3DS Fraud Workflow

[JmBurge1]

Hello, we're exploring a workflow for a client in their Fraud Management process and was wondering if it was possible for Shopify to handle the following workflow:

1. The customer submits their order
2. Card is Authorized:
1. Failed: Order does not proceed
2. Successful: Funds are held
3. The order, including payment details, is risk screened by Fraud
4. The outcome of the risk assessment may be: ACCEPT/REJECT/3DS
1. ACCEPT: held funds are taken, merchant fulfills the order.
2. REJECT: funds are released, and the order is not fulfilled.
3. 3DS: transactions are escalated to 3DS:
5.       If the challenge is successful, held funds are taken, merchant fulfills the order.
6.       If the challenge is unsuccessful, funds are released, and the order is not fulfilled.

Has anyone built this workflow?

Thank you!

[dylanpierce]

Hi @JmBurge1 

Great question. So let me clear up some misconceptions first.

1. The payment authorization happens before the order is submitted. Other platforms like WooCommerce are the opposite, but in Shopify the payment needs to be authorized before the order is created.

Fraud screening is provided by Shopify's internal Risk Analysis system, which analyzes the order, which again is after payment authorization. You can build workflows with Shopify Flow based on the risk level of a given order.

The available tiers of risk are currently:

• Low
• Medium
• High

There's not a 3DS flag within Shopify Order Risk Analysis. That would be at the payment gateway level.

I assume you're using Shopify Payments, but if you're using another payment gateway please let me know. If that's the case, then here's the closest workflow you can get to what you're aiming to achieve.

1. Switch to manual payment capture

2. Create a Shopify Flow workflow (here's a free workflow you can download) that will hold fulfillment on medium and/or high risk orders

3. (Optional) In the same workflow, create a branch that will automatically capture payment on low risk orders

That way if an order is high risk, you have the ability to verify customer details before capturing payment. The payment is still authorized on the customers credit card, but it won't actually charge until your staff have verified the customer's details.

You may be asking - but how do I trigger 3DS in Shopify? The answer that I've gathered is that you can't explicitly do this. It's a feature that's per bank, not at the eCommerce platform level. It would help to know which market you're servicing, here in the U.S. I don't believe Shopify Payments supports 3DS what so ever.

But unfortunately I can't double check, their help article on 3DS is blocked for me: https://help.shopify.com/en/manual/payments/shopify-payments/faq

[francis_leung21]

This is also the reason why we stop using shopify payment. I have no idea why they didnt set 3DS triggered. Money is collected, but all the risk are beared by the store