Advice Needed for fulfilling a potentially fraudulent order

[eclipsecards]

Hi everyone,

I’m looking for some advice regarding a recent order situation and potential fraud concerns.

A customer placed a high-value order  two days ago. The order came through as low risk on Shopify, and I fulfilled it with Royal Mail Special Delivery 1pm. tracking showed it was delivered (There was also a picture but it is not very clear).

Earlier today, the same customer placed another high-value order, but this time it was flagged as medium risk. The main concern was that the billing address was in the US, and I noticed they used a different card from their first order.

I usually cancel any medium- or high-risk orders automatically, but in this case I decided to call the customer (on the US number they provided). I explained that the order triggered risk flags, especially because of the billing address mismatch. The customer said they had used a different card that was new. I suggested cancelling the order which the could agree too as the intended to place a new order using the same card they’d used for the first order.

They did so, and this third attempt came through as low risk again. While Shopify now rates it as low risk, I’m still cautious because of the earlier medium-risk flag and the change of cards. I’ve had bad experiences before where even with proof of delivery, the bank sided with the customer in a chargeback, so I’m being extra careful.

To be on the safe side lately I have implemented the following 2 factor authentication method on my store described in this Reddit guide:

👉 https://www.reddit.com/r/shopify/comments/16nq45q/a_guide_to_prevent_fraudulent_chargebacks_with/

I contacted the customer to see if they could provide this. The customer provided the code from their bank statement and sent a screenshot as proof. The customer also called back to see if the order was successful this time and to ask about order timelines.

Would you consider this safe to fulfil now, or would you still be wary? Any insights would be appreciated!

Thanks in advance.

[fielde]

Hi eclipsecards,
You're handling this situation with impressive caution — and that’s really wise, especially with high-value orders where chargebacks can be brutal, even with delivery proof.
The steps you've taken (calling the customer, verifying the billing address, and using a 2FA code via bank statement) are strong fraud-prevention moves. It's a good sign that the customer responded proactively and placed the third order using the same card as before.
That said, I’d still suggest keeping an eye on a few things:
Confirm the delivery address hasn't changed at all between the first and latest order.
Double-check if the IP address or browser/device used matches the original (can be found in the order timeline).
If possible, add a signature requirement upon delivery to further protect yourself.

[fielde]

I've worked out other store owners tighten their fraud-prevention workflows, so if you’re looking to strengthen this process or want help setting up more automated risk flags,

[Reuventr]

I’ve been through similar situations—especially when customers switch cards or billing countries between orders. Even if Shopify rates the final attempt as “low risk,” I’d still consider the full context before fulfilling.

In this case, since:

• you spoke to the customer directly,

• they confirmed the code from their bank statement,

• sent a screenshot,

• and followed up actively—
  it sounds like you’ve done more verification than most merchants ever do.

Personally, I would feel comfortable fulfilling the order at this point, especially if the delivery is signature-required and tracked. It would also cover you if a chargeback were to appear.

That said, these cases can be exhausting to manage manually. I actually built a Shopify app called FraudGuard to help with exactly this—
It adds an extra layer of fraud analysis, automatically holds payment for suspicious orders, and sends the right verification flow depending on the risk level (card code, ZIP, ID, etc.). If the order turns out to be fraud and you cancel, you don’t pay any processing fees since it was never captured.

If it sounds useful, we’re currently giving 30 days free + 50% off for early adopters:
https://fraudguard.carrd.co/