High-risk order alerts: what to do in the first ten minutes

The flag is information, not a verdict

Shopify's fraud analysis reviews each order against a set of signals and labels the result as low, medium or high risk. A high-risk label means several signals lined up in a pattern that often indicates fraud.

It does not mean the order is fraudulent. It means the order resembles ones that were. Plenty of entirely legitimate customers trip the flags: someone buying a gift for a different address, an expat using a foreign card, a shopper on a corporate VPN, a customer who mistyped their postcode twice and then got it right.

So the job in the first ten minutes is not to decide guilt. It is to stop the clock, gather two or three cheap pieces of evidence, and route the order to one of three outcomes.

Minute one: hold the fulfilment

Before any investigation, make sure the order is not about to ship.

This is the only genuinely time-sensitive step, and it is the one that gets skipped because investigating feels more useful. A flagged order that ships during your investigation converts a recoverable situation into a chargeback plus lost stock. If your fulfilment runs on a schedule or a third party picks up at a fixed time, the window can be shorter than you think.

Holding is reversible and costs nothing. Do it first, every time, and make it something anyone on shift is allowed to do without asking. If holding requires permission, it will not happen fast enough, which is exactly the kind of threshold worth writing into your decision rights.

Minutes two to six: read the actual signals

Open the fraud analysis and look at which indicators fired rather than the overall label. The label aggregates; the indicators tell you what to do.

Broadly, they fall into three groups.

Payment signals

Whether the billing address matched the card, whether the security code was correct, whether multiple cards were tried. These are the ones worth weighting most heavily. A failed address check plus multiple card attempts is a substantively different situation from a single mismatch.

Location signals

Distance between billing and shipping address, the IP address location, whether an anonymous proxy or VPN was used. These produce the most false positives by a wide margin. Gift purchases, travel, corporate networks and privacy-conscious customers all trip them, and none of that is fraud.

Behaviour signals

Order velocity, multiple failed attempts, a brand-new account placing an unusually large first order. Individually weak, collectively meaningful.

The pattern that should actually worry you is signals from more than one group at once. Location signals alone are usually a customer with an unusual life. Payment signals plus behaviour signals is a different conversation.

Minutes six to nine: three cheap checks

None of these take long and they resolve most cases.

1. Does the customer have history? A returning customer with delivered orders and no chargebacks is the strongest exonerating evidence available. Check before anything else.
2. Does the order look like a person or like a script? Fraudulent orders skew toward high-resale items, maximum quantities, and the fastest shipping regardless of cost. A basket that looks considered, with mixed items and standard delivery, reads differently from three of your most resellable product at express rates.
3. Does the address resolve? A quick check that the shipping address is a real, findable place. Freight forwarders and mail-drop addresses are not automatically fraud but they change the risk, and they are worth recognising.

Minute ten: pick one of three

Every flagged order should land in one of these. Sitting in a fourth state, undecided, is the outcome that costs the most.

Fulfil. Signals are location-only, or the customer has good history. Release the hold and move on. Most flagged orders end here, and treating every flag as suspicious costs you real revenue and real customers.

Verify. Genuinely ambiguous. Contact the customer with a light-touch message. The wording matters and is covered below.

Cancel and refund. Multiple signal groups, no history, and a basket that reads as resale. Cancel and refund promptly rather than sitting on the money, and keep the reasoning short and factual in your notes.

How to word the verification message

This is where stores do avoidable damage. A message that implies the customer is a suspect will lose a good customer permanently even when you release the order.

Do not mention fraud, risk or verification checks. Frame it as protecting them, keep it short, and ask for something a real customer can supply in seconds.

Something in this register works: a brief note saying you are confirming details on the order before it ships, that you want to make sure it reaches them, and asking them to confirm the delivery address and the name on the card. No explanation of why, no mention of flags.

A legitimate customer replies within a day, usually cheerfully. Someone using stolen details typically does not reply at all, and the silence is your answer. That is the real function of the message: the non-response is more informative than the response.

Set an internal deadline. If no reply in a defined window, cancel and refund. Orders left pending indefinitely are how a queue of undecided flags accumulates.

The most expensive mistake is not shipping a fraudulent order. It is treating a hundred good customers like suspects to avoid one.

The false positive you should expect more of

Worth flagging as an emerging pattern rather than a settled fact: automated shopping agents that place orders on a customer's behalf now produce a signal fingerprint that closely resembles fraud. A brand-new account, a data-centre IP address, and an order completed in seconds is precisely the profile these systems were built to catch.

If you start seeing high-risk flags on orders that otherwise look entirely ordinary, and the customer responds normally to verification, this is a plausible cause. Weight customer history more heavily and location signals less.

Who should handle it

Speed matters more than seniority here, because the window closes. Holding an order should be available to anyone on shift, no permission required, and the same applies to cancelling a clearly fraudulent one, since nobody has ever regretted not shipping to a stolen card.

The decision that genuinely needs judgement is fulfilling a flagged order against the signals, and that is the one worth a threshold. Above a certain value, escalate. Below it, let the person on shift decide with the procedure above.

Whatever you choose, it needs to be visible where the flag arrives. An alert that reaches somebody who is not allowed to act on it just adds a hop.

Write down why

Whatever you decide, put one line in the order notes explaining it. "Cancelled: address check failed, three cards tried, no history." Or "Fulfilled: location flags only, customer has four delivered orders."

Two reasons, and the second is the one people underrate.

First, if it goes wrong you can see what you knew at the time rather than reconstructing it. A chargeback arriving six weeks later is much easier to handle with a note than with a memory.

Second, the notes accumulate into calibration data. After a few months you can read back through the cancellations and ask whether the reasoning still looks sound. Most stores discover they were cancelling on thinner evidence than they thought, and the notes are the only way that becomes visible.

Patterns worth noticing across orders

Individual flagged orders are the immediate job. The pattern across them tells you something the per-order view cannot.

If flags cluster on one product, that product has resale value someone has noticed, and it is worth tightening how you handle it specifically rather than raising caution across the whole catalogue.

If flags cluster on one shipping region, decide deliberately whether you serve it. An explicit decision beats cancelling case by case while feeling uneasy about it.

And if your flag rate rises suddenly with no change in what you sell, look at what changed on your side. A new ad campaign reaching a different audience, a change in checkout, or a promotion attracting bulk buyers will all move the rate without any fraud being involved.

Deciding your own tolerance in advance

The procedure above tells you how to read an order. It does not tell you how cautious to be, and that is a business decision rather than a fraud-analysis one.

Work it out from your own numbers rather than from instinct. Take your average order value, your margin, and what a chargeback actually costs you once you include the fee and the lost stock. That gives you the cost of being wrong in one direction.

Then estimate the other direction: the lifetime value of a customer you wrongly cancel on, and the fact that they will not tell you, they will simply not return.

For most small stores with ordinary margins and ordinary products, the arithmetic favours shipping in genuinely ambiguous cases. For a store selling high-value, easily resold goods, it does not. Neither answer is universally right, which is exactly why it should be decided once, deliberately, rather than re-derived under pressure by whoever happens to be on shift.

Common questions