Shopify fraud prevention is the discipline of catching fraudulent orders before they ship — saving you the cost of goods, fulfillment, and the inevitable chargeback fee. Industry data: fraud costs Shopify merchants 0.5–3% of revenue, with chargeback fees adding another 0.2–0.8%. For a $50K/month store that's $300–$1,900/month before chargebacks.

This guide covers the signal-vs-noise problem (false positives are expensive too), the tools that work in 2026, and the workflow for handling borderline orders without grinding to a halt.

Why fraud is a small but real problem

The fraud landscape for Shopify in 2026:

  • Carded orders: stolen credit cards used for purchase. Most common fraud type.
  • Identity theft orders: real card + real address, but not the cardholder. Harder to detect.
  • Refund fraud: legitimate purchase, then customer claims didn't receive (sometimes legitimately, sometimes not).
  • Chargeback abuse: customer disputes a legitimate charge as fraud after using/keeping the item ("friendly fraud").

For most consumer-product Shopify stores under $200K/month, total fraud is 1-2% of revenue. Above $200K/month, fraud volume grows roughly with revenue (not faster) and the operational discipline matters more.

Shopify's built-in fraud detection

Shopify automatically assigns a fraud risk indicator to every order: Low, Medium, or High. Visible in the order page in admin.

The indicator considers:

  • Billing address vs shipping address mismatch
  • Card AVS / CVV results
  • Whether the IP location matches the billing address
  • Whether the order shipping address is in Shopify's known-fraud list
  • Order velocity from a similar customer profile

Shopify's filtering catches 80%+ of obvious fraud without you doing anything. The remaining 20% is what manual review handles.

Third-party fraud tools

Two categories:

1. Fraud scoring tools (light review)

Signifyd, NoFraud, Fraud Filter (Shopify native) — score each order, flag suspicious ones for manual review.

When useful: $50K+/month with order volume that makes manual review of every borderline order infeasible.

Cost: $30-200/month based on volume.

2. Fraud guarantees (insurance model)

Signifyd Pro, NoFraud Guarantee — they review and decide whether to ship. If they approve and it turns out fraudulent, they cover the chargeback.

When useful: high-AOV stores ($150+) where individual fraud losses are large. Mostly enterprise.

Cost: 0.5-1.2% of revenue.

For most stores under $100K/month, Shopify's built-in detection + manual review of high-risk orders is enough. Don't pay for tools you don't need.

The 3-question manual review

For Shopify-flagged Medium or High risk orders, a 60-second review answers:

Question 1: Does the billing address match the shipping address?

If yes, fraud probability drops sharply. Most fraudsters can't ship to the cardholder's billing address (defeats the purpose).

If no — different countries, different cities, or the shipping address is a freight forwarder — investigate further.

Question 2: Does the IP location make sense?

Shopify shows the order's originating IP location. Card billed in Texas + IP in Russia + shipping to Florida is suspicious.

Note: VPNs are common. An IP in one country with a domestic billing/shipping isn't automatically fraud — many travelers and privacy-conscious customers use VPNs. But IP + billing + shipping all mismatching is a strong signal.

Question 3: Is this a typical order for your store?

Anomalies that flag fraud:

  • 5x your AOV in a single order from a new customer.
  • Multiple of the same SKU when typically customers buy one.
  • Express shipping requested but cheapest items selected.
  • New account, no order history, expensive cart.

Most of these aren't disqualifying alone — they're cumulative signals.

If 2 of 3 questions raise concerns, email the customer asking to verify rather than canceling outright. A simple "We had a security flag on your order — can you confirm the shipping address matches your billing?" gets a quick reply from legitimate customers and silence from fraudsters.

The workflow for borderline orders

A clear protocol prevents both fraud losses and false positives:

Order classification

  • Low risk + no anomalies: ship as normal. ~95% of orders.
  • Low risk + one minor anomaly: ship as normal but log for batch review. ~3% of orders.
  • Medium risk + matches the 3-question test: ship. ~1% of orders.
  • Medium risk + fails the 3-question test: email customer to verify. ~0.5% of orders.
  • High risk + fails verification email (no response in 48h): cancel order with refund. ~0.2% of orders.

The verification email is the key lever. Legitimate customers respond quickly; fraudsters disappear. False-positive cancellations drop dramatically.

Time cost

For a $50K/month store with ~1,200 orders/month: maybe 10-15 verification emails per month, each taking 2 minutes to send and 5 minutes to follow up. Total: 1-2 hours/month.

For higher-volume stores, this is the threshold where a fraud-scoring tool starts paying back operationally.

Chargebacks: prevention vs response

Chargebacks have two phases:

Prevention

  • Clear product descriptions — see PDP guide. "Friendly fraud" chargebacks often start with "I didn't expect this" complaints.
  • Visible return policy — customers initiate returns instead of chargebacks if returns feel easy.
  • Tracking notifications — customers don't claim non-delivery if they've seen the tracking updates.
  • Realistic shipping expectations — explicit delivery timeframes prevent chargebacks driven by shipping confusion.

Response

When a chargeback hits, you have 5-10 days to respond with evidence. Shopify's chargeback dashboard organizes this.

Evidence to include:

  • Order details (cart, billing, shipping).
  • Tracking with delivery confirmation.
  • Customer correspondence (replies to verification emails, support history).
  • Return policy + customer's lack of return attempt.

Win rate: 40-60% with good evidence. 10-20% without.

High-AOV considerations

For stores selling $150+ AOV products, fraud math shifts. A single fraudulent order is more expensive; the case for fraud-scoring tools strengthens.

Tactics:

  • Identity verification step at checkout for orders above a threshold (e.g., $300+). Friction is acceptable for high-value transactions.
  • Manual review on every order above a threshold. At low volume this is feasible.
  • Signifyd or NoFraud Guarantee for the volume cases.

For stores below $80 AOV, the fraud-prevention overhead has to stay light — manual review of every order isn't viable.

Frequently asked questions

What's a normal Shopify fraud rate?

0.5–3% of revenue lost to fraud + chargebacks is typical. Above 4% suggests structural issues (high-fraud-targeted category, no fraud filtering). Below 1% is excellent.

Should I require AVS / CVV on every order?

Yes, by default. Shopify Payments enforces these. Disabling them dramatically increases fraud risk for marginal conversion gains.

What if I get a chargeback for an order I shipped?

Respond within 5-10 days with tracking + customer correspondence + clear product description. Win rate with proper evidence is 40-60%.

Should I use a third-party fraud tool?

Below $50K/month: probably not. Shopify's built-in is enough. $50K-$300K/month: optional, depending on order volume and AOV. $300K+/month or $150+ AOV: yes, the math typically works.

Does DropifyXL touch fraud detection?

No. Fraud detection is Shopify's domain (built-in or via tools like Signifyd). DropifyXL operates on confirmed orders for analytics + recommendations.

Key takeaways

  • Fraud is 0.5-3% of revenue for typical Shopify stores. Real but bounded.
  • Shopify's built-in fraud detection catches 80%+ of obvious fraud. Don't disable it.
  • For Medium/High risk orders: 3-question manual review (60 seconds) catches most remaining fraud accurately.
  • Verification email > automatic cancellation. False positives are 3-5× more expensive than false negatives.
  • Chargeback prevention starts with clear PDPs, visible return policy, and tracking notifications.
  • Third-party tools earn back at $50K+/month or $150+ AOV; not before.

Fraud is bounded and manageable. Most merchants either ignore it (paying the loss) or over-engineer for it (paying the false-positive cost). Neither extreme is right; the discipline is in the middle.