next shift can tell an unresolved order from an approved exception.

Know which orders your rule can actually assess

Shopify provides indicators on Basic and above; recommendations require Grow or above, or Shopify Payments. Its analysis applies to online credit card orders it can verify. Some orders, including POS, B2B, subscription renewals, free orders, and orders fully paid by gift card, don't receive a recommendation. Check your third-party gateway's limitations too.

These eligibility limits make an exception queue essential. My recommendation is to label orders awaiting an assessment separately from orders that aren't eligible for one. Neither should silently inherit your low-risk approval rule.

At the start of each dispatch shift, have the reviewer reconcile orders awaiting a decision against the payment and fulfillment queues. For each exception, record the order reference, assessment source, payment status, authorization deadline when applicable, affected shipments, owner, and next action. Review orders without recommendations independently of the risk-triggered Flow; do not assume that workflow has handled them. This is the manual control I would retain until the store has demonstrated complete coverage.

Before implementation, list the order types your business actually receives. Include subscriptions, wholesale, pickup, and alternative payment methods if relevant. Beside each, write which system supplies the assessment and which person owns the decision. Skip categories you do not sell; this should be a working document, not a theoretical catalog.

Choose whether review happens before payment capture

Manual capture can give your team time to review a supported payment before collecting it. In Settings > Payments > Payment capture method, choose Manually and save. Shopify Payments users can enable the warning email before authorization expires. Shopify's authorization and capture reference explains the settings and limitations.

Authorizations expire: Shopify Payments normally provides seven days, with eligible Plus extensions subject to their own conditions. Some additional providers capture automatically even when the store uses manual capture. Record the actual payment method and authorization deadline in the review queue rather than assuming every order behaves identically.

Do not switch to manual capture if nobody will monitor authorized orders. First assign the owner, document the approval step, and test the process. Stores with little review capacity may prefer keeping automatic capture while strengthening fulfillment review; that choice trades earlier collection for a simpler payment workflow.

Also inspect any app that already captures payments. Shopify warns that overlapping automatic capture mechanisms can conflict. Decide which mechanism owns the action before enabling another one. Ask your implementer to show that ownership in the configuration and in a completed test order.

Build the Flow around a completed assessment

Shopify's Order risk analyzed trigger runs after Shopify's assessment finishes. It does not run immediately at order creation, and it does not represent completion of a third-party provider's assessment. If your decision depends on that provider, verify its supported integration instead.

For Shopify's capture template, go to Apps > Flow > Create workflow > Browse templates > Risk, then install Capture payment if order is not high fraud risk. The setup instructions require manual capture for this workflow to function.

Read its conditions before activation: the template captures low- and medium-risk orders. If your written policy requires a person to review medium-risk orders, have the workflow edited to match. Add an internal notification and an identifiable review tag on the exception branch, then check the recipient address.

I would initially keep cancellation as a deliberate reviewer action. Shopify also offers an automatic cancel-and-restock template, but that is a different business decision from creating a review queue. Do not install both simply because they appear beside each other.

Ask for a plain-language walkthrough of each branch: what triggers it, what it changes, what it leaves waiting, and who gets notified. If the implementer cannot explain where an unresolved order goes, the workflow is not ready to activate.

Make the warehouse wait for the right decision

A review tag helps people find an order. Use an actual fulfillment hold when the requirement is to prevent fulfillment. Shopify's Hold fulfillment order action supports a reason, notes, and a merchant notification.

The action's scope matters. With an order-level trigger such as Order risk analyzed, it can hold the fulfillment orders for the order's locations. With a trigger that supplies one fulfillment order, it holds that fulfillment order. Ask the implementer to identify the scope instead of accepting “the order gets held” as a complete explanation.

For a manual hold, open the order and use the menu in the relevant Unfulfilled or In progress section, then choose Mark as on hold, select the items and reason, and confirm. Shopify's fulfillment-hold guide also explains how to release a specific hold.

Test a two-location order with one shipment held: the order-level status can still say Unfulfilled, so the acceptance evidence must show both shipment cards and what the warehouse received. This follows Shopify's documented mixed-fulfillment behavior. It is why checking a tag or one status badge is an incomplete test.

For a third-party warehouse, agree when orders enter its picking queue and what prevents release while review is pending. Demonstrate the behavior in its system. Do not assume a later Shopify hold retracts work already sent elsewhere; require the provider to verify that sequence.

On approval, release the review hold deliberately. Multiple holds can coexist, so do not clear an unrelated inventory or service hold just because the fraud review passed. The reviewer should record the reason for approval and the fulfillment team should see the intended result.

Keep risk review separate from chargeback protection

Shopify Protect covers eligible fraudulent and unrecognized chargebacks; it is not a promise attached to every low-risk order. Its standard eligibility requires a US business with a US Shopify Payments account, with further order and fulfillment conditions. Merchants elsewhere should not build their procedure around presumed access.

The protection requirements include valid tracking and fulfillment within seven days, transit within ten days, and supported carriers. Changing the shipping address after checkout voids coverage. Check the order's protection status and all applicable conditions rather than inferring coverage from a payment badge.

Our Shopify chargeback protection guide goes deeper into fulfillment requirements. For this procedure, keep protection eligibility as a separate field beside the risk decision. A request to change an address deserves a new review of both.

Prove the process before the next busy dispatch window

Use controlled test orders before relying on the automation. Shopify documents simulated risk values such as shopify.test.high, shopify.test.medium, and shopify.test.low in the shipping address's apartment field. Follow its test requirements, including a positive order value and the required test gateway setup.

Coordinate testing so no warehouse ships a test parcel. Our Shopify Payments test-mode guide covers the return to live payments. Record the starting settings and include that restoration in the person responsible's checklist.

I would ask for these acceptance results, using your own policy as the expected outcome:

Keep order references and results with the workflow handover. Retest affected branches after changing a payment provider, fulfillment integration, or risk app. A screenshot of a successful Flow run does not show that the right person was alerted or that a parcel stayed out of picking.

Know when this workflow needs more help

Repeated small payment attempts can indicate card testing. Shopify's fraud-prevention guidance notes that attempts classified as suspected card testing or bot activity are excluded from abandoned checkouts. An order-review queue therefore cannot be your only view of that activity.

Use the available payment-provider controls and investigate suspicious completed orders before dispatch. Manual capture reduces some exposure, but Shopify explicitly warns that canceling or voiding an order does not guarantee that a cardholder's bank cannot file a chargeback. Avoid any workflow or app proposal promising complete prevention.

If your team can review orders reliably, start with the native tools and a clear handover. Consider additional tooling when you can name the missing capability and test its effect. If the difficult part is coordinating Flow, payment capture, and your warehouse, our Shopify implementation services can help build and verify that operating procedure.