Blocking fraudulent orders with Shopify Flow

Chargebacks quietly tax a growing store: you ship the goods, lose the product, refund the money and pay a dispute fee on top. On Stateside Distribution I built a Shopify Flow automation that catches high-risk and mismatched-address orders the moment they're placed and holds them for review — before anything ships. No app subscription, no custom code, just Shopify's native automation engine. Here's the exact logic.

Why Flow, and not a manual check

Manually reviewing every order doesn't scale and it's inconsistent — the one order that slips through at 2am is the one that charges back. Flow runs on every order, instantly, with the same rules every time. It's free on the Shopify and Advanced plans, it reads the same risk analysis Shopify already runs, and it can take real action: tag, hold fulfillment, notify staff, or cancel outright.

1. The trigger

Start the workflow on Order created. It fires once per order, before fulfillment, which is exactly the window where blocking is cheap. (If you want to lean on Shopify's fraud analysis specifically, the Order risk analyzed trigger gives you the assessment result to branch on instead.)

2. The conditions — what "suspicious" means

A single signal produces too many false positives. I combine a few so the workflow flags orders that are genuinely worth a human's time:

Trigger:  Order created

Condition (ANY of the following is true → treat as suspicious):
  • order.riskLevel  is  HIGH
  • order.billingAddress.countryCode  ≠  order.shippingAddress.countryCode
  • customer.numberOfOrders  is  0
    AND  order.totalPrice  is greater than  300
  • order.shippingAddress  matches an entry tagged  "blocked-address"

• Risk level HIGH — Shopify's own fraud analysis already scores this; Flow just reacts to it.
• Billing ≠ shipping country — a classic stolen-card pattern worth a second look.
• First-time customer + high total — a large order from a brand-new account is a common fraud shape.
• Known-bad addresses — repeat offenders. Keep a list (a metafield or a tagged reference) so an address that charged back once is caught automatically next time.

3. The actions

When a condition matches, do three things. First, tag the order so it's filterable in the admin and other automations can key off it. Flow accepts Liquid in the tag field:

{% comment %}
  Flow "Add order tags" action — Liquid is allowed in the tag field.
  Tag the order so staff can filter the admin and so downstream
  automations (fulfillment holds, Klaviyo) can react.
{% endcomment %}
review-fraud
{% if order.riskLevel == "HIGH" %}risk-high{% endif %}
{% if order.billingAddress.countryCode != order.shippingAddress.countryCode %}address-mismatch{% endif %}

Second, hold fulfillment so nothing can ship while the order is flagged. Third, send an internal email so a human actually looks — a flag no one sees is not a control:

Subject: ⚠️ Order {{ order.name }} held for fraud review

Order {{ order.name }} was flagged and fulfillment is on hold.

  Customer:  {{ order.customer.displayName }} ({{ order.email }})
  Total:     {{ order.totalPrice }} {{ order.presentmentCurrencyCode }}
  Risk:      {{ order.riskLevel }}
  Billing:   {{ order.billingAddress.city }}, {{ order.billingAddress.countryCode }}
  Shipping:  {{ order.shippingAddress.city }}, {{ order.shippingAddress.countryCode }}

Review in admin, then release the hold or cancel + refund.

4. Make it better over time

• Feed the loop — every real chargeback should add its address to the blocked list, so the same actor can't repeat.
• Tier the response — one flagged signal → tag and review; two or more → hold fulfillment as well. It keeps low-risk orders moving.
• Track the false-positive rate — if staff release most held orders untouched, the conditions are too aggressive. Tune them.
• Reassure good customers — a held order can send a short "verifying your order" email so legitimate buyers aren't left wondering.

The result

The same-day fraudulent orders that used to become next-month chargebacks now stop at the door: flagged, held and reviewed before a box is packed. It runs on every order without anyone thinking about it, it cost nothing beyond the plan the store was already on, and it's the kind of margin protection that quietly compounds — which is why it shipped alongside the WooCommerce-to-Shopify migration rather than as an afterthought.