Shopify "high risk order": what the flag means and what to do

An order comes in, and next to it Shopify shows a red indicator: high risk of fraud detected. The customer paid. The product is sitting in your warehouse. What now?

This guide explains what Shopify's fraud analysis is looking at, how to make the call on a single flagged order, and how to stop making that call by hand. The second half covers OfferGuard's post-purchase rules, which can tag, hold, or cancel an order the moment it comes in, and the card checks you can attach to them.

What Shopify's fraud analysis checks

Shopify runs a fraud analysis on every order paid by credit card through Shopify Payments and on most third-party gateways. Each order gets one of three levels: low, medium, or high. The level comes from a set of indicators shown on the order page.

The indicators

The list varies by order, but these are the ones that appear most often:

• Whether the card's CVV was provided and matched.
• Whether the billing street address and ZIP or postal code matched the card issuer's records (the AVS check).
• Whether the billing address matches the shipping address.
• How far the IP address used to place the order is from the shipping address.
• Whether the IP address is a known proxy or a high-risk location.
• How many payment attempts were made before the order went through.
• Whether the same card or customer has had chargebacks before.
• Whether the email looks disposable or newly created.

None of these alone means fraud. A high-risk level means several indicators pointed the wrong way at once.

Medium risk is the awkward one

Low risk orders you ship. High risk orders you look at. Medium is where most of the wasted time goes: enough indicators fired to make you nervous, not enough to justify a cancellation. Common causes are a customer shipping to a different address than their billing one, a VPN, or a mismatched ZIP code typed on a phone.

How to review a flagged order

Before you cancel anything, work through the order page.

1. Read the indicator list, not just the level. One AVS mismatch and a shipping address across town from the billing address is a gift order. An IP two thousand miles away, a proxy, four payment attempts, and a new email is a different picture.
2. Check the customer's history. Have they ordered before? Did earlier orders ship without a chargeback?
3. Look at what they bought. Fraud clusters around high-resale items, gift cards, and the maximum quantity of whatever is easiest to flip.
4. Contact the customer if the order is large. A short email asking them to confirm the shipping address gets a fast reply from real buyers and silence from the rest.
5. Decide. If you cancel, refund the payment and restock. If you ship, keep the order note trail so you have it if a chargeback arrives later.

Shopify Protect covers chargebacks on eligible Shop Pay orders. For everything else, the decision and the loss are yours.

Where the native flag falls short

Two gaps come up repeatedly.

The first is that the analysis is about the payment, not the person. It can tell you the card looks odd. It cannot tell you this is the same buyer who placed three orders last month under different emails to claim your welcome discount every time. That pattern has a valid card, a matching CVV, and a real address. Fraud analysis will call it low risk.

The second is that the flag is passive. It sits on the order and waits for a human. If your store does fifty orders a day, a morning of flagged orders is a queue, and the ones you don't get to ship anyway when fulfillment picks up the batch.

Both gaps are what post-purchase rules are for.

Post-purchase rules in OfferGuard

OfferGuard's post-purchase rules run when Shopify sends the order-created webhook, seconds after checkout. A rule has a trigger (which products), conditions (what has to be true about the buyer), and actions (what happens to the order).

The three templates

OfferGuard ships three ready-made post-purchase rules. Each one can be edited before it goes live.

Tag repeat buyers adds the order tag repeat-buyer and the customer tag returning when a buyer purchases a guarded product more than once. Nothing is held. This is the filter-in-admin version: you see the pattern, you decide later.

Flag high-risk orders creates a high risk assessment on the order and puts fulfillment on hold with a notification to you. The order stays in your queue with a visible reason until you release it.

Hold for review puts fulfillment on hold and notifies you, without adding a risk assessment. Use this for products where you want eyes on every order regardless.

What each action does

Order tags and customer tags. Tags are added through Shopify's tag mutation on the order and, separately, on the customer record. Tags are the hook for everything else in Shopify: filtered views, reports, and any automation that watches tags.

Risk assessment. OfferGuard writes its own assessment onto the order at the level you choose: high, medium, or low. It appears alongside Shopify's own analysis, with the fact that triggered it, so whoever reviews the order sees why.

Hold fulfillment. The fulfillment order is placed on hold with a reason note you write. Shopify's API requires a hold reason from a fixed list, so the note is where the real explanation goes. Holds are idempotent per rule: the same rule cannot stack duplicate holds on one order. You release the hold from the order page when you are satisfied.

Cancel the order. The strictest action. The order is cancelled with a reason (fraud by default), the payment is refunded or voided depending on whether it has been captured, inventory is restocked, and a staff note records which rule did it. Notifying the customer is optional and off by default.

Order note. Whenever a rule applies any action, OfferGuard writes a note on the order naming the rule and listing what it did. That trail is what you want in hand if a chargeback dispute arrives later.

Unverified checkouts

There is also a store-wide setting for the case where OfferGuard flagged a buyer at checkout but the order still completed, for example a soft warning rule. When it is on, those orders get the tag offerguard-unverified, a high risk assessment, and a fulfillment hold, without needing a separate rule per product.

Card checks that fire after payment

Post-purchase rules can include conditions about the card itself, which is where they overlap most with Shopify's native analysis. These run when the order is created, using the payment details Shopify exposes for the order.

• AVS result required. Fire when the address verification result is anything other than the code you require, for example Y for a full match.
• CVV result required. Fire when the CVV result is anything other than M for match.
• Wallet only. Fire when the order was paid with a plain card rather than Apple Pay, Google Pay, or Shop Pay. Wallet payments come with the wallet provider's own verification.
• Cards per email. Fire when one email has paid with more than a set number of distinct cards inside a window (30 days by default). One buyer cycling cards is a farming signal.
• Emails per card. The reverse: one card appearing across more than a set number of emails. One person, many identities.
• Known card. Fire when the card has been seen at your store before, useful on products that are meant to be bought once.

Card identity is stored as a keyed hash of the card's BIN, last four digits, and cardholder name. OfferGuard never sees or stores the full card number or the CVV.

If a rule has card conditions and none of them fire on an order, the rule's actions are skipped. That keeps a hold-for-review rule from holding every order.

Putting it together

A workable setup for a store that gets a steady trickle of flagged orders:

1. Turn on the unverified-checkout setting so anything OfferGuard warned about at checkout lands in a held queue with a tag.
2. Add "Hold for review" on your two or three highest-resale products, with a CVV-match condition so clean orders on those products still ship on time.
3. Add "Tag repeat buyers" on any product that is meant to be bought once. Review the tag weekly rather than order by order.
4. Reserve auto-cancel for the pattern you have already confirmed is fraud, for example a known card returning to buy a one-time product.

What OfferGuard is not

OfferGuard is not a chargeback guarantee. It does not insure orders or score every transaction with a machine-learning model trained across thousands of stores. If your loss is mainly stolen cards on high-ticket goods, a dedicated payment-fraud vendor is the right tool, and the comparisons with Signifyd and NoFraud spell out where each one fits.

OfferGuard's job is the fraud that passes payment checks: the same buyer coming back under a new identity to claim an offer twice, and the order handling that follows. The features page covers the checkout side of that, and the checkout fraud prevention guide covers the full picture.