Shopify marked fraudulent order as LOW RISK despite multiple failed payment attempts – has anyone else experienced this?

Shopify Discussion
1

Hi everyone,

I’m looking for advice from other Shopify merchants after experiencing a fraudulent order that Shopify’s fraud analysis classified as LOW RISK.

We are a UK online retailer using Shopify Payments.

On 18 August, the customer attempted to make a purchase, but there were multiple unsuccessful/declined payment attempts.

On 19 August, a payment for £108.99 was successfully processed for two electrical products.

When we reviewed the order, Shopify classified it as LOW RISK. There was therefore nothing obvious from Shopify’s overall risk assessment telling us not to fulfil the order.

We dispatched the order using Royal Mail Tracked and have tracking information, delivery confirmation and photographic delivery evidence.

Several days later, we received a fraudulent transaction chargeback.

We challenged the chargeback and supplied our evidence, including proof of delivery. However, the cardholder’s bank rejected our dispute and confirmed that the genuine cardholder did not recognise the transaction. The bank also stated that the name, email address, billing address, shipping address and IP information associated with the transaction did not belong to their cardholder.

We have consequently lost the £108.99 transaction plus a £10 chargeback fee, despite fulfilling an order that Shopify had assessed as Low Risk.

I have since reported the incident to the police/fraud reporting service and have obtained a crime/report reference. I have also contacted Shopify Support about the case.

My main concern is prevention.

Looking back through the information available to us, there were warning signs — particularly the multiple payment attempts before the successful transaction — but the final successful order was nevertheless assessed as Low Risk.

I’d really appreciate hearing from other Shopify merchants:

  • Has anyone had a fraudulent chargeback where Shopify originally classified the order as Low Risk?

  • Do you manually investigate multiple failed payment attempts even when the eventual order is Low Risk?

  • Is there a Shopify Flow you’ve successfully used to detect multiple payment attempts/cards?

  • Do you use manual payment capture?

  • Are there any third-party fraud prevention or chargeback protection apps you would recommend?

  • Is there a way to automatically place an order on hold when several payment methods/cards have been attempted?

  • What additional checks do you now perform before dispatching higher-value orders?

I’m not looking to criticise the chargeback process or the genuine cardholder — I’m trying to understand how another small business can prevent this happening again when Shopify’s overall assessment tells the merchant that the order is Low Risk.

Any advice or experience from other UK Shopify merchants would be greatly appreciated.

Thanks.

2

Sorry you got hit with that. Low Risk is Shopify’s chargeback-risk recommendation from fraud analysis, not a promise the order is safe. The bank still decides the dispute. Shopify’s docs say they aren’t liable for chargebacks and they aren’t involved in the outcome.

Treat the recommendation and the indicators as two different things. On the order, open Order risk and read the full indicator list. Indicators include AVS, CVV, IP details, and whether the customer tried more than one credit card. Those indicators don’t score likelihood. The Low / Medium / High badge does. Multiple failed cards can show in the indicators even when the badge says Low Risk.

Practical native setup:

  1. Settings > Payments > Shopify Payments > Manage > Fraud prevention. You can decline charges that fail AVS postal code or CVV. AVS is off by default on Shopify Payments. Turning it on can also increase false declines.
  2. Switch credit card capture to manual so you can review Order risk before you capture and before you pick/pack.
  3. Shopify Flow with the Order risk analyzed trigger can tag, hold fulfillment, or cancel when risk is high.

Proof of delivery can still lose an unauthorized-use dispute. The durable fix is pausing fulfillment when the pre-order signals look off, not leaning on the Low Risk badge alone.

3

The thing that decided this was probably not the risk badge at all. It was whether the charge carried a 3D Secure authentication.

You are UK on Shopify Payments, so SCA applies. A payment successfully authenticated with 3DS gets a liability shift, and a fraudulent chargeback lands on the issuer instead of on you. The catch is you do not control when it happens. Shopify’s own PSD2 page says Shopify Payments only uses 3D Secure when the issuing bank requires it for the transaction to be authorized. A card the bank waves through without a challenge leaves you fully liable, and there is no setting to force it on.

So worth checking whether that specific order went through 3DS. If it did and you still lost a fraud dispute, that is worth taking back to support with the authentication data, because the shift should have applied.

If it did not, then your evidence lost because it answered a different question than the one being asked. On a fraud reason code the issuer wants to know whether the cardholder authorized the purchase. Tracking, delivery confirmation and a delivery photo prove a parcel arrived somewhere. None of that proves the cardholder ordered it. Under Visa Compelling Evidence 3.0 what actually wins is two earlier undisputed transactions from the same buyer, at least 120 days old and no older than 365, matching the disputed one on at least two data points, and one of those has to be IP address or device ID. A first time buyer has no such history, so that route does not exist, which is why a one off fraud order is close to unwinnable once it ships.

Since the goods went out to an address, did the billing address on the order match where you shipped it? That mismatch is usually the tell on this pattern, and it is also the thing that decides whether the AVS decline setting would have caught it.

6

You are right to be frustrated. A “Low Risk” label naturally gives merchants confidence to fulfil, even though Shopify treats it only as a recommendation.

I would separate two questions here:

  1. Why did Shopify classify the order as Low Risk despite the failed attempts?

  2. Was there actually any evidence capable of winning this particular chargeback?

For an unauthorized-payment dispute, delivery photos and tracking normally prove only that the parcel arrived—not that the genuine cardholder placed the order. The important details are whether 3D Secure/SCA created a liability shift, the precise dispute reason and card network, the AVS/CVV results, whether different cards or identities were tried, and whether there was qualifying previous transaction history. The available evidence routes also differ between Visa and Mastercard.

If you can share redacted screenshots of the payment timeline, fraud indicators and dispute reason code, I’d be happy to look through them and tell you whether the case was realistically unwinnable or whether something important may have been missed. Just remove all customer, address and card information before posting.

7

Multiple declined attempts before a successful payment would make me uncomfortable relying only on the final “Low Risk” label. I’d preserve the failed-attempt timeline, delivery proof and subsequent chargeback together, because the sequence tells a much stronger story than any one signal.

Founder disclosure: I’m building VedaSuite for Shopify around this broader problem — connecting operational/customer signals and surfacing evidence-backed risks or losses that might otherwise stay hidden. Cases like yours are exactly why I think merchants need more context than a single risk score.

If useful, you can see what we’re building at vedasuite.in.

8

Automatic capture is just asking for trouble. You should have a workflow with order created trigger and have several conditions already in place before capture. You should add a workflow with order risk analyzed trigger too.

In the workflow you could possibly put a condition that looks at the actual assessment facts not the low,med,high. Something like order.risk.assessments.facts.description and includes There were

Since “There were” is only used in payment attempt counts, and doesn’t include 1 (There was), there shouldn’t be any false positives.

Then cancel. If capture is manual (or anytime after this) then you won’t incur a transaction fee either.

There are actually quite a lot of conditions you can set to cancel a suspicious order. There are a number of specific addresses and names associated with fraudulent orders, and it’s a good idea to protect yourself before you get hit by them. This forum is full of posts on this subject. Look through them and you’ll see some of the flows I’m talking about.

9

Yes I would add all of that. You can use Shopify Flow for that:

  • use the trigger “Order Created”
  • check billing & shipping address mismatch
  • check if customer order count is 0

I would then send an internal email to check it manual and hold the fulfillment not cancelling automatically.

But you could also automate that with (Disclaimer: I’ve built this app) FraudFalcon.

FraudFalcon does the same idea with a few conditions Flow does not have, like

  • past chargebacks on that customer
  • disposable email domains

And more. We can automatically not just cancel orders after it was done. But also at the checkout level.

In case you’re intersted: :slight_smile:

10

I’d stop treating the final Low Risk badge as the final decision and start flagging the pattern before that, because the repeated declines are often the real warning.

An easy way to do that is to set a manual review rule for orders where the same checkout session has multiple failed attempts. Then check a couple of extra things before capture or dispatch, like whether the billing country, shipping country, and IP line up, whether the email looks real, and whether the order is for a first-time customer buying higher-value items.

If you’re on Shopify Payments, I’d also look at whether the payment was 3D Secure authenticated, because that matters more than the fraud badge when you’re trying to understand who is likely to eat the loss.

If you want to automate part of it, I’d use Flow or a fraud app to tag orders with repeated declines so they land in a review queue instead of going straight out the door.

12

The Low Risk rating does not mean that the order is legitimate, so I would consider it just one signal rather than an approval to fulfill. Several declined attempts should certainly be added to your scrutiny list. Shopify Flow can be used to generate an internal notification or hold workflow when an order meets specific conditions related to the order or payment. For orders of higher value, apply include fraud analysis as well as AVS, CVV, billing and shipping address match and suspicious payment activity prior to shipment. You can also leverage manual capture to help investigate suspicius orders prior to charging the payment.

13

Hi - your case stuck with me: several declined attempts first, then a successful £108.99 payment that Shopify still rated Low Risk. I’m a developer researching how small stores decide what to do with an order like that before fulfilling; I’m not selling anything and have no app. Would you be up for 4 short questions about what you changed after this one?

14

Following up on my earlier reply: I ended up building the tool I described — it holds flagged orders, asks the customer to confirm in one tap, and keeps an evidence file per order. Free beta for 10 stores; details and a 2-min demo in my post on the Shopify Apps board: Looking for 10 stores to beta test a flagged-order verification app (free, feedback wanted)

15

Did you ever find a way to prevent the charebacks?

17

Sorry you went through this. The key distinction here is prevention before fulfillment versus evidence preparation after a dispute opens. Multiple failed payment attempts are a strong reason to hold the order for manual review even when the final Shopify badge says Low Risk. For the existing dispute, delivery proof shows that a parcel arrived, but it does not by itself prove that the cardholder authorized the purchase. A concise response should connect the timeline with AVS/CVV results, 3D Secure status, IP/location signals, the failed attempts, fulfillment records, and any customer communication.

Disclosure: I work on CaseSignal, a free Shopify app built to help merchants review dispute deadlines, identify missing evidence, and prepare a structured draft that the merchant must review and approve. It does not submit evidence automatically and cannot guarantee an outcome. If that workflow would help, you can find CaseSignal in the Shopify App Store. I would also be interested to hear which part of evidence preparation takes you the most time, because that feedback directly shapes the checklist.

18

Multiple failed payment attempts before one finally succeeds are definitely something I’d treat as a warning sign, even if Shopify ultimately labels the order Low Risk.

One thing worth separating here is ordinary fraud from card testing. If someone is repeatedly attempting cards through checkout, ideally you want to stop that behavior before a successful charge ever reaches the payment provider, rather than relying only on the risk rating after an order is created.

We actually built Halt after dealing with repeated card-testing attacks on our own Shopify stores. It blocks suspicious repeat checkout activity before the card is charged, and gives you an activity log showing what was stopped and why.

It’s not general chargeback protection and it wouldn’t guarantee that a fraudulent order like this could never happen. But if those multiple failed attempts are part of a card-testing pattern, that’s specifically what Halt is designed to help stop.

19

I’m seeing the same concern here. “Low risk” doesn’t necessarily mean the order is safe, especially when card testing or coordinated fraud attempts are involved.

If the detailed signals are no longer visible, I’d suggest looking at the activity around the order as well, such as repeated checkout attempts, IP/device patterns, and unusual checkout velocity. Those signals can sometimes reveal what the individual order risk label doesn’t.

We’ve actually been working on this problem with Blockio Card Testing Protection, which monitors suspicious checkout activity and can block repeated/card-testing attempts before they turn into multiple fraudulent orders.

Disclosure: I’m part of the Blockio team. If anyone is dealing with this specifically, here’s the app: Blockio Card Testing Protection

21

We had the exact situation in August. The order was not flagged so we didn’t look at all the credit card info at the bottom. Subsequent orders were flagged and not fulfilled.

When we went back to review the order, the first card that was rejected didn’t show on the first page of the cc details, so we would have missed it anyway.

Regardless, we disputed the chargeback but just this last week were told we lost that dispute.

We went with putting all orders on Manuel Review and that is working for us.
Shopfiy will not take any responsibility for marking the order Low Risk. They did not support us at all in the dispute process.

In our mind, WE are Shopify’s customer..not the person who purchased from us. We were greatly disappointed that they did nothing to support THEIR customer.

22

Low risk is the model saying it did not see the pattern, not a statement that the order is safe. Several declined attempts followed by one that goes through is the shape of a card test.

What the risk view does not show you is anything before payment: how many attempts came from that device, and how the email and shipping address line up with earlier orders. Those are the signals that keep working after the sale.

Practical version: when a dispute or damage claim lands on an order that was marked low risk, walk back through the checkout attempts on it. Repeated attempts from one device with rotating emails is worth a look before you approve a refund, because it changes how much weight the claim photo deserves.

23

Disclosure: I work on a fraud/bot guard app (Estre), so I’ll keep this to what you can do in admin first.

Low Risk is Shopify’s chargeback-risk recommendation, not a green light. Banks still decide unauthorized-use disputes, and proof of delivery answers “did a parcel arrive,” not “did this cardholder authorize the buy.” Several declined attempts before one success is a pattern worth treating as a pause even when the badge stays Low.

Practical setup that matches what you asked for:

  1. Settings → Payments → Manual capture, so you can review before money (and fees) move.
  2. On Shopify Payments → Manage → Fraud prevention, consider declining charges that fail AVS postal code / CVV if that fits your false-decline tolerance (AVS is often off by default).
  3. Open the order’s full risk indicators, not only the badge — multiple cards attempted usually shows there.
  4. Shopify Flow: trigger Order risk analyzed. Add a second path (or separate Flow) that does not rely on High alone — e.g. tag + hold fulfillment when indicators mention multiple payment attempts, or when billing/shipping mismatch + first-time customer + higher AOV. Hold for review rather than auto-cancel if you want to save good customers.
  5. For UK/Shopify Payments, check whether that order completed 3D Secure. Liability shift only applies when authentication happened; many fraud losses are cards that waved through without a challenge.

On “automatically place on hold when several cards were attempted”: Flow can get you most of the way if the attempt text appears in risk facts; otherwise a fraud app that holds for Approve/Block with a plain-language reason is the usual gap fill. Whatever you use, put higher-value first-time orders in a review queue instead of treating Low Risk as fulfillable.

Sorry you took the hit — once it ships on unauthorized use, delivery photos rarely win. The lever is the hold before dispatch.