A Shopify high risk order is not an instruction to cancel. It is a prompt to spend five minutes checking six things, then ship, verify or refund. Cancel on instinct and you will turn away real customers. Ship on hope and you will pay for a chargeback.
Most Australian store owners do one of two things when that red warning appears on the Orders page. They panic and cancel everything flagged, or they ignore it because the customer “seems nice” and the order is $380. Both habits cost real money, and Black Friday on 27 November 2026 will multiply the mistake because order volume spikes and your attention drops.
This guide gives you the exact decision tree we use with eCommerce Circle members, the checks behind it, the Shopify Flow workflow that automates the boring part, and the evidence pack that wins the disputes you cannot avoid. It sits in the Protection pillar of the More Orders Operating System because one lost dispute can erase the margin on ten good orders.
What a Shopify high risk order actually means
Shopify scores eligible online card orders as low, medium or high risk of a fraud-related chargeback. According to the Shopify Help Centre, medium and high orders get a warning symbol on the Orders page, plus a suggested next step: fulfil it, confirm with the customer first, or consider cancelling.
The score comes from machine learning trained on historical transactions across Shopify stores. SureBright, citing a Shopify data science manager, puts the training set at more than 10 billion transactions. That is a lot of signal, but it is still a probability, not a verdict.
The signals Shopify reads include:
- AVS result. Does the billing address match what the card issuer has on file?
- CVV. Was the security code entered correctly?
- Location mismatch. Does the buyer’s location sit near the payment method and shipping address?
- Unusual device or network activity. Think proxies, VPNs and masked connections.
- Multiple cards. Did the buyer try several different cards before one worked?
Shopify’s own guidance warns against judging an order by the number of indicators. One flag on its own, like a long IP distance, is often a mobile carrier or a traveller. Three flags together, like a failed CVV, a mismatched address and four different cards, is a different story.
There is one more thing to know. Not every order gets scored. Test orders, free orders, gift card orders paid in full, POS orders, B2B orders and subscription renewals are excluded, and recommendations need the Grow plan or higher, or Shopify Payments. If you are on Basic without Shopify Payments, you only see the raw indicators.
Why cancelling every flagged order backfires
Fraud is a real cost. It is also smaller than most owners think, and the cure can be worse than the disease.
Visa Acceptance’s Global Fraud Report puts the global order fraud rate at 3.0% in 2025, down from 3.4% the year before, with merchants rejecting 5.0% of orders. Read those two numbers side by side. Merchants reject more orders than are actually fraudulent. Some of those rejections are legitimate customers who walk away and do not come back. Chargebacks911 estimates merchants lose around 13 times more to incorrectly declined orders than to fraud itself (figures collected by Opensend).
Treat the 13x figure as directional, because it is a vendor estimate and the maths will differ for a small Aussie store. The principle holds either way. Every cancelled good order is lost revenue plus a lost customer, and you paid to acquire that customer.
Here is a simple way to feel it. Say your average order is $120, you run a 2.5x ROAS on Meta and you cancel 10 legitimate orders a month. That is $1,200 in revenue and roughly $480 of ad spend you will never recover, before you count repeat purchases. Ten false cancels a month burns about $5,760 a year in ad spend alone, on top of $14,400 in lost sales.
The opposite error is just as expensive. Fulfilling a fraudulent order means you lose the stock, the shipping and the sale, and then pay the dispute fee on top.
What a chargeback really costs an Australian store
For Shopify Payments stores in Australia, the dispute fee is $25 AUD per chargeback and you only get it back if you win, according to Ringly breakdown of Shopify chargeback fees. That fee is the smallest part of the bill.
The same source cites about $110 as the average all-in cost of a chargeback, covering merchandise, fulfilment and labour (attributed to Mastercard research via ClearSale). Their worked example has a $120 order costing roughly $237.50 once you add the lost goods, the fee and the time.
Then there is the account risk. Shopify warns that fulfilling high risk orders can increase chargebacks, which can lead to deactivated payment processing or removal from Shopify Payments. A store that loses its payment gateway in the middle of November has a much bigger problem than one bad order.
One more piece of Australian context. The ACCC reported that shopping scams were the most reported scam type involving a financial loss from January to September 2025, with 9,628 reports of loss and $8.6 million lost, up 19% on 2024. Fraudsters are active in Australian online shopping, and they are busiest around sales events.
Do not count on Shopify to cover you. Shopify Protect only applies to US-based businesses using Shopify Payments and is closed to new activations, which we unpack in our Shopify Protect Australia guide. For Aussie stores, your process is your protection.
The 6 checks to run on every high risk order
You do not need a fraud analyst. You need a fixed routine so every flagged order gets the same five minutes of attention. Run these in order.
Check 1: CVV and AVS
If both the security code and the billing address matched, the card issuer has already verified the card in a meaningful way. That does not clear the order on its own, but it is the strongest single reassurance you have. If either failed, the order moves straight to verification.
Check 2: Payment attempts
One clean attempt is normal. One retry is common, because people mistype cards. Three or four attempts, especially with different cards, is the pattern that fraudsters produce when they are cycling through stolen numbers. Look at the payment timeline on the order page.
Check 3: Shipping against billing
A mismatch is not automatically bad, because gifts exist. A different shipping address combined with a brand-new customer, an express shipping upgrade and a high-value order is the classic combination to slow down. Gift orders can trigger false positives in November and December, which is why our gift returns guide is worth a read before the rush.
Check 4: Email and customer history
Is this a returning customer with prior successful orders? Great. Is it a freshly created email at a free provider, with a name that does not match the card, ordering your three most resellable products in quantity? Not great. Search the email in your orders. Repeat customers are far lower risk.
Check 5: Order shape
Fraud has a shape. Look for high-value, easily resold items, unusual quantities, express shipping on a first order, and a basket far above your normal average order value. If you sell consumables at $45 and this order is six units of your most expensive electronics bundle, pause.
Check 6: Network signals
A proxy or VPN is a medium-weight signal. A large distance between the IP and the shipping address, on its own, is often a false positive. SureBright’s example was a $125 order with a 1,220 km gap that turned out to be a mobile carrier. Context decides.
The decision tree: ship, verify or cancel
Now turn the checks into a decision. This is the part most stores skip, which is why they flip a coin on every flagged order.
- Cancel and refund when CVV or AVS failed and there were multiple cards or failed attempts. This pattern is rarely a real customer. Refund through Shopify, tag the order, and move on.
- Ship with tracking when CVV and AVS both matched and the only flag is the IP distance. This is the most common false positive. Ship it with a trackable service and keep the evidence.
- Verify by email for everything in between. Ask the customer to confirm the shipping address by replying from the email used at checkout.
The verification email takes 90 seconds to write. Here is a version you can paste:
Hi [First name], thanks for your order #[number]. Before we dispatch, our system needs one quick confirmation. Can you reply to this email confirming the delivery address below and that you placed the order? We will ship as soon as we hear back. If we have not heard from you within 24 hours we will cancel and refund the order in full. Thanks, [Your name].
The 24-hour cutoff matters. A genuine buyer replies, usually within hours, because they want their parcel. A fraudster rarely engages, and a stolen-card user cannot confirm details from the real cardholder’s inbox. Silence is your answer.
Two rules keep you out of trouble. First, never ask for card numbers or photos of cards by email. Second, write down your decision and the reason on the order timeline. That note becomes evidence if the order is later disputed.
Automate the first pass with Shopify Flow
You should not be eyeballing every order during Black Friday. Shopify Flow is free and has a risk template ready to go. Shopify’s help centre lists a template called Capture payment if order is not high fraud risk, plus templates that cancel and restock high risk orders or cancel orders from known bad email addresses.
Here is the setup, step by step:
- Go to Settings > Payments and set card authorisation to manual capture. The capture template will not work with automatic capture on.
- Open Apps > Flow > Create workflow > Browse templates > Risk.
- Choose Capture payment if order is not high fraud risk and click Install.
- Check the trigger. It should be Order risk analyzed, not Order created, because fraud analysis takes time to finish.
- In the Otherwise branch, add a tag such as review-high-risk and an internal email to your support address.
- Click Turn on workflow, then place a test order to confirm the high risk branch fires.
The result is a store where low and medium risk orders capture payment automatically and high risk orders sit uncaptured with a tag and an email waiting for you. You review a short list rather than the whole order book.
One caution. Manual capture means an authorisation can expire if you take too long to review, so build the habit of clearing the review tag every day. If you are fully automatic today, test the change on a quiet Tuesday, not on the Friday of the sale.
Tools worth adding to the stack
Flow handles the routing. A few other tools are worth knowing about, each with a clear job.
- Shopify Flow (free). Routing, tags and alerts. Start here.
- A third-party fraud app. Apps like Fraud Order Defender add rule-based checks on top of Shopify’s analysis. Useful if you sell high-value, high-resale products.
- A dispute-response tool. Chargeflow and similar services assemble evidence packs automatically. They charge a share of recoveries, so run the numbers against how many disputes you actually get.
- Afterpay or Zip at checkout. Afterpay’s retailer guide, summarised by Finder, says it pays merchants upfront and assumes end-customer non-payment risk, at roughly 4-6% commission plus $0.30 per transaction. It is not a fraud tool, but it moves part of the risk off your books on those orders. Check the current terms in your own agreement.
None of these replace the five-minute routine. They just shrink the pile that reaches you.
Build your dispute evidence pack before you need it
Even with a perfect process you will lose some disputes. The merchants who win more of them are the ones who saved the evidence at the time, not the ones who scramble after the notice arrives.
According to Ringly, you typically have 7 to 21 days to submit evidence after a dispute is filed, and the card network can take up to 75 days to rule. A quick, complete response may even close an inquiry before it becomes a fee-bearing chargeback. Your pack should include:
- The order confirmation and payment details, including the AVS and CVV results.
- Customer emails, including the verification reply if you sent one.
- Carrier tracking with the delivery scan and, for high-value orders, a signature or photo proof.
- Your shipping and returns policies as they stood on the day of the order. Our Shopify shipping policy template covers the wording.
- The IP address and device data from the order.
- A short note describing why you shipped, written at the time you made the decision.
Friendly fraud deserves its own mention. Chargeflow research cited by Ringly says more than 45% of chargebacks are friendly fraud, where a real customer disputes a legitimate purchase, and 81% of those customers admit it was easier than contacting the merchant. Make contacting you easier than calling the bank: clear support details on the order confirmation, a fast reply time, and a recognisable billing descriptor.
For orders over $300, use signature on delivery or at minimum a carrier service with a delivery photo. An Australia Post authority-to-leave drop is convenient, but it is thin evidence when a customer claims they never received the parcel.
The compound effect: process beats instinct
Put the pieces together and the system looks like this. Flow routes every order by risk, so only a short list needs your attention. Your six checks decide each flagged order in five minutes. The verification email resolves the grey ones with a 24-hour rule. Every decision gets a note. Every shipped high-value order gets tracking you can defend.
The payoff is not one big win. It is three quiet ones. You cancel fewer real customers. You ship fewer fraudulent orders. And when a dispute does arrive, you win more of them because the evidence already exists. Run that across a Black Friday weekend with a few hundred orders and the difference is easily thousands of dollars.
If this is your first November running a process like this, read it alongside our Black Friday Australia 2026 guide, and if you sell gift cards, put the controls in our gift card fraud playbook in place first. For the bigger picture on cover, see what insurance a home-based store needs.
Your high risk order checklist
Copy this into your SOP doc and share it with whoever handles orders.
- Before the sale: switch to manual capture, install the Flow template, send a test order, and write the verification email into a saved reply.
- For every flagged order: check CVV and AVS, payment attempts, shipping vs billing, customer history, order shape and network signals.
- Decide: cancel on failed CVV/AVS with multiple cards, ship on clean CVV/AVS with only an IP flag, verify everything else.
- Verify: send the email, wait 24 hours, cancel and refund on silence.
- Record: add a timeline note with the decision and reason.
- Ship: tracked service, signature for high value, save the scan.
- Weekly: count your flagged orders, false cancels and disputes. Track your dispute rate against a 0.5% internal alarm.
Frequently asked questions
Should I cancel every high risk order on Shopify?
No. A high risk label is a probability. Run the checks, verify by email where unsure, and cancel only when the evidence points to fraud.
Can I ship a high risk order and still dispute a chargeback?
Yes, but the odds depend on your evidence. A tracked delivery, a verified email reply and saved AVS and CVV results give you a real case. Shopify warns that fulfilling high risk orders can raise your chargeback count, so keep the volume low.
Does Shopify Protect cover Australian stores?
No. Shopify’s help centre says eligibility requires a US-based business using Shopify Payments, and Fraud Protect can no longer be activated on a store.
How long do I have to respond to a chargeback?
Typically 7 to 21 days to submit evidence, with the card network taking up to 75 days to rule. Check the exact deadline on the dispute in your Shopify admin.
Where this fits in your growth
Protection is the P that gets ignored until it hurts. Inside eCommerce Circle, fraud and dispute handling is one of the core pillars we work on with every member, because a store that protects its margin can spend more confidently on ads. If you want to see exactly where your store is being capped, take the free More Orders Scorecard. It takes two minutes and shows you which of the 10 P’s to fix first.
