IP address dispute evidence on Shopify: what UK sellers can and cannot prove

A customer with a billing address in Guildford places a £260 order for a pair of headphones at 11:40 on a Sunday night. Your admin shows the connection came from a country 3,000 miles away. The order ships. Six weeks later the Guildford cardholder tells her bank she never ordered it, and the disputed £260 plus a £10 fee leave your Shopify balance. Is that IP address a smoking gun, or a holiday? That depends on what else you can show, and it is why IP address dispute evidence needs care.

IP address dispute evidence is the record of the internet address and country an order was placed from, used to help a card issuer decide whether the cardholder made the purchase. It is useful but weak on its own: a match with the billing country supports your case, a mismatch can hurt it, and neither proves who was at the keyboard. This guide explains what an IP address shows, where it misleads, how to compare it with order history, how to write it into a response, and how to use it before you ship.

This guide is for you if:

• You sell on Shopify Payments in the UK and receive "fraudulent" or "unrecognised" disputes.
• You have seen an IP country that does not match the billing country and are unsure whether to ship, cancel or fight.
• You want a simple routine that uses IP evidence honestly, without overclaiming.

Last updated: 22 October 2026. Written by the ChargeFix team. Reviewed against sources on 22 October 2026. General information, not legal or financial advice.

Disclosure. ChargeFix helps merchants respond to Shopify Payments disputes, so I benefit when disputes need answering. I found no published UK data on how often IP evidence changes a dispute outcome, so the examples are made up and labelled. Where Shopify's pages are silent, I say so.

The 30-second answer (TL;DR)

• Shopify names IP address and country as evidence for fraud disputes, and says it collects some of it automatically.
• IP address evidence supports your case when the IP country matches the billing country and the customer's history. It proves a connection, not a person.
• A mismatch is not proof of fraud. VPNs, mobile networks, work networks and travel all change an IP address.
• Never write "the cardholder placed this order" from an IP match alone. Write what the record shows and let the other evidence do the rest.
• Use the IP location before shipping, as one signal alongside Shopify's fraud analysis, not as a verdict.

Do this today (10 minutes):

1. Open your last five fraud or unrecognised disputes in the Shopify admin.
2. For each, note the IP location, the billing country and whether the customer had earlier orders.
3. Count how many had a match and how many a mismatch. That is your own baseline.

How IP evidence fits into a dispute

Stage	What can go wrong	The record that protects you
Checkout	Order placed from an unexpected country	IP and country stored with the order
Payment	Stolen card tested from a proxy	Payment checks and fraud risk level
Dispatch	Order shipped despite a mismatch	A dated note saying what you checked
After delivery	Cardholder says "not me"	Delivery proof plus earlier undisputed orders
Dispute	Reviewer sees a foreign IP	A response that explains the mismatch honestly
Outcome	Bank decides on the whole picture	IP is one line of evidence, never the only one

What does IP address dispute evidence actually show?

An IP address is the number your customer's connection presents to the internet when they load your checkout. From it, services can estimate a country and often a region or city. That is all. IP address dispute evidence shows where a connection appeared to come from at the moment of the order. It does not show whose hands were on the keyboard.

What an IP address can show	What it cannot show
The country the connection appeared to come from	Who was using the device
Whether the same connection was used on earlier orders	That the cardholder was at home
Whether several orders came from one connection	That a VPN or proxy was not in use
A pattern across orders, such as many cards from one IP	Whether the card was stolen

A bank reviewer reads IP address evidence the way you would. A match is mildly reassuring. A mismatch raises a question. Neither settles it. The weight comes from what sits beside the IP: the billing address, delivery to a known address, earlier orders, and emails to the cardholder.

Which disputes does IP address evidence help with?

Shopify's help pages put IP address and country on the evidence list for fraud-related and general disputes. They do not list it for product not received or credit not processed. That fits the logic: IP evidence speaks to whether the cardholder made the purchase, not to whether the parcel arrived.

Dispute reason	Does IP evidence help?	What to lead with instead
Fraudulent	Yes, as supporting evidence	Payment checks, address match, order history
Unrecognised	Yes, if the IP matches earlier orders	Billing descriptor, order emails, delivery
Product not received	Rarely	Tracking and delivery scan
Product unacceptable	No	Listing, photos, returns replies
Credit not processed	No	Returns policy, refund records
General	Sometimes	The full evidence list

If you are answering a fraud dispute, IP address dispute evidence goes in the middle of your response, never at the top. Lead with the strongest proof you have, which is usually delivery to an address the cardholder has used before.

Where do you find the IP address and country in Shopify?

Shopify says that if you add nothing, it submits the evidence it collected on its own, and its list of that evidence includes the IP address, customer name and email, billing and shipping addresses, fulfilment and tracking, refund records, and order and dispute history. So the IP is captured for you at checkout.

Where it appears in your admin depends on your plan and the page. Shopify's fraud analysis page lists address and card checks among its indicators, and says it does not describe the indicator results in detail. Open a recent order and look at the fraud analysis section and the order timeline. If you cannot find it, check the dispute's evidence screen, where Shopify shows what it has collected.

Where to look	What you may find	Check
Order page, fraud analysis section	Risk level and indicators	Recommendation for eligible orders
Dispute evidence screen	Evidence Shopify collected	Is the IP and country shown?
Order timeline	Events such as payment and fulfilment	Dated notes you added
Customer page	Earlier orders	Whether past orders were undisputed

Take a screenshot of what you see when you answer a dispute. If you attach a screenshot, make sure it shows the date and the order number so the reviewer can match it to the case.

When does IP address evidence help your case?

IP address evidence helps when it matches the story the rest of your records tell. There are four cases where it adds weight.

First, the IP country matches the billing country. For a Guildford cardholder, a UK connection is what you would expect. Second, the IP matches earlier orders. If the same connection placed three undisputed orders in the past year, the disputed order fits the same pattern. Third, the IP is stable across a session: the customer browsed, added to basket and paid from one connection. Fourth, the IP is near the delivery address, which is common for gifts to a customer's own home.

Pattern	What it suggests	How much weight
IP location equals billing country	Ordinary purchase	Light
Same IP as three earlier undisputed orders	Familiar customer	Moderate
IP in the region of the delivery address	Customer at home	Light to moderate
Account login from the same IP over weeks	Established account	Moderate
Order emails opened from the same area	Customer engagement	Light

Even the best of these is moderate. A reviewer will not accept IP address evidence as a replacement for proof of delivery to the cardholder.

When does IP address evidence hurt, or mislead you?

A mismatch between IP and billing country looks bad, but it has many innocent explanations. People travel. People use a VPN for privacy or for work. Some mobile networks route traffic through gateways that appear to be in another city or country. Offices and universities share one address across hundreds of people. A customer ordering from a holiday flat in Spain is not a fraudster.

The reverse also holds. A fraudster using a stolen card can pick a proxy in the cardholder's own country, so a match is no guarantee. IP geolocation is an estimate, not a fact.

Case	What the IP shows	The honest reading
Customer on a VPN	A country far from the billing address	Unknown, ask the customer
Customer abroad	The holiday country	Plausible if the customer says so
Mobile network	A city that is not the customer's	Common, weak signal
Work or university network	A shared address	Weak signal
Stolen card with a UK proxy	UK	Looks fine, may not be
Several cards from one IP	One connection, many cards	Strong warning

The strongest warning in this table is the last. Many different cards used from one connection within a short time is a classic sign of card testing. That is a reason to hold orders, not a reason to rely on an IP match.

Use your own history for this: pull the last 50 orders with a mismatched IP and count how many were later disputed.

How do you compare IP address evidence with order history?

Order history is the best partner for IP address dispute evidence. A returning customer who has paid three times without a dispute has already shown a pattern. If the disputed order shares the same email, the same delivery address and the same connection, the case is much stronger than any IP alone could make it.

Build a short comparison table for every fraud or unrecognised response:

Order	Date	Amount	IP country	Delivery address	Outcome
#1001	3 Mar 2026	54	UK	14 Elm Road, Guildford	Delivered, no dispute
#1026	19 Jun 2026	89	UK	14 Elm Road, Guildford	Delivered, no dispute
#1077	11 Oct 2026	260	Spain	14 Elm Road, Guildford	Disputed

This is a made-up example. It shows an honest reading: the disputed order went to the same address as two earlier undisputed orders, which supports the customer being the same person, and the Spanish IP has an innocent possible explanation (a holiday, or a VPN). Note that the amount is higher, which a reviewer may also notice. Do not hide that.

If the customer has no history, say so. A first-time buyer with a mismatched IP and a rush shipping request is a risky order, and your response will be weaker. That is a reason to check it before shipping.

How do you write up IP address dispute evidence in a response?

Write IP address dispute evidence as the record shows it, in plain words, with no claim that goes further. A reviewer discounts any sentence that sounds like a conclusion the evidence cannot carry.

IP address and location

At checkout on 11 October 2026 at 23:40 the order was placed from an
IP address located in Spain. The billing address is in Guildford, UK.
The same email address and delivery address were used on orders #1001
(3 March 2026) and #1026 (19 June 2026), both delivered and not
disputed. We cannot say why the connection appeared to be in Spain.
We note that VPNs and travel can produce this. [attach screenshot of
the order page and the order history table]

Compare that with a version a reviewer will distrust:

The IP address proves the cardholder placed this order.

That sentence claims something the record cannot show. Using it risks the rest of the response. Keep the honest version, and let the delivery proof and the history carry the weight.

If the IP location matches, say so in one sentence and move on:

The order was placed from an IP address in the United Kingdom, which
matches the billing address country.

What do you do before shipping when the IP address evidence does not match?

Because a mismatch is a warning and not a verdict, the right move is a short, polite check, with a rule for which orders get one. Decide a value threshold. Below it, ship as usual. Above it, run the checks.

Signal	Action
IP location differs from billing country, low value	Ship, keep a note
IP location differs, value above your threshold	Email the customer to confirm before shipping
IP location differs and fraud analysis is medium or high	Hold, verify, or cancel
Many cards from one IP in an hour	Cancel and review the pattern
IP matches and history is clean	Ship as normal

Shopify's fraud analysis, for eligible orders, rates the risk of a fraud chargeback as low, medium or high and offers guidance: fulfil, confirm with the customer first, or consider cancelling. The page says individual indicators do not show overall risk and that Shopify does not cover charge reversals from banks. Use IP as one input to that judgement.

A confirmation email to the cardholder's address on the order costs little:

Subject: Please confirm your order #1077

Hi,

Thank you for your order. We noticed it was placed from outside the
UK, which can happen when travelling or using a VPN. To protect you
from card misuse we confirm orders of this size before dispatch.

Please reply "confirmed" and we will send it today. If you did not
place this order, reply "not mine" and we will cancel and refund it.

Thank you,
The Example Store team

A "confirmed" reply from the cardholder's email address is far stronger evidence than any IP match. A "not mine" reply stops a dispute before it starts.

How does IP address evidence work for digital goods?

For downloads, courses and licences, there is no parcel to track, so the connection data becomes more important. Shopify's list for product not received says to provide an activity log for digital goods. For these orders, the record that matters is when the customer downloaded, streamed or logged in, and from where.

An activity log that lists the order number, the download date and time, the IP address and the device type is the closest equivalent to a delivery scan. If the same IP that placed the order also downloaded the file, that is a coherent story. If the download came from a different country, you have a question to answer.

Digital record	What it shows	Weak point
Download timestamp	The goods were accessed	Does not show who
IP at download	Where the access came from	Same caveats as any connection
Account login history	An established account	A stolen login looks the same
Licence activation	The product was used	Can be done by anyone with the key

Whether Shopify stores a download log for your digital delivery app depends on the app. I did not research specific apps. Ask your app's support what it logs and for how long.

What should you do when the customer says they were abroad or on a VPN?

Sometimes the cardholder tells you, before any dispute, that the odd location was theirs. A customer writes: "I was on a work trip in Madrid when I ordered." That sentence, in an email from the order address, is worth more than any amount of IP address evidence, because it comes from the cardholder in their own words.

Treat it in four steps. First, keep the email with its date in the order timeline or your records. Second, reply politely and confirm you have noted it, which creates a two-way thread. Third, if the order is large, still check that the delivery address is one the customer has used. Fourth, if a dispute later arrives, attach the thread and the order history table and say plainly that the customer explained the location at the time.

What the customer says	What to keep	What it proves
"I was travelling when I ordered"	The dated email from the order address	The cardholder knew about the order and explained the location
"I use a VPN for work"	The same email	A plausible reason, not proof
"I did not place this order"	The email, then cancel and refund	A dispute avoided, and a record of the claim
No reply to your check	The unanswered email, dated	Silence, which is weak but should be recorded

The same thread helps if the customer later says they never ordered. A reviewer who sees "I ordered from Madrid, please ship to my home" followed by a dispute will weigh the dated message heavily. This is why a short question before shipping is worth more than the best response written afterwards. A reviewer is also more patient with IP address evidence that you explained in advance than with one you explain only after the money has left.

What are the UK data protection points to keep in mind?

The ICO's guide to personal data quotes the UK GDPR definition, which names an online identifier among the things that can identify a person, directly or indirectly. An IP address can do that, so treat it as personal data. If you keep IP addresses for longer than Shopify does, or copy them to a spreadsheet, you are processing personal data and should have a reason, a limit on how long you keep it, and a way to answer a request from a customer.

In practice, three habits help. Keep the IP in Shopify rather than exporting it. Delete exports when the dispute window has passed. And say in your privacy policy that you use order and connection data to prevent fraud and defend disputes. Read the Shopify documents on your account for how it handles data, and take legal advice if you build a bigger fraud system.

ChargeFix's privacy documents say the app does not store customer names, emails or addresses and reads them from Shopify only while you review a case. That limits what a tool you connect holds, but it does not remove your own duties as the business that collects the data.

Should you fight when IP address evidence does not match?

Sometimes. The question is not the IP; it is whether the rest of your evidence is strong enough to carry a mismatch.

Question	If yes	If no
Was the parcel delivered to an address the cardholder used before?	Strong, fight	Weak
Does the customer have undisputed history?	Good, fight	Think harder
Did the cardholder confirm the order by email?	Very strong	Neutral
Did payment checks pass and risk stay low?	Supports the case	Consider accepting
Is there a plausible innocent reason for the mismatch?	Say so	Say nothing you cannot support
Is the amount above the £10 fee and your time?	Worth answering	May not be

On Shopify Payments in the UK the dispute fee is £10 and is returned if you win. The disputed amount leaves your balance immediately. No tool can promise a win, because the issuing bank decides.

What is a dated plan for putting IP evidence to work?

This plan assumes you start on Monday 26 October 2026 and want to be ready for the Black Friday and Christmas peak.

Date	Task	Output
Mon 26 Oct	Find where IP and country appear in your admin and take a screenshot	A note of the exact place
Tue 27 Oct to Fri 30 Oct	Review your last 10 fraud or unrecognised disputes against IP and history	A baseline table
Mon 2 Nov to Fri 6 Nov	Write your value threshold and the "confirm your order" email	A saved email template
Mon 9 Nov to Fri 13 Nov	Add the IP paragraph and history table to your response template	A reusable response skeleton
Mon 16 Nov to Thu 26 Nov	Test the routine on live orders above your threshold	A log of held and confirmed orders
Fri 27 Nov	Black Friday: apply the routine to every order above the threshold	No unreviewed risky orders
Mon 4 Jan to Fri 29 Jan 2027	Answer the first wave of post-Christmas disputes	Responses filed before deadlines
Fri 26 Feb 2027	Compare results with the baseline	Revised threshold

What does this look like for three UK merchants?

These are made-up examples.

A headphone and audio shop in Reading. Average order £140. The owner finds that most mismatched IP orders are staff at a nearby company using the office VPN. A rule is added: orders above £300 with a mismatch get a confirmation email, and below that they ship. Disputes on mismatched orders fall because the few that matter are caught.

A skincare brand in Leeds. Average order £48. IP evidence rarely matters here, since most disputes are "item not as described". The owner uses it only when a customer says they never ordered, and keeps the comparison table in the response template.

A software licence seller in Edinburgh. Average order £90, all digital. The owner keeps download logs with IP and time, and sets the app to delay a licence key by ten minutes for orders from a country that differs from the billing address. A confirmation email goes out in the gap. Card-testing attempts, which show as many cards from one IP, are cancelled.

What is different for UK merchants?

The Shopify Payments dispute fee in the UK is £10, returned only if you win. UK customers often shop on mobile networks, and mobile networks can place a user in a city or region that is not theirs, so a regional mismatch inside the UK is weak evidence. Shopify Protect, which covers some fraud chargebacks, is for US stores only on Shopify's own pages, so UK merchants carry the full risk of fraud disputes unless they use another route.

The ICO's guide to personal data names an online identifier among the things that can identify a person, and an IP address can do that, so keep what you hold to what you need. We are not lawyers.

What are the common mistakes with IP address dispute evidence?

1. Treating a mismatch in IP address evidence as proof of fraud. Travel, proxies and mobile networks all create mismatches.
2. Treating a match as proof of innocence. A fraudster can use a proxy in the right country.
3. Writing that the IP "proves" the cardholder ordered. It proves a connection. Overclaiming costs you credibility.
4. Leading the response with IP evidence. Put delivery proof and history first.
5. Ignoring order history. A returning customer with a clean record is your best evidence.
6. Hiding an obvious mismatch. A reviewer will see it. Explain it plainly.
7. Skipping the confirmation email on large risky orders. It is the cheapest protection you have.
8. Keeping exports of IP addresses forever. Set a retention limit and delete.
9. Submitting before you have added your own evidence. Shopify says early submission locks your edits.
10. Missing the deadline. After it passes, only Shopify's automatic evidence goes in.

Frequently asked questions

What is IP address dispute evidence?

IP address dispute evidence is the record of the internet address and country an order was placed from. Shopify lists IP and country as evidence for fraud-related disputes. It supports a response when it matches the billing country and past orders, but it never proves who made the purchase.

Does a matching IP address win a chargeback?

No. A match is mildly reassuring and adds weight to a case built on delivery proof, order history and customer emails. A card issuer decides on the whole picture, and a fraudster can use a proxy in the cardholder's country. Treat a match as one supporting line, never the headline.

Is a mismatch in IP address evidence proof of fraud?

No. Travel, proxies, mobile networks and shared office or university connections all produce mismatches for genuine customers. A mismatch is a reason to check the order, not to cancel it automatically. Combine it with Shopify's fraud analysis, payment checks and the customer's history before you decide.

Where does Shopify show IP address evidence for an order?

Shopify says it collects the IP address automatically and includes it in the evidence it submits if you add nothing. Check the fraud analysis section and the dispute evidence screen for your plan, and screenshot what you see. Do that before you copy anything into a spreadsheet.

Should I email the customer when the IP location is different?

For orders above a value you choose, yes. A short, neutral message asking the customer to reply "confirmed" costs little and gives you strong evidence if they reply from the order email. If they reply "not mine", you can cancel and refund before any dispute begins.

How do I use IP evidence for digital products?

Keep an activity log with the order number, download or login time, IP address and device. Shopify's list for product not received asks for an activity log for digital goods, so keep one. If the same connection placed the order and downloaded the file, that is a coherent story. If it differs, explain it honestly.

Can I keep customers' IP addresses in a spreadsheet?

You can, but an IP address can be personal data under UK data protection law, so have a reason, keep it only as long as you need, and delete exports after the dispute window. Where possible leave it in Shopify. Take advice if you build a larger system.

How much does a fraud dispute cost in the UK?

On Shopify Payments the disputed amount and a £10 fee leave your balance when the chargeback opens, and the fee is returned only if you win. If the goods have shipped you also lose them. A £260 order therefore costs £270 at once, plus the goods if you lose.

Should I fight every dispute with a mismatched IP?

No. Fight when you have delivery to an address the cardholder used before, a clean order history, or an email confirmation. Consider accepting when the order is new, risky and thinly documented. A weak response uses time and cannot be changed once Shopify has filed it.

What if the same IP placed several orders with different cards?

Treat it as card testing. Hold or cancel the orders, review the pattern, and consider blocking the address in your fraud tools. This is the one case where an IP signal is strong, because many cards from one connection in a short time is rarely innocent.

Start free trial with ChargeFix

For IP address dispute evidence to help, it has to sit beside the right order, delivery and history records. ChargeFix reads the real order, payment, tracking and delivery data for each Shopify Payments dispute, scores the evidence and drafts the response from your own records, never inventing facts. You review and file it, or let Auto mode handle them. Start free trial

Sources

• Responding to chargebacks and inquiries, Shopify Help Center
• Fraud analysis, Shopify Help Center
• Chargebacks and inquiries, Shopify Help Center
• ChargeFix support page
• ChargeFix data processing agreement
• What is personal data, ICO
• Stripe, Dispute evidence best practices: further reading on how to format convincing evidence
• Adyen, Manage disputes: further reading on how another payment provider handles disputes