How to Spot Fraudulent Online Orders Before You Ship Them

A big order lands overnight: 3 of your most expensive items, express shipping, an address 2,000 miles from the billing ZIP code. Is it your best customer of the month, or a stolen card that will turn into a chargeback in 6 weeks?

When a fraudulent order slips through, you usually lose the product, the shipping cost, the sale amount and a dispute fee. Too many disputes can also put your payment account at risk. But blocking every unusual order turns away real buyers, such as gift senders and travelers. The goal is to recognize patterns, not to treat every order as a suspect.

This guide covers the red flags to look for, how to read the fraud signals your platform already gives you and how to set filters that catch fraud without killing conversions.

The most common types of ecommerce fraud

Knowing what you’re up against makes red flags easier to read:

• Stolen card fraud: someone uses stolen card details to buy goods they can resell. The real cardholder disputes the charge.
• Card testing: bots try many stolen card numbers with small purchases to see which ones work. Stripe describes it as using scripts to test large amounts of card data at once.
• Reshipping fraud: goods paid for with stolen cards go to a “reshipper,” often a person recruited through a fake job offer, who forwards them on. The FTC has warned consumers about these schemes.
• Friendly fraud: a real customer makes a purchase, then disputes it, claiming it never arrived or wasn’t authorized.
• Account takeover: a criminal logs in to a real customer’s account and orders with saved payment details.

Each type leaves different clues. Stolen card fraud shows up at checkout. Friendly fraud shows up later, which is why good records matter, as covered in our guide to preventing and fighting chargebacks.

Red flags to check on every risky order

No single signal proves fraud. A mismatched address might be a gift. What matters is when several signals line up.

Key takeaway: Judge the whole order, not one signal. A gift order with a mismatched address is normal. A mismatched address plus a failed CVV, a forwarder address and overnight shipping is a strong pattern.

How to read the fraud signals your platform already gives you

Most store platforms and payment processors score orders for you. Learn what yours shows before buying extra tools.

Shopify fraud analysis

Shopify’s fraud analysis gives eligible online card orders a low, medium or high risk rating, plus a recommendation such as “You can fulfill this order,” “Confirm with the customer before fulfilling” or “Consider canceling this order.” The indicators include AVS and CVV results, whether the customer’s location matches the payment method, unusual device or network activity and multiple card attempts.

Shopify advises judging by the overall risk level and recommendation rather than counting indicators. It also notes that an IP address or location alone isn’t a fraud recommendation. Indicators require the Basic plan or higher, and recommendations require the Grow plan or higher, or Shopify Payments.

Stripe Radar

Stripe’s Radar screens every payment with default rules. It blocks payments at the highest risk level and sends payments with an elevated risk level for review by default. Depending on your Radar plan, you can write custom rules to:

• Request 3D Secure for risky or new customers
• Review payments that match a pattern, such as high-value orders on prepaid cards
• Block payments you’re confident are fraudulent
• Allow trusted patterns, which Stripe says to use sparingly because allow rules override everything else

Stripe also offers built-in rules to block payments that fail CVC or postal code checks, even when the issuer approved them.

PayPal, Square and others

Other providers offer similar risk scoring and filter tools. Check your dashboard for risk flags, and learn which payments the provider covers under its own protection programs and which it leaves to you. Our comparison of Stripe vs PayPal for online stores covers the broader trade-offs.

How 3D Secure shifts liability

3D Secure (3DS) adds an extra authentication step, such as a code or banking app approval, for the cardholder. According to Stripe, when 3DS authenticates a payment, liability for fraud-related disputes typically shifts from the seller to the card issuer.

The trade-off is friction. Stripe warns that using 3DS on every payment can lower conversion rates. A common approach is to request 3DS only on risky payments, such as orders above a set amount with an elevated risk score, or on cards your store has never seen before.

3DS doesn’t protect you from every dispute. “Item not received” and “not as described” claims still depend on your delivery proof and product descriptions.

Setting fraud filters without blocking good customers

Overly aggressive rules cost real sales. Use this approach:

1. Start with review, not block. Stripe recommends using review rules first when you’re unsure, then turning patterns into block rules once you see the results.
2. Test rules against past orders. Stripe’s rule testing simulates how a rule would have affected the last 6 months of charges, so check how many legitimate orders it would catch.
3. Combine conditions. “Block all foreign cards” is too broad. “Block foreign cards with an elevated risk score” is narrower.
4. Use manual payment capture for risky orders. Shopify notes you can authorize payment and investigate before capturing it.
5. Revisit rules monthly. Fraud patterns change. Remove rules that no longer match anything.

How to verify a suspicious order

When an order looks risky, contact the customer before shipping:

• Email or call using the details on the order. Ask them to confirm the order and shipping address. Fraudsters often go silent.
• Search the shipping address. A map search showing a warehouse or freight forwarder for a consumer order is worth a closer look.
• Check order history. A returning customer with past successful orders is lower risk.
• Don’t ask for full card numbers or photos of cards by email. That creates security and PCI risks. Our guide to PCI DSS for small businesses explains why.

If you can’t verify the order, refund it rather than ship it. A refund before shipping costs you a small processing loss at most. A chargeback after shipping costs the product, shipping and a dispute fee.

What to do when card testing hits your store

Card testing looks different from normal fraud. Stripe lists the common symptoms: a spike in failed or blocked payments, and a spike in small payments with nonsense names and email addresses.

If you see this:

1. Refund any small payments that went through, so they don’t become disputes.
2. Add a CAPTCHA to checkout and card forms, or make sure your provider’s protection is turned on.
3. Add rate limits on how many cards one visitor or IP address can try.
4. Contact your payment provider. They can often apply extra protection during an attack.

Hosted checkouts from major providers include built-in card testing protection, one reason many small stores choose them over custom payment forms. See how to accept payments on your website for setup options.

Where to start this week

1. Turn on the fraud tools you already pay for. Check Shopify fraud analysis, Stripe Radar or your provider’s settings.
2. Set a review threshold. Decide which orders get a manual check, such as anything over a set amount with a risk flag.
3. Write a short checklist for staff: addresses, AVS and CVV results, IP location, shipping speed, account age.
4. Use 3DS selectively on high-risk orders.
5. Require signature confirmation on high-value shipments, which also strengthens your chargeback evidence.
6. Publish a clear return policy to reduce friendly fraud.
7. Review disputes monthly for shared patterns, and turn those into rules.

Conclusion

Spotting fraudulent orders isn’t about suspicion of every customer. It’s about noticing when several warning signs stack up on one order, then pausing to verify. Use the risk scores your platform gives you, start with review rules before block rules, apply 3D Secure where it matters and refund rather than ship when you can’t confirm an order. A few minutes of checking can save the product, the shipping and the chargeback.

Sources

• Shopify Help Center: Fraud analysis — risk levels, recommendations, indicators and plan eligibility
• Stripe Docs: Radar fraud prevention rules — default rules, custom rules, 3D Secure liability shift and rule testing
• Stripe Docs: Protect yourself from card testing — card testing symptoms and mitigations
• FTC Consumer Alert: Signs of a reshipping scam — how reshipping schemes move goods bought with stolen cards