What Is a High-Risk Order on Shopify and How Do You Handle It Without Losing Money?

Quick answer: A high-risk order is an order Shopify flags as likely fraudulent because it shows warning signs like an IP that doesn't match the card's country, VPN/proxy use, or multiple card attempts. If you fulfill a flagged order that turns out to be fraud, you'll get a chargeback: you lose both the product and the money, plus a penalty fee. The right move is to not fulfill right away verify the customer (call/email), check the risk signals, and automatically block dangerous orders before they ever enter your system.

Updated: June 2026 · Author: Admin Browsify 10 years running and consulting on security for Shopify stores

If you're reading this, chances are you just saw an order with an orange or red warning in Shopify and you're wondering: "Should I ship this?" I've handled this situation hundreds of times for stores, and this article answers every question you have right now with a practical, step-by-step process.

What does a high-risk order on Shopify mean?

A high-risk order is an order that Shopify's fraud analysis system scores as having a high probability of fraud. Shopify sorts every order into three levels: Low, Medium, and High risk.

The risk level is calculated from a range of signals, the most common being:

• The customer's IP address doesn't match the card's issuing country
• The customer is using a VPN, proxy, or TOR to hide their real location
• Multiple failed card attempts before a successful order (a sign of card testing)
• The billing address doesn't match the shipping address
• The card's AVS/CVV details don't match
• A single device places several orders in a row within a short time

Important: a "High risk" flag does not mean the order is definitely fraud. It only means the order is worth pausing on and checking before you ship.

The Fraud Analysis section of a Shopify order, showing the specific signals IP mismatch, card attempts, address mismatch that pushed this order into the High-risk tier.

Why are high-risk orders dangerous for your store?

Because if you fulfill a fraudulent order, the damage isn't just a lost product. Here's the real chain of losses:

1. Chargeback: The real cardholder discovers the theft and disputes it with their bank. The money is pulled from your account.
2. Lost product: The item has already shipped you'll almost never get it back.
3. Chargeback fee: Each dispute usually adds a fee (around $15 or more, depending on the payment gateway).
4. Rising chargeback rate: If this rate crosses a threshold, you risk having your payment account held, restricted, or shut down.

In other words, a $50 fraudulent order can cost you many times that amount and at worst, your ability to accept payments at all.

Should you fulfill a high-risk order?

Don't fulfill it right away. The safe rule is: with a High-risk order, always verify before you ship. Here's the decision tree I still use:

A decision flow for whether to fulfill a high-risk order branching on order value, verification response, and repeat signals from the same source.

How to handle a high-risk order step by step

Here's the practical process, in order:

1. Open the order's Fraud Analysis. See exactly which indicators Shopify flagged (IP, card, AVS…).
2. Cross-check the addresses. Do billing and shipping match? Does the IP country match the card country?
3. Contact the customer. Send an email or call to confirm the order. Real customers usually respond quickly and happily; fraudsters tend to go silent or answer vaguely.
4. Request verification for high-value orders. You can ask the customer to confirm through a second channel.
5. Make the call: Fulfill if everything checks out Cancel & refund if doubt remains. When in doubt, a refund is always cheaper than a chargeback.
6. Log the fraud source. Save the IP, Visitor ID, or IP range to block in the future.

How do you stop high-risk orders at the source instead of handling them one by one?

This is where most merchants miss the point: manually reviewing every order doesn't scale. As your store grows, you can't sit and verify every alert. The solution is to block risky traffic before it ever creates an order.

An effective approach has three layers:

• Block anonymous sources: Automatically block visitors using VPN, proxy, or TOR the group with the highest fraud rate.
• Block by risk score: Set a threshold to auto-block orders above a certain risk level (e.g., 80/100).
• Block by geography / ISP: Block countries or networks that your store repeatedly receives fraud from.

This is exactly how a dedicated security app like Browsify helps. Instead of leaving you to react after a risky order has already appeared, Browsify scores every visitor on a 0–100 risk scale based on IP, browser fingerprint, and behavior, then automatically blocks or redirects the dangerous group before they ever reach checkout. It also has an option to let iCloud Private Relay through, so you don't accidentally block genuine Apple customers. For merchants drowning in high-risk alerts, this automated layer of defense saves hours of manual review every week.

Setting an auto-block threshold (here at 80/100) so high-risk visitors are stopped before they can create an order the source-level prevention described above.

Practical tip: Start with the auto-block threshold at 100 (blocking only the highest risk), monitor for a few days, then gradually lower it toward 80 to tighten up reducing fraud while limiting false blocks of real customers.

Frequently Asked Questions (FAQ)

Is a high-risk order always fraud?

No. It's a probability flag, not a verdict. A real customer who's traveling, using a corporate VPN, or who mistyped their address can still get flagged. So always verify before deciding, instead of canceling every high-risk order.

Will I lose money if I cancel a legitimate high-risk order?

You won't lose product or money you simply refund what you charged the customer. The only risk is losing a legitimate sale. That's why verifying (call/email) before canceling helps you keep real customers.

Does Shopify automatically block high-risk orders?

Shopify Payments can automatically hold or cancel some very high-risk orders, but the default level of automation is fairly limited. Most high-risk orders still require your own decision, or a third-party app to automate based on your own rules.

How do I tell a real customer using a VPN from a fraudster using a VPN?

It's hard to tell from the VPN alone so you need to weigh other signals: does billing match shipping, were there multiple card attempts, what's the history of that Visitor ID. A customer on a VPN whose other details are all clean is usually genuine.

Can you win a fraud-based chargeback dispute?

It's very hard to win against card fraud (a "fraudulent" chargeback), because the real cardholder never made the purchase. This is why prevention before fulfillment matters far more than disputing after you've already lost the money.

What risk score threshold is reasonable?

There's no single right number for every store. A low threshold (e.g., 67) blocks more but more easily blocks real customers; a high one (100) is more lenient but lets more fraud through. The safe approach is to start high and lower it gradually while monitoring your false-block rate.

This article is based on hands-on experience securing Shopify stores. If you're dealing with constant high-risk orders or chargebacks, you can find more in the Browsify documentation or reach out to [email protected] for help with configuration.