Fraud control is a balance with a cost on both sides. Too loose and you pay chargebacks. Too tight and you decline real customers, which costs more and is invisible because nobody complains about an order they could not place.
What Shopify already does
Fraud Analysis on every order: a risk indicator with the signals behind it — billing and shipping mismatch, proxy use, card velocity, CVV result, previous chargebacks on the card.
It flags. By default it does not block. The order comes through and you decide.
Shopify Protect, on eligible Shop Pay orders through Shopify Payments, absorbs the chargeback on fraudulent orders it covers. Genuinely valuable and narrower than people assume — check what qualifies before treating it as blanket coverage.
3D Secure triggered by rules, which shifts liability for fraudulent transactions to the issuer where it applies.
The controls worth adding
Automatic cancellation on highest risk, above a value threshold. Not on everything — the indicator is a probability, not a verdict, and cancelling every medium-risk order will cost you more than the fraud does.
Manual review band. High-risk orders above a value you pick get looked at before fulfilment. A two-minute check on a four-hundred-pound order is worth doing.
Address verification on high-value orders. Mismatched billing and shipping is the single strongest signal in most categories.
Velocity limits. Several orders to one address on different cards in an hour is not a loyal customer.
Set the thresholds by order value, not by risk level alone. Blocking a thirty-pound order to avoid a thirty-pound chargeback is break-even at best once you count the legitimate orders the rule also kills.
Where fraud concentrates
| Pattern | Typical signal |
|---|---|
| Reshipping | High-value, express shipping, mismatched addresses |
| Card testing | Many small orders, rapid succession, varied cards |
| Account takeover | Changed shipping on an established account |
| Friendly fraud | Legitimate order, chargeback claimed as not received |
| Promo abuse | Multiple accounts, same device, first-order discounts |
Friendly fraud is the hardest and the most common in DTC. Delivery confirmation with signature on high-value orders is the main defence, because the dispute turns on evidence rather than argument.
Fighting a chargeback
You can win them, and the determinant is documentation. Order details, IP and device at purchase, delivery confirmation, any customer correspondence, your policies as they were shown at the time.
Shopify assembles much of this automatically for disputes on Shopify Payments. Add what it does not have.
The bar worth watching: keep the chargeback rate under 1% of transactions. Above that, processors start applying monitoring programmes and higher rates, and that cost exceeds the fraud.
The thing most stores get wrong
They tighten rules after a bad month and never loosen them. Review the decline and cancellation rate alongside the chargeback rate — if cancellations are climbing and chargebacks are already low, the rules are costing you more than they save.
Talk it through
Tell us your chargeback rate and your cancellation rate.
Those two together say whether the problem is fraud or over-blocking, and the fixes are opposite.
Get a readA real read within one business day — not a sales call.
About the author
Manpreet Singh
Founder of Proscube. Leads the studio's Shopify, headless and CRO engineering, and works directly with founders rather than through account managers.
More about Manpreet
