Can one red flag alone prove an order is fraudulent?

Almost never. A single signal such as a mismatched billing and shipping address is common in legitimate gift orders. Fraud becomes likely when three or more independent signals appear on the same order, which is why scoring beats hard blocking.

What should I do with an order I am unsure about?

Do not cancel it. Hold fulfilment and ask the customer to verify — a verification email that confirms they control the checkout address, plus an ID check on the highest-value orders, resolves most cases within hours.

Are high-value orders always the risky ones?

No. Fraudsters frequently place a small test order first to confirm a stolen card works. Low-value orders from a brand-new customer on an untried card deserve attention too.

How to spot a fraudulent Shopify order: 12 red flags before you ship

Payment approval is not fraud approval. These are the order-level signals worth checking before a package leaves your warehouse — and what to do with each one.

Why manual review still matters

Payment gateways approve stolen cards every day. An authorisation only proves the card has funds and has not been reported yet — it says nothing about whether the person typing the number owns it. By the time the real cardholder notices, your product has shipped and the chargeback is already on its way.

The window you control is between order placement and fulfilment. These twelve signals are the ones that pay for the time you spend looking.

The 12 red flags

Billing and shipping addresses in different countries, or a shipping address that is a freight forwarder or mail drop.
A brand-new customer placing an unusually large first order with no browsing history.
A disposable or randomly generated email address (long strings of digits, throwaway domains).
The phone number's country code does not match the billing or shipping country — or the field was left blank on a high-value order.
Checkout completed in seconds: card details pasted rather than typed usually means autofill from a dump.
Several failed payment attempts followed by a success — classic card testing.
Multiple orders in a short window using different cards but the same shipping address or device.
An IP address from a VPN, proxy, or data centre, or one thousands of kilometres from the billing address.
Expedited or overnight shipping chosen on a low-margin item where the shipping fee exceeds normal behaviour.
Orders placed at odd local hours for the customer's stated country, repeatedly.
High quantities of a single easily resold SKU — electronics, sneakers, gift cards.
The customer contacts support before shipping to push for faster dispatch or to change the delivery address.

Score, don't block

Blocking on any single rule costs you real revenue. A traveller on hotel Wi-Fi buying a gift for their parents trips three of the flags above and is completely legitimate.

Combine the signals into one score per order instead. Low scores fulfil automatically, medium scores get a verification email, and only the highest scores wait for an ID check or a manual decision. That way the friction lands on the small slice of orders that earns it.

A workflow you can run every day

Score every order automatically the moment it is created, not when someone remembers to look.
Send an alert to the person who packs orders, so risky orders are held before the label is printed.
Ask medium-risk customers to confirm their identity by email; ship the moment they do.
Require a government-issued document on the highest-risk, highest-value orders.
Keep the verification record — it is the strongest evidence you can submit if a dispute still arrives.

Frequently asked questions

Can one red flag alone prove an order is fraudulent?: Almost never. A single signal such as a mismatched billing and shipping address is common in legitimate gift orders. Fraud becomes likely when three or more independent signals appear on the same order, which is why scoring beats hard blocking.
What should I do with an order I am unsure about?: Do not cancel it. Hold fulfilment and ask the customer to verify — a verification email that confirms they control the checkout address, plus an ID check on the highest-value orders, resolves most cases within hours.
Are high-value orders always the risky ones?: No. Fraudsters frequently place a small test order first to confirm a stolen card works. Low-value orders from a brand-new customer on an untried card deserve attention too.