Fraud prevention on Shopify: fraud analysis and 3D Secure

A large order arrives from a new customer, shipped to a different address. Ship it and hope, or stop and check? Good fraud prevention on Shopify is a few cheap checks, applied before fulfilment. Here are the tools, their limits and a routine.

Fraud prevention on Shopify starts with fraud analysis, which rates orders low, medium or high risk, and with 3D Secure, which NAB says shifts fraud liability. Neither covers everything: fraud analysis does not cover bank charge reversals, and Shopify's 3D Secure status in Australia is unconfirmed. Add manual review and clear records.

This guide to fraud prevention on Shopify is for you if:

You sell to Australian customers and want fewer fraudulent and unrecognised charge disputes.
You have seen a medium or high risk flag and are not sure what to do with it.
You want to know what 3D Secure does and whether you can rely on it.

Last updated: 10 October 2026. Written by the ChargeFix team. Reviewed against sources on 10 October 2026.

The 30-second answer (TL;DR)

Shopify's fraud analysis rates orders low, medium or high risk. Fraud indicators need the Basic plan or higher, and recommendations need Grow or higher, or Shopify Payments.

Shopify says fraud analysis does not cover bank charge reversals. It is a review tool, not a guarantee against chargebacks.

Shopify's address verification advice is written for the US, UK and Canada, not Australia, so do not build an Australian routine on it.

NAB's merchant guide says 3D Secure shifts fraud liability, and that manual key entry is card-not-present with merchant liability. We could not confirm how 3D Secure works on Shopify in Australia, so check your own settings and ask Shopify Support.

Fraudulent is one of eight Shopify dispute reasons. Visa and Amex "Fraudulent" disputes have no early resolution, so prevention matters more than the response.

The most useful habit is small: review medium and high risk orders before you fulfil, and keep a dated record of what you checked.

Quick note: Shopify's help pages do not publish fraud scoring rules, the thresholds behind low, medium and high, or an Australian 3D Secure rate or setting we could verify. This guide does not invent any. Never treat a customer as a fraudster because of a flag alone: a flag is a reason to check, not a conclusion.

Fraud prevention on Shopify at a glance

Tool or step	What it does	Limit
Fraud analysis	Rates orders low, medium or high risk	Does not cover bank charge reversals
Fraud indicators	Show what drove the rating	Need the Basic plan or higher
Recommendations	Suggest what to do with an order	Need Grow or higher, or Shopify Payments
Address verification	Compares billing details with the card	Shopify's advice covers the US, UK and Canada, not Australia
3D Secure	Extra card authentication	Shopify availability in Australia unconfirmed
Manual review	You check the order before fulfilling	Takes time, so target it

What does fraud prevention on Shopify actually cover?

It covers the checking you do before an order ships: reading the risk rating, looking at the indicators, contacting the customer if something looks odd and deciding whether to fulfil. It does not cover disputes after the event. Shopify says fraud analysis does not cover bank charge reversals, which is the term for chargebacks.

That distinction shapes everything else. A low risk rating does not stop a customer disputing an order later, and a high risk rating does not prove anything about the customer. Fraud prevention on Shopify reduces the number of orders you fulfil blind. It does not replace evidence, and it does not replace a clear descriptor, a good delivery record and quick customer service. Our post on how chargebacks work in Australia puts the dispute process in context.

What is the difference between fraud and a disputed genuine order?

Fraud means someone used a card without the cardholder's permission. A disputed genuine order means the cardholder placed the order, or a family member did, and later disputed it. Shopify's friendly fraud blog (19 June 2024) describes a customer who makes a purchase and later requests a chargeback, with three causes: accidental, chargeback fraud and refund abuse. The reason on the dispute may say fraudulent either way.

We cannot tell you which you are facing from a flag, and you should not guess. Our guide to friendly fraud in Australia explains how to word things without accusing anyone.

Why do fraudulent disputes matter more than most?

Shopify's resolve page says there is no early resolution for Amex or Visa "Fraudulent" disputes, so a withdrawal by the cardholder cannot shorten them. The response window is usually 7 to 21 days, and the bank decides up to 75 days after you submit, with no appeal. Because the money is taken at once, prevention is far cheaper than any response.

How does Shopify fraud analysis work?

Shopify rates each order low, medium or high risk and, on eligible plans, shows indicators that explain the rating. Recommendations suggest what to do. Shopify does not publish the scoring rules, so treat the rating as a prompt to look closer, not a verdict.

Feature	What it gives you	What you need
Risk level	Low, medium or high on each order	Fraud analysis available on your store
Fraud indicators	The signals behind the rating	Basic plan or higher
Recommendations	Suggested next action	Grow or higher, or Shopify Payments
Bank charge reversal cover	Not provided	Not applicable

The plan names matter only because they decide what you can see. This guide does not quote plan prices. Check your own plan in Shopify admin to see what your store shows.

What should you do with a medium or high risk order?

Pause fulfilment, look at the indicators, check the order against what you know and contact the customer if something needs explaining. Then decide to fulfil, ask for more information or cancel and refund. Keep a dated note of each step. Shopify's evidence guidance says to put the strongest proof first, so a record of your checks can become part of a later response.

MEDIUM OR HIGH RISK ORDER: REVIEW ROUTINE
[ ] Note the order number, total, risk level and the time you looked
[ ] Read the fraud indicators and recommendation, if your plan shows them
[ ] Compare billing and shipping addresses, and note why they differ
[ ] Check whether the customer has prior orders or disputes with you
[ ] Look at the order contents: unusual quantity, high value, resale items
[ ] If anything is unclear, email the customer a neutral question
[ ] Record the reply, or the lack of one, with a date
[ ] Decide: fulfil / ask for more information / cancel and refund
[ ] Save the decision and the reason in the order notes

What neutral question can you send?

Ask something a genuine customer can answer easily, such as the name on the card, a phone number for the delivery or confirmation of the delivery address. Do not say you suspect fraud. A genuine customer will usually reply, and the reply is evidence if you need it.

Subject: A quick check on your order #[number]

Hello [name],

Thank you for your order. Because the delivery address is different from
the billing address, we like to confirm a couple of details before we
dispatch.

Could you please confirm:
1. The delivery address is correct: [address]
2. A phone number we can give the carrier: [number]

We will dispatch as soon as we hear back. If you would prefer to cancel,
just reply and we will refund the full amount straight away.

Regards,
[Store name]

What should you know about 3D Secure and Australian stores?

NAB's merchant guide says 3D Secure shifts fraud liability, and that manual key entry is card-not-present, with the merchant liable. That is the main reason merchants care about it. What we could not confirm is whether, and how, Shopify applies 3D Secure to Australian Shopify Payments transactions.

We found no current Shopify page that confirms 3D Secure behaviour or settings for Australia, and the one dated reference we saw is a 2022 changelog, which we have not used because it is old. So the honest position is: check your payment settings, read what your store shows, and ask Shopify Support in writing whether 3D Secure is applied to your Australian transactions and what it means for fraud disputes.

Question	What NAB's guide says	What we could not confirm
Does 3D Secure shift fraud liability?	Yes	How it applies on Shopify in Australia
Who is liable for manual key entry?	The merchant	Whether you take manual orders
Is it automatic?	Not stated	Shopify's default setting for Australia
Does it cover every dispute reason?	Not stated	Whether it affects non-fraud reasons

Does 3D Secure stop all disputes?

No. NAB's guide describes a shift in fraud liability, which relates to fraud disputes. It does not stop a customer disputing a parcel that never arrived, a product that was not as described or a refund they did not receive. For those, your delivery proof, listing accuracy and refund records matter. Our posts on item not received disputes and Australia Post and dropshipping chargebacks in Australia cover those.

What about address verification in fraud prevention?

Shopify's address verification guidance is written for the US, UK and Canada, and Australia is not named. So do not assume that a match or mismatch signal works the same way for Australian cards. Compare the billing and shipping addresses yourself, and treat the result as one input.

How do you decide whether to fulfil, check or cancel?

Weigh the cost of a wrong decision on each side. Cancelling a genuine order loses a sale. Fulfilling a fraudulent one can lose the goods, the postage, the amount and the fee. A short check costs minutes. The arithmetic below shows why a review before you ship is usually the cheapest step.

Illustration: one flagged order, three outcomes. An order totals A$329.00, including A$14.00 shipping. The goods cost you A$142.00 and postage costs A$14.00, so A$156.00 leaves your business if you fulfil. At the standard online card rate of 1.7% plus 30 cents for the Basic plan, processing is A$5.89 (1.7% of A$329.00 is A$5.59, plus 30 cents). The dispute fee is the reported A$25.00, which is also NAB's own merchant fee, and Shopify's own amount is unconfirmed. We assume the processing fee is not returned in any outcome, because Shopify's pages do not say.

Line	Cancel and refund before shipping	Ship, then lose a fraud dispute	Ship, then win or no dispute
Customer paid	A$329.00	A$329.00	A$329.00
Refunded or taken back	minus A$329.00	minus A$329.00	A$0.00
Dispute fee	A$0.00	minus A$25.00	A$0.00 if returned
Goods and postage	A$0.00	minus A$156.00	minus A$156.00
Processing fee	minus A$5.89	minus A$5.89	minus A$5.89
Net result	minus A$5.89	minus A$186.89	A$167.11

The lost case works out as A$329.00 less A$329.00, which is zero, less A$25.00 gives minus A$25.00, less A$156.00 gives minus A$181.00, less A$5.89 gives minus A$186.89. The good case is A$329.00 less A$156.00 less A$5.89, which is A$167.11. Cancelling costs A$5.89, which is the price of a wrong call on a genuine order if you also lose the sale margin of A$167.11. So a review is worth doing when the chance of a loss times A$186.89 is higher than the margin you would give up. We do not know that chance for your store, and Shopify gives no figure, so use your own history.

When is a review not worth the time?

For low-value orders with a low risk rating, a full review costs more than the likely loss. Set a threshold that suits your margins, and review everything above it that is rated medium or high. Revisit the threshold quarterly using your own dispute data. We found no benchmark worth quoting, so your numbers are the benchmark.

Should you ever refuse an order on a flag alone?

Be careful. A flag is a prompt to check, not proof. If you cannot get a reasonable answer to a neutral question, cancelling and refunding in full is a legitimate commercial decision, and it keeps the record clean. Do not say or imply that the customer is a fraudster, and do not post suspicions anywhere.

How do you build a fraud prevention on Shopify routine that fits a small team?

Keep it short, written down and tied to a threshold. A routine that one person can run in a few minutes a day will be used. A long one will not. The aim of fraud prevention on Shopify is not to catch every case, but to make the expensive mistakes rare.

Step	Who	When
Check the risk level on new orders	Whoever fulfils	Before packing
Review medium and high orders against the routine	Owner or senior staff	Same day
Send the neutral question where needed	Customer service	Same day
Record the decision and reason in order notes	The reviewer	At decision
Review the month's disputes and flags	Owner	Monthly
Adjust the threshold	Owner	Quarterly

What records should you keep for fraud prevention on Shopify?

Keep the order, the risk level, your notes, the customer's replies and the delivery proof. If a fraudulent dispute arrives, those are the building blocks of a response. Shopify auto-includes order details, addresses, IP, fulfilment and tracking, refunds, and prior orders and disputes. You add messages, policies, delivery photos and access logs.

Record	What it shows	Where it comes from
Risk level and indicators	What you saw at the time	Shopify order page, screenshot it
Your review note	That you checked and why you decided	Order notes
Customer replies	That a real person engaged	Email thread
Delivery proof	Where and when it was delivered	Carrier record
Policy screenshot	Terms shown at checkout	Your store
Prior orders	A history of genuine purchases	Auto-included

The format rules matter. Shopify accepts PDF, JPEG or PNG, up to 2 MB per file and 4 MB in total, one file per evidence type. It does not accept links, audio or video, so use screenshots. Our guide to evidence to save at fulfilment lists what to save and when, and the chargeback evidence checklist puts it in one place.

How should you set a review threshold for fraud prevention on Shopify?

Pick an order value above which every medium or high risk order gets a human look, and below which you accept the risk. Fraud prevention on Shopify works best when the threshold is written down, because then the decision does not depend on who is packing orders that day. Review the number every quarter, using your own flags and disputes.

Order value	Low risk	Medium risk	High risk
Under your threshold	Fulfil	Fulfil, note the flag	Quick check, then fulfil or ask
Over your threshold	Fulfil	Full review routine	Full review routine, neutral question first

The table is a starting layout, not a rule from Shopify, which publishes no thresholds. Move the line to suit your margins and your history.

Illustration: the cost of a review routine. A store takes 200 orders in a month, and 12 of them are rated medium or high risk. A review takes about 10 minutes each, so the routine costs 120 minutes, or 2 hours. If you value your time at A$35 an hour, which is an assumption, that is A$70.00 a month. One lost fraud dispute on a similar order cost A$186.89 in our example above. So the routine pays for itself if it prevents one such loss every three months or so (A$186.89 divided by A$70.00 is about 2.7 months). If your orders are smaller, your break-even is longer, and you should raise the threshold.

How do you measure whether fraud prevention on Shopify is working?

Track four numbers each month: how many orders were flagged medium or high, how many you reviewed, how many you cancelled and how many fraud or unrecognised disputes you received. If disputes fall and cancellations stay low, the routine is working. If disputes stay flat while reviews rise, change what you check. Shopify gives no benchmark, so compare month with month in your own store.

Measure	What it tells you	Where to find it
Flagged orders	How much work the routine creates	Orders list, risk filter
Reviewed orders	Whether the routine is being followed	Your order notes
Cancelled after review	How often a check ends the sale	Orders list
Fraud and unrecognised disputes	Whether prevention is reaching the bank stage	Settings, Payments or Analytics, Reports

Does fraud prevention on Shopify change by sale season?

Volume changes it. In busy weeks, such as Click Frenzy on 12 November, Black Friday on 27 November and Cyber Monday on 30 November 2026, there are more orders to check and less time to check them. A lighter routine that still covers the highest-value flagged orders is better than a full routine that gets skipped. Our guide to Click Frenzy and Black Friday chargebacks covers the seasonal side.

What happens when a fraudulent dispute arrives anyway?

You respond by the due date with the best evidence you have. Shopify's pages say the response window is usually 7 to 21 days, the due date uses your store time zone and is 11:59 PM if no time is shown, and evidence is editable until the due date but not after "Submit now". Shopify submits on the due date even with no evidence.

Illustration: a fraudulent dispute with dates. An order is placed on Wednesday 21 October 2026. It is fulfilled on Friday 23 October. A dispute with the reason fraudulent arrives on Monday 9 November 2026. Assuming a 21-day window, the evidence is due Monday 30 November 2026. You submit on Friday 20 November, and the latest decision is 75 days later, on Wednesday 3 February 2027.

Date	Event	Notes
Wed 21 Oct 2026	Order placed; flagged medium risk	Review note and customer reply saved
Fri 23 Oct 2026	Order fulfilled	Tracking and delivery proof saved
Mon 9 Nov 2026	Dispute opened, reason fraudulent	Amount and fee taken at once
Fri 20 Nov 2026	Evidence submitted	Cannot be edited after "Submit now"
Mon 30 Nov 2026	Due date, assuming 21 days	Shopify submits on the due date even with no evidence
Wed 3 Feb 2027	Latest bank decision	No appeal; a win can be re-disputed

The 75 days run from Friday 20 November 2026 to Wednesday 3 February 2027. We could not confirm how weekends and public holidays affect due dates, so submit early. Cash planning matters, so see negative balance after a chargeback. The guides to responding to a Shopify Payments dispute and accepting or fighting a dispute cover the rest.

How long can a cardholder wait before disputing?

NAB's guide gives cardholders 120 days for Visa and Mastercard, varying by reason code, and 210 days for eftpos. For the order above, 120 days after 21 October 2026 is Thursday 18 February 2027 and 210 days is Wednesday 19 May 2027, if the count runs from the order date. The start point differs between schemes and reason codes, so treat those dates as the order of magnitude, not a promise. Our guide to chargeback time limits in Australia explains the clocks.

Where does the ePayments Code fit?

ASIC's ePayments Code is voluntary, excludes business-purpose facilities and sets how banks treat customers in unauthorised transaction cases. It says the holder is not liable for fraud or negligence by a merchant, and that a bank need not use chargeback rights. It is about the customer and their bank, not you, but it shapes why banks often side with cardholders on genuine unauthorised use. See the ePayments Code and unauthorised transactions.

Which other fraud prevention habits reduce fraudulent and unrecognised charge disputes?

Make your store recognisable, deliver with proof and respond fast to customers. Shopify lists unrecognized as its own dispute reason, so a clear store name on the statement and a prompt order confirmation email reduce the chance a genuine customer fails to recognise you.

Habit	Reason it helps
Send an order confirmation with your store name	The customer can match the charge
Use tracked shipping and keep proof of delivery	Strong evidence if challenged
Be careful with authority-to-leave and safe-place delivery	Weaker proof of who received it
Answer customer messages quickly	AFCA tells customers to contact the merchant first
Refund quickly when a refund is owed	Avoids a dispute over an unprocessed credit
Keep your dispute rate low	A high rate can lead to a notification, a reserve and monitoring

Our posts on authority to leave and safe place delivery and wrong address chargebacks explain where delivery proof is thin. For the rate, see chargeback rate and account health warnings.

What's different for Australian merchants?

Shopify's address verification guidance does not name Australia. Shopify's 3D Secure position for Australian stores is unconfirmed. Cardholders have long dispute windows. And the A$ dispute fee is not published on the pages we read. Together these mean you should build your routine on the checks you can see and prove.

Debit and credit. Both can be disputed, and eftpos is Australia's local debit scheme, co-badged with Visa, Mastercard or UnionPay. See debit vs credit card chargebacks.
Banks. NAB debits after 10 calendar days for fraud disputes and 24 for non-fraud, in its own merchant facility. The guide does not describe Shopify Payments.
Fees. The pricing page lists card rates, with no dispute fee. The Australian terms allow a separate investigation or mediation fee on notice, with no amount.
Provider. The Australian terms name Shopify Commerce Singapore Pte. Ltd., with Singapore as governing law and venue.
Payout calendar. The Australian minimum is 2 business days, with no payouts on weekends or public holidays. In 2026, Click Frenzy is on 12 November, Black Friday on 27 November, Cyber Monday on 30 November and Christmas Day on Friday 25 December, so busy weeks need a firmer routine.

What are the most common mistakes in fraud prevention on Shopify?

Relying on the rating alone is the first. The second is treating a low rating as safe, and the third is accusing a customer. After those come ignoring the process on busy days and keeping no record of the review.

Treating the rating as a verdict. It is a prompt to check.
Believing a low rating prevents disputes. Fraud analysis does not cover bank charge reversals.
Assuming 3D Secure is on. We could not confirm Shopify's position for Australia, so ask.
Using US-style address checks. Shopify's guidance is for the US, UK and Canada.
Accusing the customer. Ask neutral questions and keep the tone polite.
Skipping reviews in sale weeks. Volume rises, so the routine matters more.
Not recording the review. The note can become evidence.
Ignoring delivery proof. A fraud claim and a not-received claim need different evidence.

Frequently asked questions

What is fraud analysis in fraud prevention on Shopify?

It is a Shopify feature that rates orders low, medium or high risk. Fraud indicators need the Basic plan or higher, and recommendations need Grow or higher, or Shopify Payments. Shopify says it does not cover bank charge reversals, so a rating does not stop a later dispute.

Does fraud prevention on Shopify protect me from chargebacks?

No. Shopify says fraud analysis does not cover bank charge reversals. It helps you decide which orders to check before shipping, but a cardholder can still dispute any order. Keep your evidence, delivery proof and customer messages whatever the rating says.

Does Shopify support 3D Secure in Australia?

We could not confirm it. NAB's merchant guide says 3D Secure shifts fraud liability, but the Shopify page we found for 3D Secure was a dated changelog from 2022, which we did not use. Check your payment settings and ask Shopify Support in writing how it applies to your Australian transactions.

How does fraud prevention on Shopify treat a high risk order?

Pause fulfilment, read the indicators, compare addresses, check for prior orders and send a neutral question to the customer. Then fulfil, ask for more information or cancel and refund, and record the reason. A flag is a reason to check, not proof of anything about the customer.

Is address verification useful for fraud prevention in Australia?

Shopify's address verification guidance is written for the US, UK and Canada, and does not name Australia, so we cannot say it works the same here. Compare billing and shipping addresses yourself and treat any mismatch as one input among several.

What dispute reason is used for fraud?

Shopify lists eight reasons, and fraudulent is one of them. Unrecognized is separate, and covers a customer who does not recognise the charge. Each has its own evidence list on Shopify's reasons page. There is no early resolution for Amex or Visa "Fraudulent" disputes, according to Shopify.

How long does a fraud dispute take?

Shopify says the response window is usually 7 to 21 days, and the bank decides up to 75 days after you submit, with no appeal. For example, submitting on Friday 20 November 2026 puts the latest decision at Wednesday 3 February 2027. A win can be re-disputed with a new deadline.

Should fraud prevention on Shopify mean cancelling risky orders?

Only after a neutral check, unless you cannot get a reasonable answer. Cancelling and refunding in full is a legitimate commercial decision, and in our example it cost A$5.89 against a loss of A$186.89. Do not accuse the customer, and keep a note of what you did.

Is the customer liable for unauthorised card use in Australia?

The ASIC ePayments Code, which is voluntary and excludes business-purpose facilities, sets rules for banks and customers. It says the holder is not liable for fraud or negligence by a merchant. It is about the customer and their bank, not you, but it explains why unauthorised claims are taken seriously.

Start free trial with ChargeFix

ChargeFix helps Australian Shopify merchants turn their order, delivery, message and policy records into a ready response. You review and file it, or let Auto mode handle them. If you want your evidence ready alongside your fraud prevention on Shopify routine, you can try it on a free trial first.

Start free trial

Fraud prevention on Shopify in Australia: fraud analysis, 3D Secure and a review routine

What does fraud prevention on Shopify actually cover?

What is the difference between fraud and a disputed genuine order?

Why do fraudulent disputes matter more than most?

How does Shopify fraud analysis work?