BFCM Security Checklist for Shopify Merchants

This is the action checklist for your BFCM fraud preparation. Each item is a specific, completable task no theory, just execution. Work through it in order, starting 8 weeks before Black Friday.

For the strategy and reasoning behind these steps, read our companion guide: BFCM 2026 Fraud Prep →

Phase 1: Foundation (8–6 Weeks Before BFCM)

Fraud Prevention Setup

  • [ ] Install Browsify from the Shopify App Store (if not already installed). Install →
  • [ ] Set fraud score threshold to 80. Configuration → Fraud Settings → Auto-block threshold. This is your standard operating threshold you'll tighten it before BFCM.
  • [ ] Enable VPN/Proxy detection. Configuration → Network Settings → Toggle on.
  • [ ] Enable TOR blocking. Same section → Toggle on.
  • [ ] Enable "Allow iCloud Private Relay." Same section → Toggle on. Do NOT block Apple users.
  • [ ] Enable content protection (Advance+ only). Configuration → Content Protection → Block Right-Click, Block Keyboard Shortcuts.

Chargeback Recovery Setup

  • [ ] Install a chargeback recovery tool (e.g., Chargeflow). You'll need automated dispute management for the January chargeback wave.
  • [ ] Verify your Shopify Payments descriptor. Settings → Payments → Check the billing descriptor matches your brand name. Fix if needed "unrecognized charge" disputes spike during BFCM.

Baseline Data

  • [ ] Let Browsify run for 2–4 weeks to build a baseline. Don't skip this fraud scoring accuracy improves with data.

Phase 2: Review & Tighten (4–3 Weeks Before BFCM)

Data Review

  • [ ] Check your risk score distribution. Dashboard → Analytics. Note what percentage of visitors score above 60 and above 80. BFCM will amplify these numbers.
  • [ ] Review blocked visitors for false positives. Confirm your threshold isn't catching legitimate customers. Target: <2% false positive rate.
  • [ ] Cross-reference recent chargebacks. Look up Visitor IDs for any chargebacks in the last 90 days. Block all of them.

Shopify Flow Backup (Shopify Plus / Advanced)

  • [ ] Create Flow workflow: auto-cancel high-risk orders. Trigger: Order created → Condition: Risk level = High → Action: Cancel, restock, notify.
  • [ ] Create Flow workflow: hold high-value orders. Trigger: Order created → Condition: Total > $300 AND risk ≥ Medium → Action: Don't capture payment, tag "review-needed."
  • [ ] Create Flow workflow: block bulk purchases. Trigger: Order created → Condition: Quantity of any single SKU > 2 → Action: Cancel (prevents reseller bot bulk buys).

Phase 3: Final Prep (1 Week Before BFCM)

Threshold Adjustment

  • [ ] Lower fraud score threshold to 75 (from 80). BFCM attracts higher-risk traffic a more aggressive setting is appropriate.
  • [ ] Decide on VPN blocking strategy. Option A: Keep VPN detection on score-based (recommended for most stores). Option B: Block all VPN traffic for the first 1–2 hours of your main sale (recommended for door-buster deals or limited drops).

Team Preparation

  • [ ] Brief your team on Browsify dashboard monitoring, false positive whitelisting, and Visitor ID blocking procedures.
  • [ ] Assign a BFCM fraud monitor. Someone should watch the Browsify dashboard during peak hours especially the first 2 hours of your sale.
  • [ ] Prepare customer service scripts for blocked customers. Script: "We have enhanced security during Black Friday. If you're having trouble checking out, please contact us at [email] and we'll resolve it immediately."

Ad Pixel Check

  • [ ] Verify your pixel installations are clean. Check Meta Events Manager, Google Ads conversion tracking, and TikTok Events Manager for any existing conversion gaps or duplicate pixels.
  • [ ] Note your current conversion baseline. Record your pixel conversion count and Shopify order count for the week before BFCM. You'll compare after the event.

Phase 4: During BFCM

Real-Time Monitoring

  • [ ] Monitor Browsify dashboard during peak hours. Watch for: blocked visitor spikes, geographic anomalies, velocity patterns.
  • [ ] Don't lower your threshold during the event, no matter how tempting. The chargebacks from loosened protection will cost more than the marginal sales.
  • [ ] Whitelist false positives immediately. If customer service receives a complaint from a legitimate blocked buyer, whitelist their Visitor ID within minutes.

Quick Response Checklist

If you see a bot attack (sudden spike in blocked visitors from the same region or ISP):

  1. Check your Browsify dashboard for the pattern
  2. If your threshold is catching them → good, let it work
  3. If bots are getting through → lower threshold to 70 temporarily
  4. After the attack subsides → restore to 75

Phase 5: After BFCM (1–2 Weeks After)

Restore Settings

  • [ ] Raise fraud score threshold back to 80.
  • [ ] Re-enable VPN access (if you blocked it temporarily).

Analytics Review

  • [ ] Pull your BFCM fraud prevention report. From Browsify dashboard: total blocked visitors, risk score distribution, VPN/proxy percentage, unique Visitor IDs blocked.
  • [ ] Compare pixel conversions to Shopify orders. Calculate the gap. A small gap means your pixel data stayed clean during BFCM.
  • [ ] Block new bad Visitor IDs. Any devices identified during BFCM that showed fraud patterns → add to permanent block list.
  • [ ] Document lessons learned. What threshold worked best? How many false positives? Any customer complaints about blocking? Save these notes for BFCM 2027.

Phase 6: January Chargeback Management

Preparation

  • [ ] Set a weekly calendar reminder to check your chargeback rate every Monday in January.
  • [ ] Target: stay below 0.9% (Visa VAMP early warning). If your rate trends above 0.7%, tighten your fraud prevention immediately.

Dispute Process

  • [ ] Ensure Chargeflow (or equivalent) is active and processing disputes automatically.
  • [ ] For manual disputes, prepare evidence packages with: order confirmation, shipping tracking, delivery confirmation, Browsify visitor data (Visitor ID, fraud score, device signals), customer communication history.
  • [ ] Track dispute outcomes. Win rate, recovery amount, patterns in lost disputes. Use this data to improve prevention for next year.

Quick Reference: Key Settings

Setting Pre-BFCM (Normal) During BFCM Post-BFCM
Fraud score threshold 80 75 80
VPN/Proxy detection On (score-based) On (or block during peak) On (score-based)
TOR blocking On On On
iCloud Private Relay Allowed Allowed Allowed
Content protection On On On
Shopify Flow fraud workflows Active Active Optional

Start your BFCM prep now install Browsify free →

Related Reading