Why does Shopify mark obviously fraudulent orders as \"Low risk\"?
Shopify's built-in fraud analysis checks payment signals like AVS and CVV, but it can't verify who's actually behind an order — here's how to add a real step-up review without blocking good customers.
What's going on
A store owner sees a run of orders marked "Low risk" by Shopify sail through, get fulfilled, and later turn into chargebacks — the card matched, the address matched, everything checked out, and it still wasn't the cardholder. Meanwhile tightening the risk threshold to catch those starts flagging real customers who just happen to be shipping to a different address than their billing one, or paying with a newly-issued card. The frustration is really about two different problems getting treated as one: payment risk (is this card being used by its rightful owner) and identity risk (is this a real, consistent person at all), and Shopify's out-of-the-box tools are mostly built for the first.
This shows up hardest in categories fraudsters specifically target — electronics, gift cards, sneakers, anything with high resale value — where a coordinated bad actor can pass AVS and CVV checks using a real stolen identity rather than a stolen card number alone. Generic "block anything Medium or High risk" rules either miss these (because the risk score genuinely comes back Low) or catch too many legitimate edge cases when tightened, and merchants end up either eating fraud losses or losing sales to false positives.
Why it happens
Shopify's native fraud analysis (visible on each order and flagged with a warning icon on the Orders list) is built from payment-processor and behavioral signals: whether the billing address matches the card on file (AVS), whether the CVV was entered correctly, how the order's IP address relates to the billing/shipping address, and whether the order fits unusual velocity or size patterns. Those signals are genuinely good at catching classic card fraud — someone using a stolen card number with mismatched details. They were never designed to verify that the person placing the order is who they claim to be, which is a fundamentally different (and harder) problem involving device history, identity graphs, or behavioral biometrics that Shopify doesn't collect by default.
Because "risk level" collapses both problems into one Low/Medium/High score, merchants naturally treat it as a single dial to turn up or down — and turning it up to catch identity fraud inevitably catches legitimate customers whose payment details simply look unusual (gift shipping addresses, prepaid cards, first-time purchases from a new device), which is the overblocking complaint that shows up constantly in merchant discussions.
5 ways to fix it
Actually read what "Low risk" means before you trust it
Shopify's fraud analysis is a payment-risk signal, not an identity check — it's built from AVS/CVV match results, IP-vs-billing/shipping distance, and order velocity patterns, surfaced as Low/Medium/High on the order and flagged with a warning icon on the Orders list. A stolen-but-valid card with a matching billing address, or a patient fraudster using a real (but not their own) identity, can sail through as Low risk. Stop treating Low as "safe to auto-fulfill" for your riskiest product categories and start treating it as one input alongside your own rules.
Write step-up rules with the free Fraud Control app
Shopify's official Fraud Control app lets you build custom checkout rules — beyond the default risk score — that block or flag checkouts before they become orders, based on conditions like order value, billing/shipping mismatch, or product tags. Use it to single out your genuinely high-risk categories (electronics, gift cards, easily-resold items, first-time high-value buyers) for extra scrutiny instead of applying one blunt threshold storewide, which is exactly the overblocking merchants complain about.
Automate a step-up review path with Shopify Flow, don't eyeball every order
The "Order risk analyzed" Shopify Flow trigger fires once fraud analysis completes and gives you the risk level, risk score, and specific indicators. Build a workflow that auto-captures payment on Low-risk orders, but tags Medium/High orders (or ones matching your high-risk product/value conditions) for manual review and pings a staff channel — so nothing ships without a human look, but your team isn't reviewing every single order.
Use manual payment capture and fulfillment holds as your actual step-up gate
Switch payment capture to manual for orders that land in your review bucket, and place a fulfillment hold on anything flagged — both are native Shopify order actions. This buys time to call the customer, request a photo ID or a card-matching confirmation, or simply verify the shipping address before money moves or a package goes out, which is the real fix for "sophisticated" fraud that passes basic AVS/CVV checks.
For identity-level fraud (synthetic IDs, account takeover), Shopify's native tools have a ceiling
Shopify Protect can reimburse eligible chargebacks on qualifying US Shop Pay orders, but it doesn't stop a well-constructed fake identity from placing an order in the first place — that requires device fingerprinting, identity-graph, or behavioral-biometrics data that Shopify's built-in analysis doesn't collect. If you're seeing this at real volume, a dedicated third-party fraud/identity-verification app is the honest next step rather than tightening Shopify's native rules until legitimate customers start getting blocked.
Bottom line
There's no single setting that closes this gap — Shopify's native fraud analysis is genuinely useful for catching payment-level fraud (stolen cards, mismatched addresses) but it was never built to unmask a sophisticated fake identity, and no amount of threshold-tweaking will change that. The sustainable approach is layered: use Fraud Control and Flow to route your specific high-risk categories into a manual step-up review instead of blanket-blocking, and only reach for a specialized third-party fraud/identity app once you've confirmed the volume justifies it. This isn't a gap BesPoP's apps are built to close — for true identity-risk fraud at scale, a dedicated fraud-prevention vendor with device and identity data is the more honest fit than a general Shopify app.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.