OPERATIONS · CHECKOUT · DATA · 9 SEPTEMBER 2025 · 6 MIN READ
Fraud, chargebacks and the orders worth cancelling
Shopify tells you which orders look risky. The part nobody decides in advance is which ones you are willing to lose.
You reduce chargebacks by deciding, in advance and in writing, which orders you will not ship — and then holding fulfilment on them long enough for a human to look. Shopify already does the detection: its fraud analysis flags each order low, medium or high risk using signals including AVS and CVV results, IP analysis and unusual buying behaviour, and the Admin API exposes that as a recommendation of ACCEPT, INVESTIGATE, CANCEL or NONE. What it cannot do is tell you whether a £90 order is worth the argument. Cancelling costs you the margin once; a chargeback costs you the goods, the shipping, the disputed amount and a mark against your dispute rate whether you win or not.
IN SHORT
- Shopify classifies every order as low, medium or high risk, and the Admin API turns that into one of four recommendations: ACCEPT, INVESTIGATE, CANCEL or NONE.
- A cancelled order costs you one sale. A fraud chargeback costs you the goods, the postage, the money and a data point that follows you around.
- Shopify documents that a chargeback still counts against your dispute rate even when you win it, so the win is money back, not a clean record.
- The evidence window is typically 7 to 21 days after the chargeback is filed, and Shopify says the exact deadline depends on the issuing bank — so the reply has to be a routine, not a project.
- Most evidence that wins a friendly-fraud dispute is created at fulfilment time: tracking, delivery confirmation, and a record of what the customer was told.
- Automate the hold, not the cancellation. A machine deciding to refuse a good customer is a worse outcome than a person deciding slowly.
What Shopify already tells you, and where to read it
Every order gets a fraud analysis. Shopify documents the checks behind it as including address verification (AVS), card verification (CVV), IP analysis and detection of unusual buying activity, and the result is a level — low, medium or high — with indicators explaining which behaviours contributed.
In the Admin GraphQL API the same thing is on the order itself. Order.risk returns an OrderRiskSummary, which carries assessments and a single recommendation. The recommendation is one of four documented values: ACCEPT (fulfil it), INVESTIGATE (contact the buyer), CANCEL, or NONE (no recommendation). Each assessment has its own riskLevel — HIGH, MEDIUM, LOW, NONE or PENDING — plus the provider that produced it, which is null when the assessment came from Shopify and an app when it did not.
Two practical consequences. First, PENDING is a real state: the assessment is not always there the instant the order is. Any automation that reads risk on order creation has to tolerate not having an answer yet, which is what the Flow trigger Order risk analyzed exists for. Second, if you are reading the older risks field on Order, it is deprecated — move to risk.
A third-party fraud app does not replace this. It adds its own assessment alongside Shopify’s, with its own facts. That is useful, and it is also two opinions you now need a rule for.
The decision nobody makes until it is too late
Here is the question that actually reduces chargebacks, and it is not technical: at what order value, on which products, are you willing to eat the loss rather than take the risk?
Answer it now, while nothing is on fire. The answer differs wildly by business. A store selling £15 consumables with 70% margin should ship almost everything and absorb the occasional loss, because reviewing orders costs more in labour than the fraud costs in goods. A store selling £900 electronics with 18% margin has the opposite arithmetic: one successful fraud wipes out several honest sales, and a phone call to verify is cheap by comparison.
Work it out in the only unit that matters — what a single bad order costs you end to end. Not the item cost: the item, the outbound postage, the payment fee, the disputed amount, the staff time to answer the dispute, and the fact that the dispute counts against you regardless of outcome. Against that, the cost of cancelling is the gross margin on one order plus the risk of insulting a real customer.
For most stores the crossover is lower than instinct suggests, because instinct is anchored on the sale you can see and not on the loss you have not had yet.
- High risk, high value, expedited shipping, new customer, mismatched billing and shipping — this is the cluster worth refusing, and refusing it is not rude.
- High risk, low value, established customer — ship it. The review costs more than the item.
- Medium risk of any value — this is what
INVESTIGATEmeans, and the investigation is one email or one phone call, not an investigation. - Low risk but unusual — a first order that is ten times your average basket is worth a human glance whatever the flag says.
- Digital or instantly-redeemable goods — treat every risk tier one step harsher, because there is nothing to recover and no delivery proof to submit.
Cancel properly, and say why
A cancellation handled badly generates the thing you were trying to avoid: an angry legitimate customer who disputes the charge out of confusion.
So refund in full, immediately and visibly — not "we will process it within ten days". Send a short message that says the order could not be verified, invites them to reorder, and gives them a way to reach a person. Do not accuse anybody of fraud; you do not know, and the flag is a probability rather than a finding.
And offer a route back. "We could not verify this order, so we have refunded it in full — if you would like to place it again with the billing address matching your card, or pay by an alternative method, we will get it out today" recovers a meaningful share of the false positives. Silence recovers none of them.
Chargebacks are won at fulfilment, not at the deadline
When a dispute arrives you are assembling a case from records you either kept or did not. Shopify populates what it can automatically for Shopify Payments merchants — product and shipping details, tracking numbers, order and fulfilment dates, customer address and IP geolocation — but it cannot invent evidence that was never created.
That is the operational point. Delivery confirmation on high-value orders, a photograph at dispatch, a signature where the courier offers one, an archived copy of what the customer was actually told about delivery dates: none of that is worth much on a good day and all of it is the whole case on a bad one. If your courier cannot prove delivery on a £900 parcel, you will lose the item-not-received disputes on £900 parcels.
The timing is unforgiving. Shopify states the evidence deadline is typically 7 to 21 days after the chargeback is filed, with the exact window set by the card-issuing bank. A 7-day floor means a dispute that lands while your one ops person is on holiday can expire unanswered. Make it somebody’s named job with a named deputy.
Two things worth internalising. Shopify is explicit that it is not involved in the decision — the issuing bank decides — so escalating to Shopify support is not a strategy. And Shopify documents that winning a chargeback does not improve your dispute rate: the dispute still counts. Every chargeback is therefore partly unrecoverable damage, which is the strongest argument for prevention over litigation.
What Shopify Protect does and does not do
Shopify documents Fraud Protect for eligible businesses in the United States using Shopify Payments: on orders it classifies as protected, Shopify guarantees payment and handles the chargeback process for you. If you are eligible and not using it, that is an easy decision.
Its limits are more instructive than its coverage. It protects specific orders, not your store — an order outside the protected set is entirely yours. It is tied to Shopify Payments, so alternative gateways and any market where Shopify Payments is not available fall outside it. And it does nothing about the dispute categories that are not card fraud: the item genuinely did not arrive, the description was wrong, a subscription was cancelled and billed anyway. Those are operational failures dressed as chargebacks, and no guarantee covers being bad at fulfilment.
If you trade outside the US, the honest summary is that the guarantee is not available to you and the rest of this post is the whole of your strategy.
Automate the hold, keep the human
The automation that pays for itself is narrow. Use the Order risk analyzed trigger in Flow to hold fulfilment on high-risk orders and put them somewhere a person will see them — a tagged view, a Slack message, an ops task. That single rule removes the most common cause of fraud losses, which is not a bad decision but no decision: a high-risk order picked, packed and shipped within the hour because nobody was watching.
Shopify warns directly that fulfilling high-risk orders without review can lead to chargebacks and payment processing problems, and a hold is the cheapest possible response to that warning.
Where we would stop short is automatic cancellation. Rules cancel real customers — the person who typed their old billing address, the one travelling, the one whose bank routes oddly — and you never hear about the ones you lost. Hold automatically, decide manually, and revisit the rule quarterly using a count you actually keep: how many holds turned out to be fraud, and how many turned into a completed order after one email. If almost all of them complete, your threshold is costing you more than fraud is.
Questions this raises
How do you reduce chargebacks on Shopify?
Hold fulfilment on high-risk orders so a person reviews them before dispatch, decide in advance which order values and product categories you will refuse outright, and make delivery provable — tracking and confirmation on anything valuable. Most chargebacks are lost because the evidence was never created, not because the reply was badly written.
Should you cancel every high-risk Shopify order?
No. High risk is a probability, not a verdict, and the arithmetic depends on the order. On a £15 item with healthy margin, reviewing costs more than the occasional loss, so ship it. On a high-value, low-margin item with expedited shipping and mismatched addresses, refuse it — and refund in full immediately with an invitation to reorder, because a share of those flags are real customers.
How long do you have to respond to a Shopify chargeback?
Shopify states the evidence-submission deadline is typically 7 to 21 days after the chargeback is filed, with the exact window depending on the card-issuing bank. Treat the 7-day end as your planning assumption and give the task a named owner and a deputy, because a missed deadline is a guaranteed loss.
Does winning a chargeback clear it from your record?
No. Shopify documents that a chargeback counts against your dispute rate whether you win or lose it. You recover the money, not the metric — which is why prevention is worth more than a good dispute response, and why a high volume of disputes is a risk to your payment processing even when you keep winning them.
Does Shopify Protect cover all chargebacks?
No. Shopify documents Fraud Protect for eligible US businesses on Shopify Payments, covering orders it classifies as protected. Orders outside that set, stores on other gateways or in other countries, and disputes that are not card fraud — non-delivery, wrong item, unwanted subscription renewal — are all yours to handle.
Is a third-party fraud app worth it on Shopify?
Only if you will act on what it says. It adds its own risk assessment alongside Shopify’s in the Admin API, with its own supporting facts, which is genuinely more signal — but two scores with no rule for disagreement is worse than one score with a hold on it. Get the manual review habit working first, then buy better signal for it.
NEXT STEP
Free store audit
A senior Shopify engineer reviews your storefront, theme performance and checkout, then sends a prioritised list of fixes.