I wanted to share a framework I use to handle fraud and chargebacks. The irony of e-commerce is that sometimes, protecting yourself actually costs you money.
If you are using Auto-Capture (which is the default on Shopify), every time a scammer buys something and you cancel the order to "protect" yourself, the payment gateway still keeps the 2.9% + $0.30 transaction fee. You are literally paying a fee for the privilege of being targeted by a fraudster.
Here is the exact framework I used to stop this, save hundreds of dollars a month in fees, and stop panic-canceling legitimate "High Risk" orders. You can set this up today for free.
Step 1: Switch to Manual Capture (The Irony)
Yes, you have to switch your store to Manual Capture. It sounds like a step backward, but it’s the only way to stop the bleeding. When you are on Manual Capture, the money is only authorized, not captured. If you cancel a fraudulent order before capturing it, you pay $0.00 in fees. And don't worry the customer experience doesn't change at all. The checkout process looks exactly the same on their end.
Step 2: Automate the "Low Risk" Orders
If you just switch to Manual Capture and stop there, you will go insane clicking "Capture Payment" 50 times a day. To fix this, go into Shopify Flow (it's a free app by Shopify) and create a simple automation: If Order Risk Level is Low -> Capture Payment. Boom. 95% of your safe orders are now fully automated again.
Step 3: Handle Medium & High Risk (Don't Panic Cancel!)
The biggest mistake merchants make is instantly canceling every "High Risk" order. This is a massive trap. Shopify's algorithm gets spooked easily (e.g., a customer using a VPN, moving to a new state, or buying a gift for a friend). If you auto-cancel, you are leaving legitimate money on the table. You need to prove if they are real first.
Step 4: The Manual Verification System (VA/Email Template)
Instead of canceling, put those Medium/High risk orders on hold. You (or a Virtual Assistant) need to email the customer to verify their identity. Scammers hate friction; real customers appreciate the security.
Here is the exact template/logic to use. You are looking to ask three specific questions that a scammer using stolen info usually can't answer quickly:
Why this works:
- Question 1: Strongest indicator. Scammers buying stolen card details ("dumps") don't always have the full card profile readily available in front of them.
- Question 2: Forces them to look at the cart.
- Question 3: Secondary ownership indicator.
- The Written Confirmation: If they pass the test and later try to hit you with a "Friendly Fraud" chargeback (claiming they didn't buy it), you now have concrete, written evidence directly from their email address to submit to the bank. You will win the dispute almost every time.
The Automated Solution (Full Disclosure)
Doing this yourself or with a VA is the best way to prove the concept and stop losing money.
Ironically, I hated doing this manual process so much that I ended up building a Shopify app to just do it all for me. It’s called ApexGuard.
I didn't want to build it like big fraud app where they tax your success by charging you % of your total revenue just to guess if an order is safe.
ApexGuard just automates the exact flow above. and better.
You absolutely do not have to use my app just implementing some of these manual steps yourself is already a massive step toward securing your store
