Fraudulent transactions

[Tanya_Mitra]

Hi, we use Shopify to sell our charity merchandise, and there seems to be a bot attack and several (about 140) transactions processed (status shows paid) that have come in for Friday and Sat.

We obviously haven't fulfilled it and have cancelled the orders on our end. 

We dont want to keep the funds as this is not legitimate charitable income, so we would like to refund all of the payments. Is there a way by which we can confirm that indeed the charity would have received the money. I know we can wait for the payout to our bank account at the end of the month, but that's quite a while from now. 

Thanks, 

Tanya Mitra

Senior Fundraising Manager 

[goldi07 · Accepted solution]

Hello @Tanya_Mitra You're right to be cautious and proactive in responding to this situation. Here's how you can verify whether Shopify has actually received the funds for the fraudulent transactions, and what steps you can take to ensure the funds are refunded properly:

Step 1: Confirm Payment Capture in Shopify
Go to your Shopify Admin → Orders → Click on one of the suspicious orders.

. Check the payment status. If it says "Paid", it means the payment was authorized and captured.

. Scroll down to the Timeline or Order Payment section to see how it was paid (e.g., Shopify Payments, PayPal, etc.) and if any refund or dispute has already been initiated.

Step 2: Verify Shopify Payments Payouts (if using Shopify Payments)
If you're using Shopify Payments, here's how to check whether the funds were actually collected and queued for payout:

1. Go to Settings → Payments → Click “View payouts” under Shopify Payments.

2. You'll see a list of payouts and the status of each one (e.g., Paid, Scheduled, In transit).

3. Check if these fraudulent orders are listed in the upcoming or past payouts.

. If the orders are not listed there, no money will be sent to your bank account for them.

. If they are listed, you can note the exact amounts and timing.

Step 3: Take Action – Refund or Void the Transactions
Now that you’ve confirmed which payments were captured:

. For each Paid order:

. Click into the order.

. Click “Refund” and refund the full amount.

. If the payment is still Authorized (not captured), click “Void” instead, which prevents capture.

Bulk Refunds: Unfortunately, Shopify does not offer a built-in tool for bulk refunding multiple orders. You’ll need to refund each one manually unless you're using a third-party app or script (you can automate this with Shopify API if needed).

Step 4: Contact Shopify Support
Because this appears to be a coordinated bot/fraud attack on a charitable organization, you should contact Shopify Support directly:

. Go to Shopify Support

. Provide:

. Affected Order IDs

. A brief explanation (e.g., charity, bot attack, not legitimate, refunding proactively)

. Request confirmation if Shopify can block or delay payouts for these transactions

They may be able to:

. Freeze suspicious payouts

. Confirm if Shopify Payments is holding or rejecting them

. Help with mitigation (e.g., fraud rules, bot protection)

Step 5: Implement Fraud Protection Measures
To prevent further incidents:

. Enable Shopify’s Fraud Analysis Tools (found in each order).

. Add CAPTCHA or a bot detection app like:

. Shop Protector by Human Presence

. ReCAPTCHA Integration by free or paid apps

. Consider limiting checkout to logged-in users (if appropriate)

. Use Shopify Flow (if on Shopify Plus) or similar automation to flag suspicious orders.

Thank you 😊