Shopify Order Risk: What Low, Medium and High Mean, and When to Ship

Last updated: 2026-10-07 · Platform policies and payment rules change. Verify with official sources before acting.

An order arrives with a warning symbol next to its number, and the Order risk section says Medium. The customer looks ordinary, and you cannot tell whether shipping it is a mistake.

Shopify order risk is Shopify’s estimate of how likely an order is to end in a chargeback because of fraud. The help center explains the levels. It does not price a wrong call in each direction, and Shopify Protect, which changes the decision for many US stores, sits on separate pages. This guide puts that together.

Quick answer

• The risk level is about fraud chargebacks only. Shopify’s fraud recommendation says whether an order has a low, medium, or high risk of a chargeback due to fraud, with a recommended next step on the order.
• Forvendo’s default: ship Low; check Medium first (a short check up to your average order value, the full check above it or if anything is unusual); cancel High unless the customer clears on hard-to-fake signals.
• Check Shopify Protect first. On eligible Shop Pay orders (US stores on Shopify Payments), shipping with tracking from a supported carrier within 7 days, in transit within 10, makes fraud chargebacks reimbursable, fee included. Do not change the shipping address on those orders: that voids coverage.
• A reply from the customer is not proof. In card fraud, the person who placed the order controls its email and phone, and may have the billing address and CVV too. Weigh the signals that are harder to fake.
• Canceling does not make a chargeback impossible. Shopify says the real cardholder’s bank can still file one over the authorization hold.

Who this is for

Stores that ship physical products and see Medium or High orders.

What the Order risk section shows

The Order risk section on an order holds two things, per Shopify’s fraud analysis page:

• Fraud indicators: individual details such as whether the card passed the Address Verification System (AVS) check, whether the CVV was correct, whether the customer’s location matches the payment method, unusual device or network activity, and whether more than one card was tried.
• A fraud recommendation: an overall risk level (low, medium or high) and a recommended next step. Medium and high orders are flagged with a warning symbol on the Orders page.

Whether you see a recommendation depends on:

• Plan and payment provider. Fraud indicators are available on Basic or higher. Fraud recommendations are available on Grow or higher, or if you use Shopify Payments.
• Order type. Shopify lists orders that don’t get a recommendation, including test orders, free orders, orders paid in full with a gift card, Point of Sale orders, B2B orders and subscription renewals.

Shopify says to review the recommendation “instead of deciding whether to fulfill an order from one indicator or the number of indicators.”

What each Shopify order risk level means

The Order risk evaluation view can show one of three next steps: You can fulfill this order, Confirm with the customer before fulfilling, or Consider canceling this order. Shopify’s fraud analysis page does not say which line goes with which level, so read the line on your order. The table is Forvendo’s default.

Check Shopify Protect before you read the risk level

If you are in the United States and use Shopify Payments, orders paid with Shop Pay can be eligible for Shopify Protect. An eligible order shows a Shopify Protect section on the order page, and Shopify’s fraud analysis page says to review that protection status separately from the fraud indicators.

Shopify’s protection status page lists three statuses:

On a protected order, Shopify’s chargeback page for Shopify Protect says a fraudulent or unrecognized chargeback is debited and then immediately reimbursed as a credit, including the chargeback fee, with no action needed from you.

The conditions are strict, from Shopify’s order protection page:

• Physical, shipped items only. An order that includes any digital product, or any item bought online and picked up in store, is not protected.
• Supported carriers, valid tracking, every item. The list includes USPS, UPS, FedEx and DHL Express. Tracking added after the deadline does not count, and all non-refunded line items have to be Fulfilled.
• No address changes. Changing the shipping address after checkout voids coverage for that order.
• Not covered: Shop Pay Installments orders, subscription orders after the first, and chargebacks for reasons other than fraud or an unrecognized charge, such as item not received or not as described.

So for a Shop Pay order showing Shopify Protect, the question becomes “can I ship it, as ordered, with supported-carrier tracking within 7 days?” Filter Orders > Shopify Protect: Protection active daily.

What each wrong call costs

The risk level is a probability, so you will sometimes be wrong. The two mistakes do not cost the same.

Shipping a fraudulent order (not protected). The bank takes the disputed amount back and charges a chargeback fee, which Shopify’s chargeback process page lists as $15 USD in the United States. The product and shipping are gone too. Shopify’s fraud prevention page adds that each chargeback counts toward your chargeback rate “regardless of whether you win or lose the dispute,” and the chargeback process page warns that a high rate can affect your Shopify Payments store status.

Canceling a real customer’s order. You lose the sale. If payment was already captured, you refund it, and Shopify’s canceling page says credit card transaction fees are not returned when you refund. If you capture manually, canceling an uncaptured order voids the payment instead.

Canceling does not end the risk. Shopify’s fraud prevention page notes the authorization hold can still appear on the real cardholder’s statement, and if they report it as unauthorized, their bank can file a chargeback.

Quick ROI test. Work out two numbers for the order:

• A, the extra loss if you ship and it is fraud: product cost + shipping + $15 fee.
• B, the loss if you cancel and it was real: your profit on the order + the card fee you will not get back.

This assumes automatic capture, Shopify’s default: the card fee is lost on a fraudulent order whether you ship or cancel and refund, so it only counts in B. If you capture manually, canceling voids the payment before any fee, so move the card fee from B to A.

Shipping is the better bet while the chance the order is fraud stays below B ÷ (A + B). Shopify does not publish a fraud rate for each level, so that chance is your judgment, informed by the level and your own chargeback history. A high-margin product raises the break-even; a cheap one lowers it, because the fixed $15 fee is large next to a small profit.

Forvendo decision rule

Do not do this yet: do not set up a Shopify Flow rule that cancels every Medium order. It removes the step where real customers get cleared. Tag or hold them for review instead.

If you want time to check orders before money is taken, the Shopify capture payment guide covers manual capture and the 7-day authorization window it starts.

How to check a Medium order

The checks come from Shopify’s fraud prevention page; how to weigh them is Forvendo’s reading. Whoever placed the order controls its email and phone, and stolen card details can include the billing address and CVV. So the harder-to-fake signals are an IP address in the billing area that is not a proxy or hosting company, an email address with a long public history under the billing name, and past orders. AVS, CVV, the phone’s area code (an internet number can carry any) and the call itself are weaker. None is proof alone.

1. Read the full fraud analysis, not one indicator. Note whether AVS and CVV passed and whether several cards were tried.
2. Look up the IP address shown in the Order risk section. Shopify says to contact the customer if it is far from where they claim to be, belongs to a web hosting company, or is a proxy.
3. Map billing and shipping addresses. Addresses on different continents are a warning sign. A different state can simply be a gift; Shopify notes that legitimate shoppers sending a gift or buying for someone else might have different addresses.
4. Check for a pattern. Several orders with different names and billing addresses shipping to the same address is a signal Shopify calls out.
5. Check the phone number against the billing address. Shopify suggests a lookup service such as 411.com to see whether the number’s area code matches the billing address; fraudulent orders often carry invalid numbers.
6. Search the email address for long public use under the same name, or for reports of past fraud.
7. Call the customer on the number on the order. Shopify suggests asking simple questions about the order and judging how they respond: do they know the addresses, phone and name they used? On desktop, a Contact customer action can be available when Shopify recommends investigating; it opens an email draft.

Treat the call as one input, not the verdict. Ship when the harder-to-fake signals (the IP address, the email history, past orders, no suspicious pattern) line up and the weaker ones do not contradict them. Cancel when they do not, or when you cannot reach anyone within a day or two.

Worked example

A composite example, not a real store. A solo store on Basic with Shopify Payments sells leather goods, average order $85.

• Order #2214, $340, Medium risk. AVS passed, CVV passed. Billing in Ohio, shipping to Texas, express shipping selected. The IP address maps to Ohio.
• ROI test: product and shipping cost about $140; the card fee is about $10 in this example. A = $140 + $15 = $155. Profit is about $190, so B = $190 + $10 = $200. Break-even is 200 ÷ 355, about 56%. But $340 is four times the store’s average order and express shipping is unusual, so the owner runs the full check.
• Check: the IP address is in Ohio, near the billing address, and is not a proxy or hosting company. The email address has years of public use under the billing name. Those are the stronger signals. The weaker ones agree: the phone’s area code fits Ohio, and on the phone the customer explains it is a birthday gift for a sibling in Texas.
• Decision: ship. Had the IP address been a proxy or the email address brand new, the other strong signals would have had to carry the order, and the owner would have canceled if they could not.

Order #2219 is paid with Shop Pay, contains only shipped items, and shows Shopify Protect. The owner ships it the same day with UPS tracking, changing nothing on the order; once the carrier has it, the status moves to Protected by Shopify Protect.

Copy-paste: confirmation email

For when the number on the order does not answer. A number supplied in a reply is weaker than the one on the order; check its area code against the billing address.

Subject: Quick check on your order [#2214]

Hi [first name],

Thanks for your order. Before we ship some orders, including this
one, we confirm a few details by phone. Could you reply with a good
number and time to reach you? It takes two minutes.

If we cannot confirm the order by [date], we will cancel it and
refund any payment in full.

[Store name]

Do not ask for card details. If the order shows Shopify Protect, do not use this to change its shipping address: a change after checkout voids coverage.

What this article does not cover

• Responding to a chargeback once it is filed. See the Shopify chargeback and refund SOP.
• Card testing attacks and blocked checkout attempts, covered in Shopify’s fraud prevention guidance.
• Third-party fraud apps, whose assessments show next to Shopify’s.
• Point of sale orders, which do not get a fraud recommendation.

Frequently asked questions

What does order risk mean on Shopify?
It is Shopify’s fraud recommendation: whether an online card order has a low, medium or high risk of a chargeback due to fraud, with a recommended next step, based on machine learning trained on transactions across Shopify stores.

Should I fulfill a medium risk order on Shopify?
Read the next step Shopify shows on the order, then check it. Give the most weight to the IP address (in the billing area, not a proxy), the email address’s public history and past orders; AVS, CVV and a phone call are weaker, because whoever placed the order may hold the card details and controls its email and phone.

Should I cancel every high risk order?
Cancel unless the customer clears on signals that are hard to fake, such as a repeat buyer whose past orders were never disputed. Canceling lowers the risk of a chargeback but does not remove it: the cardholder’s bank can still file one over the authorization hold.

Why do some orders not show a risk level?
Fraud recommendations need the Grow plan or higher, or Shopify Payments, and some order types don’t get one, including test, free, gift-card-only, POS, B2B and subscription renewal orders.

What does Shopify Protect cover?
Fraudulent and unrecognized chargebacks, fee included, on eligible Shop Pay orders of US stores on Shopify Payments that contain only shipped physical items, fulfilled with supported-carrier tracking within 7 days and in transit within 10. An address change after checkout voids it, and item-not-received disputes are not covered.

How much is a chargeback fee on Shopify Payments?
Shopify lists $15 USD for the United States. Its chargeback process page says the fee is returned if you win the chargeback.

Free sheets and calculators

The free Refund and Chargeback Response Kit covers what to do when a dispute does arrive. For the money side of the same orders, see Shopify capture payment and Shopify unfulfilled orders.