How to stop fraudulent Shopify orders before dispatch

A UK customer places an order, payment succeeds and a fulfilment app sends it for packing. A fraud warning appears afterwards. The weakness is the order of events: you reviewed the risk after another system had already received permission to work. A useful prevention process makes the commercial decision before stock leaves your control. It also records what should happen when a result is missing or an order has already been handed over.

This article uses Shopify’s official documentation and AirPost’s product copy, checked on 14 October 2026. It covers physical orders and a review process for a UK seller. It does not promise that a risk score identifies every fraudulent purchase. Your payment method, app configuration and actual order status determine which controls you can use. Start by writing down which event currently causes your fulfilment provider to receive an order.

Why can a new-order workflow run before the fraud result? #

Shopify documents that fraud analysis takes time. Its Order risk analyzed trigger runs when Shopify’s assessment is complete, rather than immediately on order creation. It also applies to Shopify risk assessments, not third-party assessments. That distinction matters if you installed another screening app. A workflow waiting for Shopify’s event cannot be assumed to wait for the separate provider’s decision as well.

Draw your actual sequence on paper: order created, payment authorised, risk result available, payment captured, fulfilment requested and parcel handed over. Put the event name beside each arrow. If an app reacts before your review decision, identify how to hold that handoff. A tag called review is only useful if the downstream system respects it. Check the receiving system instead of assuming that changing a Shopify label has stopped physical work.

A completed assessment provides a point at which your chosen policy can run. Decide which results allow approval, which require a person and which stop the order. Keep pending or unavailable results visible. Avoid making silence an approval, especially during a provider delay. The person monitoring exceptions needs a list they can act on, with the latest payment state and a clear indication of whether any fulfilment request has already gone out.

What does manual payment capture change for a UK Shopify seller? #

With a supported payment method, authorisation and capture are separate. Manual capture lets you review an order before collecting the authorised amount. Shopify Payments documents a standard authorisation period of 7 days. Use the expiry shown on the actual order and do not treat that period as a promise that every other provider works identically. An investigation needs an owner and a deadline before authorisation expires.

In the admin, Shopify describes Settings, Payments and the Payment capture method setting. Check existing apps before changing it. Shopify warns that automatic capture in its settings and an app that also captures payments can conflict. Your goal is a single understandable decision about capture. List all automations that can perform it, including workflows you enabled earlier and apps whose settings are managed outside the same screen.

Manual capture is not a universal switch for all transactions. Check how each offered payment method behaves. Also check already paid orders separately; changing a future capture rule does not reverse work already requested. For each suspect existing order, confirm the payment state, whether money was collected and where the goods are. Your next action may be cancellation, a provider refund or a physical stop, and those are different operations.

Which assessment results should send an order to a person? #

Shopify’s assessment includes a recommendation and individual indicators. Review the overall recommendation alongside its proposed next step; one favourable indicator is not a general clearance. A cardholder passing a check does not explain every unusual address change or order pattern. Use the provider’s available facts to decide what still needs verification, then record a brief reason for the outcome. Keep the customer communication neutral while you investigate.

Shopify lists order types without recommendations, including gift-card-paid orders, B2B orders, point-of-sale orders and subscription renewals. Separate those exceptions from a delayed assessment. Decide who reviews them and which information is available. This prevents a workflow from treating every order without a warning as if it had received a positive card-risk assessment. Your rule should distinguish an actual result from a field that was never supplied.

How do you make a Shopify Flow decision safe to repeat? #

Use the completed assessment event for a workflow that depends on Shopify risk. The official trigger reference lists actions including Capture payment, Cancel order and Hold fulfillment order. Select actions according to your configured process, then inspect the result on the order. A workflow notification should tell the reviewer what needs doing; it should not be mistaken for confirmation that a parcel has physically stopped.

1. 1

   Check the starting state

   Confirm which orders and payment methods are subject to the proposed capture and review process.

2. 2

   Wait for the right assessment

   Distinguish Shopify’s completed result from a third-party result, a pending field or an unsupported order type.

3. 3

   Make one approval decision

   Keep the reason and current payment state together; prevent another automation from approving the same order independently.

4. 4

   Confirm the downstream result

   Inspect the fulfilment request or hold and verify the receiving system uses the intended current order.

5. 5

   Review exceptions

   Track unresolved orders, expiring authorisations and any paid order that already reached a packer.

Before adopting the workflow, use Shopify’s supported test methods and check both the successful and held paths. You want evidence that an approved order reaches the right stock and an unresolved order remains unexecuted. A workflow history entry is one part of that evidence. Inspect the recipient’s queue too. Keep the test procedure small enough that someone can repeat it after a payment or fulfilment app changes.

What if a checkout is blocked before Shopify creates an order? #

Shopify Payments can block some high-risk checkout attempts before an order exists. Shopify documents these in the Blocked view of Orders, Abandoned checkouts. They have no order fraud recommendation because they never became orders. This explains why your order list alone may not show every attempt. Keep blocked checkout activity separate from a paid order that needs cancellation or from stock already allocated for dispatch.

If a genuine customer contacts you, investigate through your normal support process. Do not treat an emailed screenshot as permission to manually mark the order paid. Check the provider’s information and the supported way to complete the sale. Likewise, do not turn every blocked attempt into a pack request. The product and customer may look familiar while the particular payment remains unresolved. You need an approved order and confirmed payment path before execution.

Where does AirPost fit when paid orders transfer automatically? #

AirPost’s Shopify copy says paid orders go automatically to an AirPost sender and tracking returns to Shopify. That makes payment capture a relevant handoff boundary for supported card orders: your review should happen before the order becomes paid and reaches that process. Verify your installed setup. Do not assume that an additional Shopify review tag is an AirPost fraud filter; arrange an explicit stop procedure for an order already transferred.

For local fulfilment through AirPost, you place stock with a sender who packs and drops off orders. Give that person the latest approved order and address. If a warning arrives after transfer, ask whether the goods are still at the packing location and get confirmation of any stop. A change in your Shopify admin must be matched to the real execution state. The difference between stock ownership and supplier dispatch is explained in Shopify dropshipping versus local fulfilment.

For one small-parcel execution, the AirPost platform component is €0.85 and the recommended sender compensation is €2.25, giving €3.10 for those two components. If a held order never enters execution, that model has zero executions; if you wrongly release it and later need a separate replacement execution, the two-execution model totals €6.20. These are EUR components from constants checked on 14 October 2026. Transport, goods, packing materials and payment costs are additional; your agreed sender compensation can differ.

This calculation explains the value of placing review before work starts. It is not a refund promise for previously incurred charges. Track the confirmed original costs and any later execution separately. Once your sequence is clear, optimise the routine low-risk path while keeping uncertain orders visible. A fast approved dispatch process and a deliberate exception queue can share the same stock without giving every paid-looking event permission to move it.