Shopify Fraud Hold: Holding Risky Orders on a Demo Store

Shopify runs a fraud analysis on online card orders it can verify and gives each one a recommendation. What it doesn't do by default is stop a risky order from being packed. None of the risk templates Shopify offers in Flow holds fulfilment, so a store that ships from the unfulfilled list can send a flagged order out the same afternoon. Here is how we built a hold for that gap with Shopify Flow on our own demo store, what happened to the test orders, and what we couldn't show. The kit, KIT-04 Fraud Hold, doesn't win disputes or make fraud go away. It puts a person between a risky order and the shipping label.

This is a demo build, not a client project. Everything below was built and tested on 21 October 2026 on Northfield Outfitters, a fictional shop on a Shopify Plus development store of ours, with synthetic data and test orders we placed ourselves. There are no client results in this article.

Key points

• Shopify Flow's Order risk analyzed trigger starts a workflow when Shopify's fraud analysis of an order is complete, and Flow has a Hold fulfillment order action (Shopify Help Center).
• On our demo store, one workflow held 3 of 4 test orders, tagged them fraud-hold and ran its email step to a reviewer address. The order that matched no signal went through untouched. A fifth order, placed after we reworded the hold note, was held too.
• One order was held only because its billing country (Canada) differed from its shipping country (US). A person released it by hand and swapped the tag to fraud-reviewed.
• A second workflow lists the orders still tagged fraud-hold each day. Its test run listed the three held orders. After the release, the same search returned two.

The order that looks like a sale

Shopify's fraud analysis gives an order a recommendation (accept, investigate or cancel) and a risk level, and Flow can read both (Shopify Help Center, Order risk analyzed; shopify.dev, OrderRiskSummary). Shopify also says card-testing attempts are mostly failed transactions, but some might result in placed orders (Shopify Help Center, preventing fraud). Those are the ones that matter here, because they look like sales.

One merchant described the rest. In a Shopify Community thread posted on 27 August 2026, a UK merchant reported a fraud order that came after failed payment attempts and that Shopify had classed as low risk (thread 672811). Other merchants replied that a low rating is about chargeback risk, not a promise. One store's report proves nothing on its own, but it is why this kit also checks signals the store picks for itself.

Then there is the paperwork. For a fraud dispute on Shopify Payments, the evidence that helps includes address and security code checks, proof of delivery to the verified address, 3D Secure, device and IP details, and messages with the customer (Shopify Help Center, chargeback process). The deadline is typically 7 to 21 days after the chargeback is filed, and in the US the fee is $15, returned if you win, varying by country. Holding a suspicious order gives the store a chance to cancel before anything ships. The bank still decides.

What the kit includes

The hold rule is the centre of it. Everything else, from the daily digest and review checklist to the dispute evidence template and handover, exists so that a held order gets looked at. The full list is on the kit page.

For other jobs Flow can take on, see our guide to Shopify automation workflows.

The demo store and its limits

Northfield Outfitters, the fictional shop from our Bot Cleanup kit, runs on a Shopify Plus development store with Shopify's test payment gateway, not Shopify Payments. That shaped the whole test. To give a test order a simulated risk level, Shopify says you need Shopify Payments in test mode (Shopify Help Center, fraud analysis), which meant entering business and card details for a demo store. We decided not to. Every order below went through the test gateway with card "1", made-up addresses in Denver and Toronto, and our own email addresses, and each one's risk panel reads "Analysis not available".

So of the rule's four signals, Shopify's recommendation and risk level had nothing to read. The store's own two, a new customer above a spending threshold and a billing country that differs from the shipping country, could be tested properly.

Building the hold in Shopify Flow

It is one workflow, "Fraud hold: hold and notify", and it starts on Order risk analyzed rather than Order created. Shopify says that trigger runs once the fraud analysis is complete, and that third-party fraud apps don't fire it (Shopify Help Center, Order risk analyzed).

The condition is a list joined by OR, so any one match is enough:

• Shopify recommends cancel or investigate.
• Any risk assessment on the order is high or medium.
• The customer has one order or fewer and the total is $200 or more, grouped with AND. The $200 is a demo figure; on a client store the owner signs off the number.
• The order has a shipping country, and the billing country is not equal to it.

On a match, Flow adds the tag fraud-hold, loops over the order's fulfilment orders and holds each one with the reason Other and the note "Held for fraud review", then sends an internal email to the reviewer. That email action takes fixed addresses only (Shopify Help Center, Send internal email), so the address is written into the workflow.

Sidekick, Shopify's assistant in Flow, built it from a written description, and we opened every step before turning it on. The logic was right. It didn't rename the workflow, though, which is why the checking step stays in the runbook.

We expected trouble with the country check. There was none: on this Plus store, Flow compared the billing and shipping country fields directly. We haven't checked Basic or Grow.

Hold, don't cancel

A held order costs a delay. A wrongly cancelled one costs a customer. Flow offers a "Cancel and restock high risk orders" template, and we leave it alone. A hold stops fulfilment while the payment and order stay as they are, and Shopify keeps the inventory reserved (Shopify Help Center, fulfilment holds).

Four test orders, one at a time

We placed four orders a few minutes apart on the morning of 21 October, each from a new test customer.

Order #1034: new customer, $749.95

One snowboard, both addresses in the US, so only the new-customer signal should match. It did. The order showed On hold, with a Flow hold reading "Other" and "Held for fraud review", and the fraud-hold tag.

Order #1035: new customer, $32.95

The control. It matched nothing: no tag, no hold, no email. One clean order isn't a sample, so we won't call it a false-positive rate.

Order #1036: billing Canada, shipping US

Ski wax, $32.95 with shipping, from a new customer. Far below the $200 line, so only the country mismatch could hold it. It was held and tagged. A spending threshold alone would have let it through.

Order #1037: two snowboards, $1,379.90

This was meant to be the split-location test. Both boards turned out to be stocked at one location, so Shopify created one fulfilment order and Flow held it. Shopify says each fulfilment order is held separately, and a partly unfulfilled order shows as Unfulfilled, not On hold (Shopify Help Center, fulfilment holds). Our loop is there for that case. We've seen it place one hold. We haven't seen it place two.

The trigger fired on test-gateway orders

We weren't sure it would. The run list shows four completed runs: three with all three actions, and one with none, which was #1035. So Order risk analyzed ran even though every risk panel said "Analysis not available". That's one store, and Shopify doesn't document it.

The daily digest

A held order nobody looks at is just late. The second workflow, "Fraud hold: daily digest", runs at 08:00 store time, finds orders tagged fraud-hold, oldest first, and emails the reviewer one line per order: name, created time, total, Shopify's recommendation and an admin link. It closes with a reminder to swap the tag after each decision.

Its test run listed #1034, #1036 and #1037 and nothing else. The first scheduled run was due on 22 October, so what you see is Flow's preview, not an inbox.

Releasing a held order by hand

Flow has a release action, but Shopify says it releases all fulfillment holds on the fulfillment order (Shopify Help Center, Release fulfillment order holds), other apps' holds included. So a person decides after checking the order: release, contact the customer, or cancel and refund. Our customer was fictional, so we went straight to the mechanics with #1036.

We clicked Release hold. Shopify showed "Fulfillment released", the order went back to Unfulfilled, and the timeline recorded "You released a hold placed by Shopify Flow on 1 item." Then we swapped the fraud-hold tag for fraud-reviewed.

Filtering the orders list on fraud-hold, the digest's own query, then returned #1034 and #1037 only. We haven't watched a scheduled digest drop #1036, but the search it depends on already has. The tag and the timeline entry also show that someone looked before the order shipped. That is a record for the store, and we make no claim about how a bank weighs it.

What we could not show

• Shopify's own risk signals. They are in the rule, but no test order here had a risk result to match, because simulating one needs Shopify Payments test mode. On a client store with Shopify Payments, the first acceptance test covers them with Shopify's own test values.
• Those signals under the threshold. #1035 showed the new-customer pair is grouped correctly. An order Shopify flags below $200 couldn't be placed here.
• Manual capture. The optional routine that holds back the payment is untested live. Shopify Payments gives a 7-day authorisation window and charges 1.75% on top of the usual fees to capture later (Shopify Help Center, payment authorization), so the handover is clear about the clock.
• A split order. One fulfilment order held, two not yet seen.
• Digital or auto-fulfilled items. No Shopify page says whether they can be fulfilled before a hold lands, so we treat them as out of scope until tested on the store.
• Email delivery. On the hold workflow, Flow's run detail shows the Send internal email step as Completed. The digest has only run as a test event, which shows a preview and sends nothing. We read both from Flow, not from an inbox, so we haven't shown an email arriving.

Three things that caught us out

The demo hold email is shorter than the one in the kit, which says which signal matched and links to the order. We also changed the hold note after the first four orders, to the wording the kit uses for clients: "Fraud hold (Axioprax KIT-04): held for fraud review. Release by hand after checking." A fifth test order, #1038, a new customer at $749.95, was held with the new note and tagged fraud-hold.

Time zones bit twice. The digest preview shows #1034 created at 14:25, while the admin shows 10:25 am. Four hours is the gap between UTC and New York in October, so we read it as the digest printing UTC, and the client version labels the time zone. And 08:00 store time here is 17:30 in India, so for a client we set the schedule from where the reviewer sits.

Then there are orders Shopify doesn't analyse. Test, free, POS, B2B and subscription renewal orders get no real recommendation (Shopify Help Center, fraud analysis), and no page covers draft orders marked as paid. Our test orders still fired the trigger, but we haven't seen which of the other types do, so we test the ones a client's store uses.

What the kit leaves out

It doesn't win or manage disputes, and no rule cancels or refunds an order without a person approving it. The rest, from payout holds to third-party fraud apps, is on the kit page.

Getting started

The kit needs someone at the store who can check held orders every working day. Without that person it just makes orders late. If you have them, and risky orders are shipping before anyone looks, see what is in the KIT-04 Fraud Hold kit, then describe your store at axioprax.com/start. Tell us your payment gateway, daily order volume and what you've been seeing. Black Friday is on 27 November this year. We confirm the kit fits before you pay.

Frequently asked questions

Will this stop chargebacks?

No promise of that. The kit makes sure a person checks a risky order before it ships and keeps the evidence banks ask for ready. Banks decide disputes, and we don't claim any reduction.

Do I need Shopify Payments or Shopify Plus?

Neither, strictly. Flow is free on Basic, Grow, Advanced and Plus. Shopify's fraud recommendation is fullest on Shopify Payments, and on other gateways it depends on your plan and processor, so on those the rule leans more on your own signals. Our demo store is a Plus development store.

What happens to orders Shopify doesn't analyse?

Shopify's own signals can't match them, because Shopify says free, POS, B2B and subscription renewal orders get no real recommendation. On our demo store, test orders still reached the rule and the store's own signals held them. We test the order types your store uses and record in the handover which ones reach the rule.

---

What this article is built on

Shopify claims were read against Shopify's own pages, and demo results come from our build log and numbered captures, all on 21 October 2026.