A merchant is struggling with Shopify Payments’ fraud detection after receiving high-risk orders lacking billing addresses and postal codes. They’re questioning why the platform accepts such transactions and why fraud analysis provides vague “characteristics” without detailed explanations.
Key Issues Raised:
No billing address provided on suspicious orders
Inability to contact Shopify Payments for transaction verification like traditional banks
Community Response:
Another user clarified that missing billing addresses occur when customers use third-party payment providers (PayPal, Apple Pay, Google Pay) - addresses are verified but not shared with Shopify for security. The real red flag is the web proxy usage, which fraudsters employ to hide their location.
Recommended Solutions:
Use Shopify Flow app to pause high-risk orders for manual approval
Expect fraud attempts in waves with different proxies
Ongoing Concerns:
The merchant remains frustrated about checking addresses without billing data and questions whether fraud protection tools work effectively in New Zealand. They note their bank identified the customer name as a fictional detective character.
Summarized with AI on November 6.
AI used: claude-sonnet-4-5-20250929.
We’re new to fraud but two recent orders were marked high risk. What’s truly suspicious to us, is no billing address or billing postal code.
General Questions…
Why does Shopify payments accept orders without billing addresses?
Why can’t we contact Shopify Payments to get full transaction/CC verification like we can with our bank?
Is Shopify Payments in New Zealand 3D Secure so that if Shopify accepts the transaction, we’re covered for cost of goods?
Is there a fraud-tested phone script with example answers to properly vet people for fraud?
Attached is the fraud analysis…
Was the first red item the name, the card or other specific info that could help us make a quality decision?
With the second line, lots of people use VPNs so I’m not sure that’s high risk these days?
Or is web-proxy something different?
How many pointless AI interactions do we have each day? I had several with the Shopify chat bot in the last hour alone! This makes vague AI recommendations feel untrustworthy so why not have AI break-down ‘Characteristics’ so we can better understand what’s going on here?
Bank help…
Even though it’s not their responsibility, we called our New Zealand bank who pointed out that the name used is a famous fictional detective.
Shouldn’t Shopify have a dedicated fraud department to provide specific info like this because using the term ‘Characteristics’ is super unhelpful - right?
If we do want more dedicated bank transaction help, it seems we have to pay the Shopify transaction fee, in addition to our bank processing - is that correct?
Any help or experiences would be much appreciated. We’re a little baffled at how vague and ‘talk to the hand’ / ‘it’s your fault if it goes wrong’ the Shopify Payments fraud process is sorry. Hopefully we’ve missed something basic here.
Hello, I can clear up the billing address situation. So the reason Shopify doesn’t have this information is because the user is using a 3rd party payment provider such as Paypal, Google Pay, Apple Pay etc. So their address is indeed being checked, the data just is not transferred to Shopify for security. These high fraud risk orders can actually be paused from accepting the payment. This is done with the use of the Flow app. Once a buyer is flagged for high risk it can send you an email to manually approve it or outright cancel it automatically but the actual payment is not accepted until you say yes.
The address being ‘missing’ isn’t the bad part, it is the proxy being of high risk. This proxy they are using is to hide their location. There are all sorts of web proxies you can use and many of them end up getting black listed if they are on a free proxy site. Luckily, this proxy was flagged. What you will want to do now is even if orders aren’t marked as fraud, double check orders anyway. They often happen in waves so I would expect them to come back at a new proxy that isn’t flagged. They are more likely drop shipping the product to their customer and the shipping address used isn’t even their address. Shopify isn’t the actual payment gateway. These gateways used are common 3rd party payment providers. Stipe is the main one for credit cards. The rest are 3rd party. The one that Shopify is actually partners with is SHOP pay. When a customer does use this gateway, they do indeed protect orders not marked as fraud. So in other words, it is probably a good idea to cancel the order if it is marked as high risk and this can be automated.
The things I typically look at:
-Email Address: It is subjective, but often they are emails no one would ever assign for themselves.
-Shipping & Billing not matching but the name is the same: If this is the case I look up the persons information on truepeoplesearch.com and see if I can connect them to the address. They usually have emails + numbers on there that I can try and match up.
-Check if the billing address is available and if it is check to make sure on the list that it matches the address on the card. This is the one area that I truly hate that they don’t check for within many gateways. So for example all that needs to be correct is the zip code but address line 1 could be incorrect. The fraud list that shows up will point this out if it is the case. The part that is annoying is having to manually check this.
-Often products that are targeted are easy to turn over (popular items). I usually pay extra close attention to these items.
I work with a lot of manufacturers so it is all branded products that are constantly targeted. Once you gain experience it almost becomes second nature catching these people.
@beauxbreaux Thanks for the reply very helpful. Some questions sorry…
If no billing address is supplied, how do we check it against the shipping address? It seems this is a huge downside of Shopify Payments - right? Because of the third-party providers, you’re on your own, often without basic but critical info. Or am I missing something here?
We’re in New Zealand and often find services that work great elsewhere, don’t work here. For example, we’re blocked from even visiting truepeoplesearch.com . I see an error: ‘Sorry, you have been blocked. You are unable to access truepeoplesearch.com’.
Not sure I fully understand but are you saying that using a web-proxy is more suspicious than a VPN?
Your note on checking the email address, along with help from the bank (even though they can’t see the transaction) has helped us determine this is most likely fraud so thank you.
