Stop Auto-Fulfilling Digital Gift Cards on Shopify

A merchant posted on r/shopify in January 2025 that ten orders from Canada had come through in a single week, all with the same shape: a low-value physical item combined with a $1,000 gift card. Their gift cards were set to fulfill automatically. Almost immediately after each purchase, a second high-dollar order shipped to a different address in the States, paid for with the gift card code. Two of the ten orders were flagged medium-risk. Eight were flagged low. By the time the merchant caught the pattern, they had lost two $1,000 orders and were unwinding four more before shipment. This is gift card fraud in its most common shape, and it is not clever. It has been running the same way in Shopify Community threads since at least 2023.

What the pipeline actually looks like

Four steps, in order:

1. A fraudster uses a stolen credit card to buy a digital gift card from your store.
2. Your store auto-fulfills the gift card. The code arrives in the buyer's inbox within seconds.
3. Either the fraudster or a buyer they resold the code to places a second order, usually shipped to a different address, paid with the gift card code.
4. The original cardholder sees the unauthorized charge, files a chargeback, and the bank pulls the money back. You are left with an empty gift card, shipped product you cannot recover, and a $15 chargeback fee.

The pipeline is boring, which is exactly why it works. Fraud engines are calibrated for something more exotic. They watch for velocity, for billing/shipping mismatch, for BIN patterns, for high-risk countries. A single gift card purchase from a real-looking Canadian customer with matching addresses satisfies every heuristic Shopify has. In the r/shopify merchant's cluster of ten orders, Shopify's fraud ML rated eight of them as low-risk and two as medium. Zero were flagged high.

The fraudsters know this. A Shopify Community thread from August 2025 documented a variant where the gift card was bundled with a $2 physical item and $10 shipping, then shipped to a vacant industrial lot. The cheap physical item exists to make the order look like a real customer purchase. One community member in the thread called it "a smart attempt to avoid automatic cancellation for a big value item," and they were right. It works often enough to keep showing up.

The one setting that flips the math

If you sell digital gift cards on Shopify, the single setting that decides whether gift card fraud is a routine annoyance or a portfolio-level loss is auto-fulfillment on the gift card product.

With auto-fulfill on, the code ships in seconds. By the time you look at the order the next morning, the code has been redeemed and the merchandise has been shipped by you, on the fraudster's instruction. You cannot cancel a gift card once it has been fully spent. You cannot get the product back. You can only take the chargeback.

With auto-fulfill off, the gift card sits in your queue. You look at it. You notice the shipping address in Delaware that matches the one from last week. You cancel and refund. The stolen card is refunded, which is fine, because the money was never yours. The merchandise stays on the shelf. No chargeback fee, no product loss, no burned code.

That is the whole argument. One toggle. Everything downstream of it is either working for you or against you.

The setting lives under Products, then your gift card product, then Order fulfillment. Set it to "Do not automatically fulfill any of the order's line items." Do this today if you have not.

The counterargument, and why it does not hold

The pushback I hear is fair: manual fulfillment adds a delay for real customers, and a gift card is the one product where instant delivery is the point. Someone bought it for a birthday. If it does not arrive in five minutes, the birthday is over.

Two things to say to that.

First, the math is asymmetric in a way that makes the delay worth it. A single $1,000 gift card lost to gift card fraud costs you the $1,000 in merchandise, the $15 chargeback fee, and the reputation ding on your merchant account, which raises processing fees on every future order. A twenty-minute delay for a legitimate customer costs you approximately nothing. The r/shopify merchant I paraphrased above lost two $1,000 orders before catching the pattern; there is no realistic count of birthdays you would have to inconvenience before the delay costs you the same amount.

Second, "manual" does not have to mean sitting on the queue all afternoon. Set up a Shopify Flow that fires on Order risk analysed (not Order created, which fires before Shopify has scored the order), uses the Get gift card data action to read the recipient email, and auto-fulfills only when both the risk is low and the recipient email is not on your growing internal watchlist. The Flow releases the code in under a minute for real orders and holds anything that fails a check. If you have never built a Flow before, this is a good first one to try. The Shopify Discord's #flow channel is faster than support for questions on the trigger timing, which is where most first attempts break.

If you cannot build the Flow, hold everything and fulfill twice a day. A three-hour delay on a birthday gift card has never cost me a merchant relationship. A $1,000 chargeback has cost me a whole afternoon of walking a stressed store owner through the dispute portal.

Why Shopify's fraud engine misses this

Shopify's fraud model was designed for card-present-shaped fraud in a card-not-present world. It weights signals that a criminal buying gift cards with stolen cards will trivially satisfy: matching billing and shipping addresses (the fraudster provides both), a plausible customer email (they created one), a residential IP location (they route through a proxy), a first-time-purchaser profile that looks normal.

The one signal that would catch this - product category is "digital gift card" and the order will auto-fulfill in seconds - is not weighted the way it should be. Shopify has publicly said no system is foolproof, which is true but also cover. The specific gap here is that the fraud engine's job is to score, not to block. As one community member put it on a September 2025 thread: "Shopify doesn't automatically block high-risk orders - it only flags them." A $1.99 digital product order flagged high-risk still completes. So does a $1,000 gift card order flagged low. The gift card fraud pipeline runs on exactly that scoring-versus-blocking gap.

I have not tested this on Shopify Plus. Plus merchants have access to Checkout Blocks conditional gift card disabling as of March 2025, which can prevent gift cards from being paid for by specific payment methods and route around some of this. If you are on Plus, your options are broader; I have written the rest of this post for the non-Plus solo merchant, because that is where the pipeline hits hardest.

The fix has to sit on top of the fraud engine, not inside it. That is what Shopify Flow's Order risk analysed trigger is for. That is why you build the check yourself.

If you want a second pair of eyes on your store's fraud posture before you turn any of this on, the first fifteen minutes with a help1 expert is free, and this is the kind of setup we look at often enough that we keep a saved diagnostic for it.

What I check before I turn auto-fulfill back on

I do turn it back on for some stores. Here is the shortlist I run through first.

1. Is the gift card excluded from the Shop Channel? The January 2025 fraud cluster came through Shop Channel specifically. If your gift card SKU is exposed there, remove it, or accept the risk explicitly.
2. Is a $0.00-$0.00 shipping rate configured? If a customer redeems a gift card that covers their full order, Shopify's checkout fails with a misleading shipping-address error until you add a zero-dollar rate. This is unrelated to fraud, but every store that sells gift cards eventually hits it, and it is one of the small setup steps that separates a merchant who knows what they are doing from one who does not.
3. Is there a fraud rule that pulls the recipient email from Get gift card data and cross-references against a watchlist? If yes, and if the risk-analysed trigger is in place, auto-fulfill is a defensible choice. If either check is missing, keep it off.

If you want the broader pattern this sits inside, I wrote about Shopify's fraud filter missing the wrong orders after a specific $3,000 miss. Same scoring gap, different product.

Every merchant I have talked to about gift card fraud eventually turns auto-fulfill off. The ones who did it before the first chargeback are the ones who tell that story shortest.