Shopify fraud costs merchants an estimated $25 billion globally per year. For individual stores, a single fraudulent order at $500 average order value results in the merchant losing the product, the shipping cost, and often a chargeback fee — a total impact of $600–700 per incident. At 5 fraud incidents per month, that is $3,500–4,200 per year in direct losses, before accounting for the operational time spent on chargeback disputes.
The problem is not that Shopify has no fraud tools — it has a built-in fraud indicator. The problem is that the indicator was designed for the most obvious fraud patterns and misses an increasingly large proportion of actual fraud. This guide covers a complete fraud prevention framework for Shopify merchants.
Types of Shopify fraud in 2026
Card-not-present (CNP) fraud: A fraudster uses stolen card credentials to place a Shopify order. The legitimate cardholder disputes the charge and receives a chargeback. The merchant loses the product and shipping costs. This is the most common form of Shopify fraud.
Friendly fraud (chargeback fraud): A legitimate customer places an order, receives the product, then disputes the charge claiming non-delivery or unauthorised transaction. The merchant must prove delivery to defend the chargeback. This accounts for 40–60% of all chargebacks in ecommerce and is growing.
Account takeover (ATO): A fraudster gains access to a legitimate customer account — often through credential stuffing using leaked passwords — and places orders using the account's saved payment methods. These orders appear completely legitimate to standard fraud checks.
Refund and return fraud: Customers claim a product was not delivered, was damaged, or was not as described to obtain a refund while keeping the product. More common in higher-value categories and with policies that offer refunds without requiring product returns.
Triangulation fraud: A fraudster sells products on a marketplace, uses stolen cards to fulfil orders from legitimate merchants like yours, and keeps the marketplace payment. You receive what appears to be a legitimate order but the card is stolen.
The limitations of Shopify's native fraud indicator
Shopify's built-in fraud indicator checks a small set of signals: card BIN country vs billing address country, billing-to-shipping address match, customer IP location vs billing country, and basic velocity checks. These signals catch the most obvious fraud — a US card billing to a Nigerian address, shipping to a freight forwarder — but miss the majority of modern fraud.
Signals Shopify's indicator does not check: device fingerprinting (the same device used for multiple fraud orders under different names), behavioural analysis (mouse movement patterns that differ between legitimate users and automated tools), cross-merchant blacklists (fraudsters who have successfully defrauded other merchants), email domain risk (disposable email services), and address age analysis (how long has this address been associated with legitimate Shopify orders?).
The practical result: Shopify marks many fraudulent orders as "low risk" because they pass the basic checks. Merchants who rely exclusively on Shopify's indicator and ship all low and medium risk orders will experience fraud losses that exceed their baseline assumptions.
Building a fraud prevention stack
A complete Shopify fraud prevention framework has three layers:
Layer 1: Pre-checkout prevention
- Require account creation for orders above a value threshold (harder for fraudsters to create verified accounts than to use stolen cards as guests)
- Enable address verification service (AVS) on your payment gateway — Razorpay, PayU and Stripe all support this
- Add 3D Secure (3DS) for card transactions above a threshold — adds friction for stolen card use while imposing minimal friction for legitimate customers using their own cards
Layer 2: Order-level scoring with Fraud Heatmap
Every order receives a 0–100 fraud risk score using 12 signals including device fingerprinting, address velocity, email domain risk and cross-merchant blacklist matching. Orders above 70 are tagged for manual review. Orders above 90 can be auto-cancelled. Low and medium risk orders proceed to fulfilment automatically — no manual review overhead for the vast majority of orders.
Layer 3: Fulfilment practices that support chargeback disputes
- Require signature on delivery for orders above $200 — adds proof of delivery that wins chargeback disputes
- Send email confirmation with tracking link immediately on dispatch — creates a documented delivery notification timeline
- Photograph packaged orders before shipping for high-value items — provides evidence if a customer claims wrong item or damaged goods
- Use Fraud Heatmap's chargeback evidence builder to package all available evidence into a formatted dispute response
Building an order review workflow
For orders flagged for manual review by Fraud Heatmap:
- Open the order in Shopify admin — Fraud Heatmap's scoring appears in the order notes
- Click through to the full signal breakdown — see exactly which of the 12 signals triggered
- Based on the signal combination, make one of three decisions: fulfil (score is elevated but no decisive signals), hold for verification (contact the customer by phone before shipping), or cancel (multiple decisive fraud signals)
- For verification holds: call the customer's provided phone number. Legitimate customers answer and confirm. Fraudsters typically do not.
- Document your decision in the order notes — this creates an audit trail and supports chargeback disputes if the order is fulfilled and later charged back
A well-configured fraud review workflow should require manual review on 3–7% of orders. If your review rate is higher than 10%, your thresholds are too aggressive. If it is under 2%, you may be missing borderline cases.
Measuring your fraud performance
Track monthly: fraud rate (fraudulent orders as % of total), chargeback rate (chargebacks as % of transactions — keep below 0.9% to avoid payment processor issues), chargeback win rate (disputes won as % of disputes filed — target above 50%), and total fraud loss (product cost + shipping + chargeback fees on fraud incidents).
A fraud rate below 0.5% is excellent for most Shopify merchant categories. A chargeback rate above 1% puts you at risk of payment processor penalties and eventually account termination. Use these benchmarks to calibrate your fraud prevention investment.