Fraud & chargebacks: the defense your store needs before it needs it.

Nobody budgets for their first chargeback. New merchants plan for ads, inventory, and shipping — then a $340 order ships to a "customer" who paid with someone else's card, and six weeks later the money vanishes from their payouts with a fee attached. Fraud management isn't a Plus-tier problem; it starts with your first sale. The good news: a handful of habits, set up once, absorb most of the damage.

1. The two ways you lose money

Merchants talk about "fraud" as one thing. It's two, and they need different defenses:

• True fraud. A stolen card number is used on your store. The real cardholder eventually sees the charge, disputes it, and their bank claws the money back. You lose the revenue, the product you already shipped, and a chargeback fee your processor charges on top — a triple loss on a single order. You will almost never win these disputes, because the cardholder genuinely didn't buy anything.
• Friendly fraud. A real customer made a real purchase, then disputes it anyway — sometimes cynically ("item not received" while holding the item), often innocently: they didn't recognize the statement descriptor, forgot the order, or disputed because emailing their bank was easier than finding your contact page. These are winnable, but only if you kept evidence.

Here's the part that surprises everyone: the system defaults against you. When a dispute is filed, the money leaves your account immediately, the bank that decides the outcome is the customer's bank, and if you do nothing, you lose automatically. Merchants who don't actively manage fraud don't break even on it — they quietly bleed. Managing it means preventing what you can (sections 2–6) and fighting what you can't (section 7).

2. How card fraud hits Shopify stores

Stolen card numbers circulate in bulk after data breaches, and the people using them behave in recognizable ways. The typical fraudulent order pattern, from the merchant's side of the counter:

• Billing and shipping addresses don't match — often not even the same city or state. The card belongs to someone in one place; the goods need to arrive somewhere the fraudster can collect them, frequently a freight forwarder or reshipping address.
• The fastest shipping available, always. Legitimate customers weigh shipping cost. Someone spending stolen money wants the goods gone before the card gets reported — express shipping on a first order is a consistent tell, especially combined with high order value.
• Disposable or nonsense email addresses. Random strings at free email domains, or a name in the email that doesn't match the name on the order. Real customers usually order with the address they've had for years.
• Multiple attempts in quick succession — several failed payments and then a success, or several orders from the same IP with different cards. That's someone working through a list.

Separately, watch for card-testing attacks: fraudsters use your checkout not to steal from you directly, but to verify which stolen numbers still work — often via small orders or repeated attempts on your cheapest product. The signature is unmistakable when it happens: a sudden spike of small or failed orders, dozens or hundreds in hours, from varied names but clustered IPs, on a store that normally does a handful of orders a day. If you see it, act fast — pause the affected checkout path or product if needed and contact Shopify support — because even declined attempts rack up processing costs and authorization noise, and successful test charges become chargebacks later. Stores running high-velocity models like dropshipping are frequent targets precisely because fast, no-questions fulfillment is the point of the model.

None of these signals alone proves fraud — military families ship to different states, gift buyers rush shipping. The skill is reading them in combination, which is exactly what the next two sections systematize.

3. Shopify's built-in defenses

Shopify runs fraud analysis on every credit card order and shows the results right on the order page — most merchants just never expand the panel. Open any order and look for the fraud analysis section. The indicators worth understanding:

• AVS (Address Verification System) — did the billing address entered at checkout match what the card issuer has on file? A full match is reassuring; a street-number or ZIP mismatch is a flag.
• CVV — was the security code correct? Stolen number lists often lack the CVV, so a failed or absent CVV check matters.
• IP geolocation vs. shipping address — an order placed from an IP thousands of miles from both billing and shipping addresses, or through a known proxy, raises the score.
• Velocity signals — how many payment attempts preceded this order, and whether the same device or IP has been hitting your store repeatedly.

Shopify rolls these into a low / medium / high risk rating. Treat it as triage, not verdict: low-risk orders ship without a second look, medium-risk orders get your manual review process (next section), and high-risk orders get cancelled and refunded unless you can positively verify the buyer. Shopify itself warns against fulfilling high-risk orders, and if you use Shopify Payments, fulfilling them anyway can put your account standing at risk.

Then there's Shopify Protect — genuine free protection, with a narrow scope. On eligible Shop Pay orders in supported regions (it launched US-first; check current availability for your store), Protect covers fraud-based chargebacks and certain unrecognized-payment disputes: Shopify reimburses the order amount and the fee, and handles the dispute. The limits matter: it only applies to orders marked protected at the time of sale, it doesn't cover "product not received" or "not as described" disputes, and the majority of your orders — regular card checkouts, PayPal, wallets other than Shop Pay — sit outside it entirely. Protect is a welcome subsidy, not a strategy. Confirm current eligibility rules and coverage terms in Shopify's documentation, because they've evolved since launch.

4. Your manual review process

For a store doing up to a few dozen orders a day, a two-minute manual review of flagged orders is the highest-ROI fraud tool available, and it's free. The process we run in client stores:

1. Define your review trigger. Every medium- or high-risk flag, plus any order over a value threshold you set (a sensible starting point is two to three times your average order value). First-time customers crossing that threshold get a look even when the risk score is low.
2. Score the order against the checklist. First-time customer + high value + express shipping + billing/shipping mismatch + odd email — count how many are true. One is noise. Two deserves attention. Three or more, and you should not ship without verification.
3. Verify with the customer directly. Email — or better, call the number on the order — with a light touch: "Thanks for your order — it was flagged by our routine security check. Can you confirm the last four digits of the card and the billing ZIP?" Real customers respond quickly and are usually glad you checked. Fraudsters go silent, or the phone number is dead. No response within a business day on a flagged order is itself an answer.
4. When in doubt, cancel and refund proactively. Full refund, polite email, done. This feels painful the first time — you're turning away revenue — but the math is lopsided: cancelling a legitimate order costs you one sale and mild awkwardness; shipping a fraudulent one costs the product, the money, the fee, and a hit to your dispute ratio. Losing one sale always beats eating one chargeback.

5. Fraud apps and when you need them

At some point, manual review stops scaling — the queue eats hours, or a single bad week convinces you to outsource the risk. That's what fraud guarantee apps (NoFraud, Signifyd, and similar) sell: they score every order with their own models, approve or decline in near real time, and — the key part — if an order they approved turns into a fraud chargeback, they reimburse you. They take a fee, typically a percentage of approved order value, and in exchange the fraud risk on approved orders becomes their problem.

Whether that trade is worth it is arithmetic, not ideology:

• The cost side: their percentage fee across all your approved orders — you pay it on the 99% of orders that were never fraudulent.
• The benefit side: chargebacks reimbursed, review hours returned, and — often underrated — revenue recovered from good orders you'd have nervously cancelled. Their models see network-wide data yours can't, so they confidently approve edge cases you'd decline.

The break-even is driven by volume and average order value. A store doing thirty orders a day at a $40 AOV with one chargeback a quarter is paying a guarantee app far more than DIY review costs — keep the checklist. A store doing three hundred orders a day, or selling $800 electronics where a single fraud loss erases a week's margin, usually comes out ahead handing it off. High-AOV, high-resale-value categories (electronics, sneakers, jewelry, gift cards) attract disproportionate fraud and hit the break-even much sooner. Run your own numbers for a month of orders before committing, and re-run them as you grow — this is a decision that expires.

6. Preventing friendly fraud

Friendly fraud is the category you can genuinely shrink, because much of it isn't malice — it's confusion and friction. Every fix below removes a reason for a real customer to dispute:

• Fix your statement descriptor. The single cheapest fix in this guide. If a customer's card statement says a corporate entity name instead of your store name, some fraction of them will not recognize the charge and dispute it. Set the descriptor to match your storefront name — in Shopify Payments settings, or with your gateway.
• Delivery confirmation, always; signature above a threshold. Tracking with delivery confirmation is your core evidence against "item not received." Above a value you choose — where the loss would genuinely hurt — require a signature. It costs a little and closes the "it never arrived" dispute almost completely.
• Photograph high-value orders as you pack them. Thirty seconds per order: contents visible, shipping label in frame. When a dispute claims an empty box or the wrong item, a timestamped photo is disproportionately persuasive evidence.
• Make contacting you easier than contacting their bank. This is the big one. A large share of disputes are customers who wanted a refund, couldn't quickly find how to get one, and went to their bank instead. Visible contact page, replies within a business day, and a clear, honest refund policy linked in the footer and at checkout. Every refund you grant directly is a dispute that never happens — a refund costs you the money; a dispute costs the money plus the fee plus the ratio damage.
• Email before customers get nervous. Shipping delay? Say so proactively, with a new ETA. Pre-order or made-to-order timeline? Repeat it in the confirmation email. Silence between "order confirmed" and a late delivery is where "item not received" disputes incubate.

7. Fighting a chargeback

When a dispute lands despite everything, here's the shape of the fight. The customer's bank files the dispute; the disputed amount (and a fee) comes out of your payouts immediately; you get a window — often measured in a couple of weeks, and the deadline is hard — to submit evidence through Shopify's dispute interface. Shopify Payments pre-fills some of the response; your job is to strengthen it. Then the customer's bank reviews and decides, which can take weeks to a few months. Exact timelines and fees vary by card network and processor — confirm current rules with your processor.

Evidence that actually moves bank reviewers, roughly in order of weight:

• AVS and CVV match results — strongest available proof the real cardholder placed the order.
• Tracking with delivery confirmation — ideally to the billing address, with signature if you have it. This is the whole case in "item not received" disputes.
• Customer communication — emails or chats where they confirm the order, discuss delivery, or ask questions after receiving it. Post-delivery messages are devastating to an "unauthorized" claim.
• IP and device data — order placed from the customer's home city, or from a device/IP that matches their previous legitimate orders.
• Prior order history — same card, same address, no prior disputes. Repeat customers claiming "unauthorized" on order five are a hard story for a bank to buy.
• Policy acceptance — your refund and terms were presented at checkout, with your policy text included in the response. This matters most in "not as described" and cancellation disputes.

Set expectations honestly: the deciding bank serves the cardholder, and ties go to their customer, not you. Strong evidence wins real friendly-fraud cases; true-fraud cases are usually lost regardless. Respond to every dispute anyway — a non-response is a guaranteed loss, the discipline of compiling evidence exposes weak spots in your own process, and a paper trail of contested disputes matters if the same customer tries it twice. Write your evidence like the reviewer will spend ninety seconds on it, because they might: lead with the strongest facts, one page, no indignation.

8. Chargeback thresholds and staying processable

Individual chargebacks cost money. A high chargeback ratio can cost you the ability to take payments at all — which is the actual existential risk in this guide. Card networks run merchant monitoring programs that flag accounts whose dispute rates climb toward roughly 0.9–1% of transactions (each network defines its own thresholds and counting rules — confirm the current numbers with your processor). Cross into those programs and the consequences escalate: mandatory remediation, fines, rolling reserves held against your payouts, and ultimately termination of processing. A merchant who can't process cards doesn't have a conversion problem; they don't have a store.

Three implications for how you operate:

• Prevention beats fighting, structurally. A chargeback you win still counts against your ratio in most programs' math. The sections above on screening orders and heading off friendly fraud aren't just about the money per incident — they're what keeps the ratio down.
• Track it monthly. Disputes received divided by orders processed, on a simple spreadsheet or dashboard. Healthy stores sit far below the danger zone — well under a tenth of the threshold. If your ratio doubles month over month, investigate now, at whatever absolute level: a product with misleading expectations, a shipping partner losing packages, or a fraud ring that found you.
• Refunds are ratio insurance. When a transaction is heading toward a dispute — angry customer, credible fraud suspicion — refunding first costs the revenue but keeps the event off your dispute record entirely. Used judiciously, it's the cheapest ratio management there is.

This monitoring discipline is standard store operations — the same monthly rhythm as inventory counts and finance reconciliation, and it belongs on the calendar with them.

9. Hardening checklist

If you're setting up a store from scratch, fold these into launch week alongside the rest of the store setup sequence — it's far easier to build the habits before order volume arrives than to retrofit them after the first bad month.

FAQ

Should I fulfill an order Shopify flags as high risk?

No. Cancel and refund. High risk means multiple indicators fired together, and if it's a stolen card you lose the product, the money, and a fee — with near-zero chance of winning the dispute. If you truly believe it's legitimate, verify with the customer by phone before shipping; otherwise the default is don't ship. One lost sale beats one chargeback, every time.

Does Shopify cover chargebacks?

Only orders covered by Shopify Protect — eligible Shop Pay orders in supported regions, protected against fraud-based and certain unrecognized-charge disputes. Everything else is on you: Shopify passes the dispute through, you submit evidence, the customer's bank decides. Check Shopify's docs for current Protect availability and terms in your region.

Can I actually win a dispute?

Friendly-fraud disputes with strong evidence — AVS/CVV matches, delivery confirmation, customer communication, order history — are genuinely winnable. True stolen-card disputes usually aren't, since the cardholder really didn't buy. Banks lean toward their customer, so treat wins as earned, not expected — and respond to every dispute regardless, because silence is an automatic loss.

What does a chargeback actually cost?

The product, the revenue, the original processing fee, a chargeback fee from your processor (typically charged win or lose — confirm yours), and the evidence-gathering time. Plus the quiet cost: every dispute feeds the ratio that card-network monitoring programs watch, and ratios approaching roughly one percent of transactions threaten your processing itself.