Postmortem of a $3,013 Shopify Fraud Filter Miss

The Shopify fraud filter flagged none of the ten coordinated-fraud orders that shipped to the same Miami address. By the time the merchant noticed, $3,013 of product was on its way and the processing fees were already gone. Two product defaults made that possible, and both are one toggle away from being fixed.

You already have "don't process high fraud risk orders" checked. Maybe you've also installed Shopify Flow and built an auto-cancel rule on High Risk, or you cancel by hand every week. We've watched all three of those patterns survive at audit, and we've watched them fail to save the merchant in the postmortem below. The fraud rule itself did its job. The trouble is that two product defaults sit underneath those steps and quietly undo them.

What happened

A dropshipper running an auto-process workflow woke up to a flood of new orders one morning. Every one was for ten of the same SKU. Different names on each, different emails, one shipping address in Miami. We've stared at lookalike patterns at audit and the alarm goes off immediately. Shopify cleared every order as low risk. Because the store ran on auto-process, every order was paid for, fulfilled, and shipped before the merchant logged in.

By the time she filed chargebacks against the obvious fraud, the products were gone and her Shopify balance was negative $3,013. Support told her the bank would side with her because the pattern was so plain. The bank sided with the cardholder, ten times in a row.

The thread, posted in early March on r/shopify and one of the highest-engagement fraud posts of the quarter, has become the canonical reference for the cross-order failure mode. The merchant had done what Shopify's admin tells you to do. The "don't process high fraud risk orders" toggle was on. The Shopify fraud filter simply did not see the pattern, because it doesn't look for one.

Why the Shopify fraud filter cleared the pattern

The Shopify fraud filter scores each order in isolation. It looks at that one order's signals: AVS match, CVV check, IP distance from billing address, address validity, whether the email or card has been associated with chargebacks. It returns Low, Medium, or High.

What it does not examine is the relationship between orders. Ten orders to the same shipping address in twenty minutes, with different cards and different emails, is a textbook coordination signature, and Shopify's per-order score has no input slot for it. A community developer put it bluntly in the Miami thread: the scoring missed the orders because cross-order patterns aren't part of the model.

The same architecture produces a second, equally costly failure on the other side. Merchants flagging legitimate customers (the AT&T mobile shopper whose IP geolocates to the next city over, the snowbird shipping to Florida from a Michigan billing zip, the traveler on hotel WiFi) sit alongside merchants who report at least one obvious-fraud order per week that the filter silently passes. The Shopify fraud filter is wrong in both directions, simultaneously, and the merchant has no transparency into which signal drove either decision.

Where the fee bleed comes from

Even when the High flag does fire, the fee on the order has often already been collected. That's the second product default sitting underneath the toggle.

By default, payment capture is automatic. The moment Shopify authorizes a card for an order, the processor's transaction fee is taken. Cancelling the order does not return that fee, because it belongs to the card network, not Shopify. A community developer named AdventureParts explained the architectural reason cleanly in an August 2024 Shopify Community thread: the fraud score itself depends on CVV and AVS signals, which only exist after the card is submitted for authorization. There is no way to run risk analysis before authorization. So if you're on auto-capture and you read the High flag five minutes after the order, your fee is gone whether you cancel or not.

For a store on a $19 first-order with a $15 processing-and-chargeback bill, that's the whole margin. For a store getting five fraud attempts a day (documented in a 2024 community thread with no resolution), that's a recurring line item with no off switch.

What we changed in the audit

The fix is two settings and one Flow. None of it is hard, all of it is hidden three menu levels deep.

1. Switch payment capture to Manual. Settings > Payments, scroll to "Payment capture", select Manual, save. Authorization still happens (so Shopify still gets the risk signals), but the fee is not collected until you press capture. Voiding before capture costs nothing.

2. Open Shopify Flow (free on every plan) and create a new workflow. The trigger has to be Order risk analysed, not Order created. This one detail kills more anti-fraud Flows than any other. A February 2026 Shopify Community thread documents the exact failure: a merchant's Flow with riskLevel is HIGH did nothing for weeks, because Order created fires before the score is assigned, so the condition silently evaluates against an empty field. Switching to Order risk analysed solved it the same afternoon.

3. On the High branch, the safer action is "Hold order fulfillment" with a note tag, not auto-cancel. A held order gives you a review window. An auto-cancelled order to a legitimate customer never recovers, and our audit pulls usually find at least a few legitimate cancels per month in stores using a hair-trigger auto-cancel rule.

4. For Medium risk, send yourself an internal email and capture only after a visual scan. The 229 km IP-distance flag that's been firing more often since spring 2026 is almost always a phone-on-cell-network shopper, not a fraud pattern.

If the Flow editor or the manual-capture switch makes you nervous (it's the part where you're touching real money, and Shopify's documentation on it is thin), that's the kind of question the first 15 minutes of a help1 expert chat is built for. We've walked merchants through the trigger change in under ten minutes a few dozen times now.

What I'd catch earlier next time

Every time we run a store-health audit, one of the first three checks is: are you on auto-capture, and is your fraud Flow trigger set to Order risk analysed? It's a thirty-second look and a thirty-second fix, and it's the single change we recommend most often.

The deeper lesson, though, is that the Shopify fraud filter only ever tells you "look at this." It stops short of confirming fraud or clearing an order as safe, and the merchant has to make that call. For a recent solo-merchant audit, that reframing was the bigger save. The merchant had been cancelling every High Risk order on principle, and we recovered close to $4,000 a month of legitimate orders that had been silently dropping out of her funnel.

We don't know everything about how the filter works. The cross-store email flagging in particular is opaque even to Shopify support, and the customer-side workaround (place the order with a new email) is the kind of thing a real customer never thinks to try. We've written more about the related ledger of chargeback fights you'll lose despite the evidence you have, because the fraud filter and the chargeback system share the same architectural quirk: you only see the score after the cost has already started to accrue.

The $3,013 case is the clean example of all of this. The filter worked as designed, scoring each order on its own and clearing them all as low risk, while auto-capture took the fees and auto-process shipped the goods before anyone looked. The filter is built to flag orders for your review, and most of the cost merchants blame on fraud actually comes from trusting its scores in either direction without changing the two defaults underneath.