A fraudulent order costs you twice. The product ships, then the bank takes the money back.
Shopify's help pages say that when a chargeback is filed, the bank takes the disputed amount from you right away, plus a chargeback fee. With Shopify Payments it comes out of your next payout.
This is the system I'd build so risky orders stop before they ship, and disputes get answered on time instead of found too late.
Table of contents
The problem: risk is flagged, then shipped anyway
Shopify already rates eligible online card orders as low, medium or high risk, and flags medium and high on the Orders page.
But a flag is easy to miss. If your warehouse or 3PL pulls orders automatically, a high-risk order can be packed before anyone reads it.
Disputes have the same gap. Shopify says the response deadline is typically 7 to 21 days after the chargeback is filed. If nobody owns the inbox, that window closes quietly.
How the system is put together
Five parts: the tools, the hold, the review, the dispute file, and who owns what.
Part 1: the tools
Shopify fraud analysis rates the order. Shopify Flow acts on that rating and on new disputes. The exceptions tracker holds one row per held order or dispute. Email or your team chat carries the alert.
Part 2: the automatic hold
Flow has an Order risk analyzed trigger and a Hold fulfillment order action, both in its own reference lists. The workflow: when risk comes back high, hold fulfillment, add an order tag like "risk-review", and send an internal email to the reviewer.
I haven't verified the exact condition fields Flow shows for the risk level, or how the hold step picks up each fulfillment order. Build it, then test it on real orders before you trust it.
A hold matters most if your 3PL pulls orders automatically. It stops the order reaching them until someone decides.
Part 3: the human review
Shopify's fraud page gives three outcomes for a risky order: verify it with the customer, cancel it, or refund it. A person picks one, not the workflow.
If the order checks out, the reviewer releases the hold. Flow also has a Release fulfillment order holds action if you want a tag to trigger the release.
Shopify also notes you can set up manual payment capture if you want time to investigate before taking payment. I'd only do that if your team can review fast, because every order then waits on a person.
Part 4: the dispute file
Flow has a Dispute created trigger. Use it to tag the order, add a row to the tracker with the due date, and email the owner.
The owner builds the evidence from the order: tracking and delivery, customer messages, and your policies. Shopify says the right evidence depends on the dispute reason, and that after evidence is submitted you can't change it. So submit once, complete.
If the claim is fair, accept it. Shopify notes you aren't refunded the chargeback fee when you do.
Part 5: what is automatic and what a person does
Automatic: the hold, the tag, the alert, and the tracker row for every high-risk order and every new dispute.
A person: deciding to verify, cancel or release; writing and submitting dispute evidence; choosing to accept a dispute.
Ownership: operations owns the workflow and the tracker. One named reviewer owns held orders, with a backup for weekends. Open disputes and their due dates go into the Friday founder update.
What it solves
Shipping risky orders. High-risk orders wait for a decision instead of reaching the packing table.
Missed deadlines. Every dispute gets an owner and a due date the day it arrives.
Weak evidence. Tracking, messages and policies are pulled together on purpose, not in a rush on the last day.
Inconsistent calls. One reviewer and one set of outcomes, not whoever happens to see the flag.
The effect on the business, and how to measure it
I'm not quoting results. I don't have published numbers for this system, and I won't invent them.
The target is that no high-risk order ships without a decision, and no dispute passes its due date unanswered. That is a target, not a result.
Here is what I'd baseline before switching it on, and compare after.
Chargebacks per month, and how many were fraud claims.
Disputed amount and fees paid each month.
Dispute win rate, and how many were answered before the deadline.
High-risk orders held before fulfillment, as a share of all high-risk orders.
Time to decision on held orders, so good customers aren't kept waiting.
Cancelled orders that were genuine, which is the cost of being too strict.
Where it shows up in the business: fewer payout deductions, less stock lost to fraud, and fewer founder hours spent on bank letters.
The bigger picture: holds are a pattern, not a one-off
This is the same idea as the order-to-fulfillment system: rules read every order, people read the exceptions.
The backorder system uses the same Flow hold for a different reason. If you're letting Flow buy labels, decide how held orders fit in, and test it.
And it slots into the operations setup plan: one owner, one tracker, one weekly update.
Build checklist
- Read how Shopify's fraud analysis rates your orders and where the flags show.
- Build a Flow workflow on Order risk analyzed: hold fulfillment, tag the order, alert the reviewer.
- Test it on real orders and confirm the hold actually stops your 3PL or app.
- Write the three review outcomes: verify, cancel or refund, release.
- Name one reviewer and a backup, with a target time to decide.
- Build a second workflow on Dispute created: tag, tracker row with due date, alert.
- Keep an evidence checklist by dispute reason: tracking, messages, policies.
- Add open disputes and their due dates to the weekly founder update.
- Baseline chargebacks, fees, win rate and time to decision, and review them monthly.
Fraud tools only flag. The system is what makes sure someone reads the flag before the box leaves.
Source: tool details checked against the Shopify Help Center pages on fraud analysis, managing chargebacks, resolving a chargeback, and Shopify Flow's triggers and actions lists. The system design and the expected effects are my own operator view.
Frequently asked questions
Can Shopify Flow hold a high-risk order automatically?
Flow has an Order risk analyzed trigger and a Hold fulfillment order action. I'd build the workflow on those and test it on real orders, since I haven't verified the exact condition fields.
What should I do with a high-risk order?
Shopify's fraud page gives three options: verify it with the customer, cancel it, or refund it. In this system a person makes that call.
How long do I have to respond to a chargeback?
Shopify says the deadline is typically 7 to 21 days after the chargeback is filed. Once evidence is submitted you can't change it.
What should I measure?
Chargebacks per month, the disputed amount and fees, your win rate, the share of high-risk orders held before fulfillment, time to decision, and genuine orders you cancelled.