Shopify Fraud Analysis: Read the Recommendation, Not One Red Flag

Shopify fraud analysis is the Order risk section on an order. Before you fulfill, read the recommendation: low, medium, or high risk of a chargeback due to fraud, and the next-step line under it. A red indicator is a clue for the investigation. It is not the decision.

This page is for someone fulfilling orders on their own Shopify store. It covers Shopify’s own analysis, not a roundup of fraud apps. Labels and paths below are from Shopify Help, checked October 14, 2026.

Shopify fraud analysis in one paragraph (per Shopify Help, checked 2026-10-14): Fraud analysis is fraud indicators plus, on eligible orders, a fraud recommendation of low, medium, or high risk of a chargeback due to fraud. Indicators are individual details: whether the card passes AVS, whether the CVV was correct, whether the customer’s location matches the payment method, unusual device or network activity, or an attempt to use more than one card. Individual indicators, and group headings such as High risk signals, do not set the order’s overall risk. Neither does the number of red icons. The next-step line follows the recommendation. Help’s examples are “You can fulfill this order,” “Confirm with the customer before fulfilling,” and “Consider canceling this order.” Recommendations are available on the Grow plan or higher, or if you use Shopify Payments. Indicators, and support for third-party fraud apps, are available on the Basic plan or higher. Some orders never receive a recommendation.

Hold the shipment until you have read the recommendation. A red indicator is not that recommendation.

What to read on the order

Shopify’s fraud analysis page splits the screen into clues and a decision:

What you see	What it is	What to do with it
Recommendation	Low, medium, or high risk of a chargeback due to fraud, on eligible orders	This is the risk level
Next-step line	Guidance that follows the recommendation, not an indicator	Read it with the risk level
Indicator	One check: address, card, device, or network	Investigate. Do not fulfill from one icon, or from a count of icons
IP address or location text	Listed apart from the indicators in the revised view	Not a recommendation by itself
Shopify Protect status	Shown when the order has protection information	Read it separately from the indicators

The line worth keeping: review the fraud recommendation instead of deciding whether to fulfill from one indicator or from the number of indicators.

On desktop:

From the Shopify admin, go to Orders.
Open the order.
In Order risk, click the icon labeled Order risk evaluation or About this order. The label depends on the view.
Read the risk level and the recommended next step, then the indicators.
If another provider has an assessment, open that tab. Act on the result you actually opened.

Medium and high recommendations are flagged on the Orders page with a warning symbol next to the order number. Those orders are also highlighted in order notification emails when you subscribe to them. Suspicious orders carry an exclamation mark in the Order risk section. Open the order and read the recommendation. The symbol is not a risk level of its own.

The icons change with the screen. The revised desktop view lists indicators in a shaded panel: details associated with fraudulent behavior, details associated with legitimate behavior, and neutral details. Orders without the newer indicators can still show the older address and payment checks. Other views, including mobile, may group lines under High risk signals, Low risk signals, and Other details, or use red, green, and gray icons. Empty groups are dropped. When every indicator sits in one group, the heading can be dropped too, so the words “High risk signals” may not be on the screen at all. A panel of red icons is still not the recommendation.

When the recommendation is to investigate, desktop can offer Contact customer. It needs an email on the order. It opens a dialog and does not send the message for you.

Help says the recommendations come from machine-learning algorithms trained on historical transactions across all Shopify stores, and that those algorithms keep getting updated. That is the source of the score. It is not a promise about the order you are looking at.

Orders that never get a recommendation

Fraud analysis works with online credit card orders that Shopify can verify. The same Help page lists orders that do not receive a fraud recommendation:

Test orders. You can still simulate one. The steps are below.
Free orders.
Orders paid in full with a gift card.
Point of Sale orders.
B2B orders.
Subscription renewal orders.

A missing recommendation on that list is not a low-risk result with the label left off. There is no recommendation to follow. For in-person sales, Help sends you to POS fraud prevention instead of this screen.

Plan access on that page:

Fraud indicators, and support for third-party fraud prevention apps, are on the Basic plan or higher.
Fraud recommendations are on the Grow plan or higher, or if you use Shopify Payments.

A Basic store without Shopify Payments can open indicators and still have no recommendation. If the recommendation line is missing, the icons do not fill in for it.

If you use a third-party payment processor, check with them about what their fraud analysis does not cover. When that gateway is reviewing an order, the status may never update in Shopify admin, because some gateways do not send the review back. Use the gateway’s own dashboard.

Apps can show their own indicators and recommendations beside Shopify’s. This page does not compare those apps. If an order has more than one assessment, use the provider tab for the result you mean to act on. Flow’s Order risk analyzed trigger, below, runs only on Shopify’s assessment.

High risk, and what Shopify Payments will do about it

Help’s reason to pause is chargebacks. Fulfilling high-risk orders can result in a higher number of chargebacks, which can result in disabling payment processing and removal from Shopify Payments. The bank that issued the card decides whether to reverse the funds. You can gather evidence for a dispute. Shopify does not cover charge reversals from banks.

On a high-risk recommendation, Help says you can attempt to verify the order, cancel it, or refund it.

Shopify Payments can also block some high-risk checkout attempts before an order exists. A blocked attempt is not an order, so there is no fraud recommendation on it. Those attempts sit in the Blocked view of Orders > Abandoned checkouts. If the timeline says Blocked due to high risk of fraud, no payment was captured. Shopify Payments evaluates risk again if the customer submits different payment or billing details, and a later try might go through.

If you know the customer and still want the sale, create a draft order and send an invoice. The invoice collects payment for this sale. It does not invent a recommendation the blocked checkout never received.

Read the order, then capture

Credit card payments are captured at checkout unless you change that. Payment authorization names a reason to switch to manual capture: reviewing the fraud analysis before you capture the transaction or cancel the order.

Go to Settings > Payments.
Under Payment capture method, select Manually.
Optional, and only with Shopify Payments: turn on the email that warns you one day before an authorization expires. Help says that without Shopify Payments you do not get those emails.
Click Save.

That setting covers online-store orders. POS orders are left alone.

Manual capture does not stretch the authorization. Capture a credit card payment inside the authorization period or you may not collect. Shopify Payments authorizes card payments for 7 days. Shopify Plus stores can get a longer window on some cards. On Plus, capturing after the standard 7 days adds a 1.75% charge on top of the usual card fees. If you do not want that fee, cancel the order and create a new one. The expiry date shows on the Orders page.

A middle setting, Automatically when the entire order is fulfilled, only authorizes at checkout. Capture happens when the whole order is fulfilled, still inside the authorization period. A partial fulfillment does not capture. On this setting, shipping the whole high-risk order is what takes the payment. Manual capture is the setting that lets the recommendation land before the charge.

If you automate this, wait for the analysis

Shopify Flow can tag an order, email your staff, capture payment, or cancel from the recommendation. The trigger to use is Order risk analyzed, not Order created.

Fraud analysis takes some time after the order is created. A workflow on Order created can run while the recommendation is still missing. Order risk analyzed starts when Shopify’s analysis is done, and only for Shopify’s assessment, not a third-party app’s.

Capturing from that workflow requires manual capture. Help says those workflows do not function when automatic capture is on. The template Capture payment if order is not high fraud risk checks that the level is not high and that the payment can be captured, then captures it. Low and medium both pass. The template Cancel and restock high risk orders cancels, restocks, tags the order and the customer, and sends an email. Install either from Apps > Flow > Create workflow > Browse templates > Risk. Sidekick can draft a workflow on Order risk analyzed. That draft waits for you to review it and turn it on.

A banner in the admin can offer Install Flow and switch on a workflow that captures low-risk and medium-risk orders. Open the workflow before you trust the banner. “Not high” still captures medium.

The decision in this section is the trigger. The rest of a Flow setup is a different job.

Simulate low, medium, and high

Test orders do not get a real recommendation. You can simulate one when the total is greater than zero. Use Shopify Payments in test mode, or use another gateway only if the store is on the Grow plan or higher.

Checkout email:

Or the shipping field Apartment, suite, etc.: shopify.test.high, shopify.test.medium, or shopify.test.low.

Place one order at each level and open Order risk. Read the risk level next to the next-step line. Help says that line follows the recommendation. It does not publish which of the three sentences appears for which test email, so use the test to see your own admin rather than to memorize a mapping. To test a Flow workflow on this trigger, create a test order that actually runs Shopify’s fraud analysis.

When the section is empty or the IP is blocked

Analysis is usually immediate. In rare cases it takes a few minutes. If the order says fraud analysis isn't available yet, refresh or come back, and do not fulfill until it finishes.

The abandoned checkout can instead say the customer’s IP is on a temporary blocklist. That can happen when many orders or failed payments come from the same IP in a short time. The block comes off on its own within 6 to 24 hours. Nothing in the admin clears it sooner, and another try before it lifts resets the timer. Until then, take the sale as a draft order, or ring it up on POS if the customer is there.

Before you fulfill

If the order says the analysis is not available yet, wait.
If there is no recommendation, check the order type and the plan before you treat the blank as low risk.
Read the risk level and the next-step line.
Use indicators to investigate. Do not count red icons and call the count a risk level.
On a high recommendation, verify, cancel, or refund. Fulfilling is the outcome Help connects to more chargebacks and, on Shopify Payments, to losing payment processing.
If a workflow captures payment, start it on Order risk analyzed and set capture to manual.

FAQ

Does one red indicator mean the order is high risk?

No. Indicators and group headings do not set the overall risk. Read the recommendation and the next-step line. An IP address listed beside the indicators is not a recommendation either.

Which orders have no Shopify fraud recommendation?

Test orders, free orders, orders paid entirely with a gift card, Point of Sale orders, B2B orders, and subscription renewal orders. A checkout Shopify Payments blocks never becomes an order, so it has no recommendation. On Basic, without Shopify Payments, you get indicators and not recommendations.

Should I fulfill a high-risk order?

Help’s options are verify, cancel, or refund. Fulfilling high-risk orders can lead to more chargebacks. On Shopify Payments that can mean disabled payment processing or removal from Shopify Payments. The card-issuing bank decides the reversal. Shopify does not cover it.

Sources

Shopify Help — Reviewing orders with fraud analysis (checked 2026-10-14)
Shopify Help — Managing high-risk orders with Shopify Flow (checked 2026-10-14)
Shopify Help — Order risk analyzed (checked 2026-10-14)
Shopify Help — Payment authorization and capture (checked 2026-10-14)