The 2026 Shopify operator guide
Shopify fraud protection in 2026: native tools vs apps, compared.
By Adrien Bokor, founder of RefundSentry · Last reviewed
Shopify ships four fraud tools: fraud analysis, the Fraud Control app, Shopify Flow and Shopify Protect. They work at checkout and on the order. After the order, when refunds, returns and chargebacks come in, apps take over. This guide puts both side by side, from Shopify's own help pages: what each covers, what it misses, what it costs and who can use it.
Links /
One card, one browser, one address
7 accounts share them: 9 orders from Jan 9 to Aug 27, 2026. Most ship to 12 Elm St, Tacoma WA, written 3 ways.
Card ****4417Browser12 Elm StConnection
RefundSentry suggests High confidence
One person or a group?
7 accounts share a card, a browser, an address or a connection.
Your note Needed to confirm or dismiss
If you confirm: you can block all 7 in one step. Nothing happens in Shopify until you block.
If you dismiss: they keep ordering, and RefundSentry stops raising this group.
4fraud tools Shopify ships itself: fraud analysis, the Fraud Control app, Shopify Flow and Shopify Protect.Shopify Help Center
Growthe plan that fraud recommendations need, unless you use Shopify Payments. Fraud indicators come on Basic and up.Shopify Help: fraud analysis
7 daysto fulfill a Shop Pay order with valid tracking, for Shopify Protect to cover it.Shopify Help: Shopify Protect
At a glance
Native tools vs apps, at a glance
Four tools built by Shopify and four kinds of app. Shopify's are free and work at checkout and on the order; the apps cover what comes after, one gap each.
| Tool | What it does | Covers | Does not cover | Cost and eligibility |
|---|---|---|---|---|
| Shopify fraud analysisBuilt by Shopify | Rates online credit card orders it can verify as a low, medium or high risk of a fraud chargeback, with the indicators behind it. | Stolen cards and account takeover at checkout. | Refunds, returns and chargebacks after delivery. It never cancels an order: you verify, cancel or refund. | Free. Indicators on Basic and up; recommendations on Grow and up, or with Shopify Payments. |
| Shopify Fraud ControlBuilt by Shopify | Filters on emails, addresses and IP addresses; checkout rules block a matching checkout. | Buyers you already know are bad. | Buyers you do not know yet, and everything after checkout. | Free. Checkout rules need Shopify Payments. |
| Shopify FlowBuilt by Shopify | Runs actions when a trigger fires: hold fulfillment, cancel, tag, email, call an app. | Acting on a risk level, or on another app's trigger. | The signals themselves. Send HTTP Request needs Grow, Advanced or Plus. | Free on Basic, Grow, Advanced and Plus. |
| Shopify ProtectBuilt by Shopify | Reimburses fraudulent and unrecognized chargebacks on eligible Shop Pay orders. | The chargeback amount and its fee. | Every other dispute reason, such as item not received, and any order whose shipping address changed after checkout. | Free. US stores with US Shopify Payments; Shop Pay orders of physical items, fulfilled with tracking within 7 days. |
| Checkout fraud appsApp Store | Decide at checkout, some with a chargeback guarantee (Signifyd, NoFraud, Riskified, ClearSale, SEON). | Card-not-present fraud, account takeover, device and identity checks. | Refunds and returns after delivery. | Set by each app: see its listing. |
| Returns apps with policy rulesApp Store | Run the return portal with your policy (Loop Returns, AfterShip Returns, ReturnGO). | Return windows, reasons and fees. | The person behind many accounts, and chargebacks. | Set by each app: see its listing. |
| Return-fraud intelligenceApp Store | Reads your orders, refunds and chargebacks after checkout, and links the accounts behind them (RefundSentry). | Repeat refunds, one person behind many accounts, orders refunded and then disputed, evidence packs, orders waiting to ship. | Checkout decisions and the return portal: it works beside both. | From $49 a month, with a 14-day free trial. |
| Chargeback recovery appsApp Store | Answer disputes after they land (Chargeflow, Justt, Chargebacks911). | Evidence and deadlines. | Stopping the dispute from being filed. | Set by each app: see its listing. |
Shopify Protect is the row merchants ask about most: it is free, but it covers two dispute reasons, and the common ones are not among them. Shopify Protect eligibility, cost and coverage, explained
Definition
What Shopify fraud protection actually means
The phrase covers two different things. The first is what Shopify builds and ships for free: fraud analysis on online credit card orders, rule-based checkout blocking in Fraud Control, automation in Flow, and chargeback reimbursement on a narrow slice of Shop Pay orders in Shopify Protect. The second is the App Store apps for fraud, returns and chargebacks that fill in what those tools do not cover.
How much the native tools cover depends on you: whether you are in the US, on Shopify Payments, on Shop Pay, and on which plan. Read their conditions before you buy an app to replace them, and before you assume they cover you.
Built by Shopify
What Shopify ships natively
Four tools, each with its own scope, conditions and gaps.
01 / 04
Shopify fraud analysis
Shopify rates the online credit card orders it can verify: a low, medium or high risk of a chargeback due to fraud, with the indicators behind it. Among them: whether the card passes the address (AVS) and security code (CVV) checks, whether the customer's location matches the payment method, unusual device or network activity, and whether the customer tried more than one card.
What it covers
- Stolen cards and account takeover at checkout.
- Address, security code and location mismatches, shown as indicators.
What it misses
- Refunds, returns and chargebacks that come after delivery.
- Orders it cannot verify, such as orders not paid online by credit card.
- Acting for you: on a high-risk order, you verify, cancel or refund it yourself.
Cost: Free. Fraud indicators on Basic and up; fraud recommendations on Grow and up, or with Shopify Payments. Shopify Help: fraud analysis
02 / 04
Shopify Fraud Control app
A free app made by Shopify. You create filters on emails, address details and IP addresses, and checkout rules block a checkout that matches them, before an order exists. Checkout rules are only available with Shopify Payments.
What it covers
- Blocking a checkout from a buyer you already know.
- Rules on emails, addresses and IP addresses.
What it misses
- Buyers you do not know yet.
- Anything after checkout, returns and refunds included.
Cost: Free. Checkout rules need Shopify Payments. Shopify Help: the Fraud Control app
03 / 04
Shopify Flow
A free automation app on the Basic, Grow, Advanced and Plus plans. A trigger starts a workflow, conditions check it, and actions act on it: Hold Fulfillment Order, Cancel Order, Add Order Tags, Send Internal Email, and Send HTTP Request on Grow, Advanced and Plus.
What it covers
- Holding or tagging orders by risk level, on the Order risk analyzed trigger.
- Acting on the triggers other apps add, RefundSentry's included.
What it misses
- The signals: Flow acts on what Shopify or an app gives it.
- Send HTTP Request on the Basic plan.
Cost: Free on Basic, Grow, Advanced and Plus. Shopify Help: managing high-risk orders with Shopify Flow
04 / 04
Shopify Protect
Free chargeback protection from fraud on Shop Pay orders. When an eligible, protected order gets a fraudulent chargeback, Shopify reimburses the chargeback amount and its fee. It is for US stores with a US Shopify Payments account, on orders of physical items fulfilled with valid tracking within 7 days and in transit within 10 days.
What it covers
- Two reasons: the cardholder does not recognize the transaction, or says they did not authorize it.
- The chargeback amount and the chargeback fee.
What it misses
- Every other dispute reason, such as item not received or not as described.
- Any order whose shipping address changed after checkout.
- Stores outside the US, and orders not paid with Shop Pay.
Cost: Free, for eligible orders. Shopify Help: protecting an order with Shopify Protect
The older Fraud Filter app is gone. Shopify retired it; independent guides date the shutdown to January 31, 2025. Checkout rules now live in Fraud Control, and order actions in Flow. If you had Fraud Filter rules, check that the ones that mattered were rebuilt.
Where fraud happens
The four fraud surfaces every Shopify store has
Fraud does not happen at one point. It happens at four: at checkout, before shipping, after delivery, and across accounts. Each has its own signs, and its own coverage.
01
At checkout
Stolen cards, card testing, account takeover.
Shopify: fraud analysis flags the risk and Fraud Control blocks buyers you already know. Neither cancels an order for you. Gap: a high-risk flag still needs you, or a Flow workflow, to act.
02
Before shipping
The order is paid and waiting: the last moment to stop a parcel.
Shopify: Flow can hold fulfillment on the Order risk analyzed trigger. RefundSentry: checks every new order as it comes in and writes its verdict into the order's risk panel; holds an order only when you blocked the customer or switched on a rule that holds it; and lists the paid orders that have waited past your store's late day to ship, next to how often never-shipped orders were disputed at your store.
03
After delivery
Repeat refunds, never-arrived claims on delivered orders, orders refunded and then disputed.
Shopify: Flow has return triggers, and fraud analysis rates only the order at checkout. RefundSentry: reads every refund, return and chargeback and ties them to the person behind them. The return fraud playbook
04
Across accounts
One person behind several accounts, each one looking new.
Shopify: its tools do not show you which of your customer accounts belong to the same person. RefundSentry: links accounts that share a card, a browser, an address written differently, a device or connection, or the exact same email once a +tag or the dots in a Gmail address are set aside. It reads your store's own history, not other stores'.
The App Store
The five fraud app categories on the Shopify App Store
Each category covers one moment. Two apps that decide on the same order at the same moment get in each other's way; apps from different categories work side by side.
01 / 05
Checkout fraud, some with a chargeback guarantee
Signifyd, NoFraud, Riskified, ClearSale, SEON
- What it catches
- Stolen-card fraud, card testing, account takeover, identity and device anomalies at checkout.
- What it misses
- Repeat refunds, returns abuse and never-arrived claims after delivery.
- Pricing
- Set by each app: see its listing.
02 / 05
Returns management with policy rules
Loop Returns, AfterShip Returns, ReturnGO
- What it catches
- Your policy in the return portal: windows, reasons, fees.
- What it misses
- The person behind many accounts, payment fraud and chargebacks.
- Pricing
- Set by each app: see its listing.
03 / 05
Return-fraud intelligence
RefundSentry
- What it catches
- Repeat refunds, one person behind many accounts (a shared card, browser, address, device or connection, or the exact same email), orders refunded and then disputed, evidence packs for Shopify Payments disputes, paid orders waiting too long to ship.
- What it misses
- Checkout decisions, which the checkout app makes, and the return portal, which the returns app runs.
- Pricing
- From $49 a month, with a 14-day free trial through Shopify.
04 / 05
Chargeback recovery
Chargeflow, Justt, Chargebacks911
- What it catches
- Answering disputes after they land: the evidence and the deadlines.
- What it misses
- Stopping fraud at checkout. Recovery comes after the loss, and Visa still counts the dispute.
- Pricing
- Set by each app: see its listing.
05 / 05
Identity checks
Several App Store apps check a buyer's identity or age
- What it catches
- Fake accounts and made-up identities at signup or checkout.
- What it misses
- Real people who abuse returns, and chargebacks.
- Pricing
- Set by each app: see its listing.
The usual stack is Shopify's own tools, one returns app if you take many returns, one return-fraud app once repeat refunds show up, and a chargeback recovery app if your dispute volume calls for it. RefundSentry works beside your checkout fraud app and your returns app, and replaces neither. RefundSentry beside these tools, question by question ·
Shopify Flow
The Shopify Flow fraud-automation playbook
Flow is the automation. The signals are yours to bring. Three recipes most stores can use.
The trigger pitfall. Shopify says to use Order risk analyzed, not Order created, for high-risk orders: fraud analysis takes some time after the order is created, so a workflow that starts at creation reads a risk level that is not there yet.
01
Hold high-risk orders for review
- Trigger
- Order risk analyzed (not Order created: the risk level is not ready yet then)
- Condition
- The order's risk level is high
- Actions
- Hold Fulfillment Order, Add Order Tags (review: fraud), Send Internal Email to the team
02
Tell the team when RefundSentry holds an order
- Trigger
- Order Held by RefundSentry
- Condition
- None needed
- Actions
- Send Internal Email, or Send HTTP Request to your team chat (Grow, Advanced or Plus)
03
Tag a return that needs a second look
- Trigger
- High-Risk Return Detected (RefundSentry)
- Condition
- None needed
- Actions
- Add Order Tags (manual-review), Send Internal Email
One plan limit: Send HTTP Request, the action that posts to a chat tool or calls another service, is on Grow, Advanced and Plus only. Basic stores keep the email and tag actions. More Flow templates for fraud
In the Shopify admin
Why native Shopify Admin integration matters
A fraud app that lives in a separate dashboard breaks the workflow. One that writes into the order page keeps the team in one place.
The mutation that matters: orderRiskAssessmentCreate
Since API version 2024-04, Shopify's older Order Risk API is deprecated. An app adds its own assessment to an order with the GraphQL mutation orderRiskAssessmentCreate: a risk level and the facts behind it, shown in the order's risk section next to Shopify's own. Shopify then sends the orders/risk_assessment_changed webhook.
RefundSentry writes its verdict into each order's risk panel this way, from the start; you can switch it off in Settings. It also adds its own block to the order page: the reasons behind its verdict, and Held by RefundSentry when it holds the order.
RefundSentryHeld by RefundSentry
Check this order before you ship it.
- Paid with the card ending 4417, used on 5 accounts you blocked
- Placed from the browser 6 of those accounts used
- [email protected] is [email protected] with a +tag
Why it is held: card of a blocked customer, browser of a blocked customer. You release it or cancel it.
What to do
How to decide: a Shopify operator's framework
Four questions before you spend on an app. Answer them and the category usually picks itself.
01
Is your chargeback rate climbing?
Shopify does not publish the rate at which it acts; it says it holds stores to a higher standard than the card networks, and it can put a reserve on your payouts. If disputes are rising, screen stolen cards at checkout and put evidence on every dispute you can answer. Chargeback prevention for Shopify
02
Where is the money actually leaking?
Look at the last 90 days. If it leaves as stolen-card chargebacks, you need a checkout app. If it leaves as refunds and disputes after delivery, a checkout app will not see it: you need something that reads the refunds and the people behind them.
03
Do you already have a returns app?
Keep it. The returns app runs the portal; RefundSentry reads the refunds, links the accounts behind them and works beside it.
04
What would it have caught?
Before any app blocks or holds on its own, see what it would have matched. In RefundSentry every rule starts paused and shows its matches on your history before you switch it on. When to actually block a customer
Questions
Shopify fraud protection, answered
What is Shopify fraud protection?
It is two things. First, the tools Shopify builds: fraud analysis, which rates each online credit card order for fraud risk; the Fraud Control app, which blocks checkouts by rules; Shopify Flow, which automates what happens next; and Shopify Protect, which reimburses fraudulent chargebacks on eligible Shop Pay orders. Second, the App Store apps that cover what those tools do not, most of it after the order.
Does Shopify have built-in fraud protection?
Yes. Stores on Basic and up get fraud analysis: indicators on Basic and up, and low, medium or high recommendations on Grow and up or with Shopify Payments. The free Fraud Control app blocks checkouts by rules, with Shopify Payments. Flow is free on Basic and up. US stores on Shopify Payments also get Shopify Protect on eligible Shop Pay orders. None of them scores returns or refunds, and fraud analysis leaves the decision on each order to you.
What does Shopify Protect actually cover?
Fraudulent and unrecognized chargebacks on eligible Shop Pay orders: Shopify reimburses the chargeback amount and its fee. The store must be in the US with a US Shopify Payments account, the order must contain only physical items, and it must be fulfilled with valid tracking within 7 days and in transit within 10. Changing the shipping address after checkout voids the protection. Other dispute reasons, such as item not received or not as described, are not covered.
Is Shopify Protect free?
Yes. Shopify says the feature is available for free and protects eligible orders against fraudulent and unrecognized chargebacks. The limits are in the eligibility: the two covered reasons, US stores, Shop Pay orders of physical items, and fulfillment with tracking within 7 days.
Does Shopify Fraud Analysis catch return fraud?
No. Fraud analysis rates the order for payment fraud at checkout: the card checks, the location, device and network activity. It does not look at return requests, refunds or what a customer does after delivery. Return fraud needs a returns app with policy rules, a return-fraud app like RefundSentry that reads the refunds and links the accounts behind them, or both.
What replaced the Shopify Fraud Filter app?
Shopify retired the older Fraud Filter app; independent guides date the shutdown to January 31, 2025. Checkout rules now live in the free Fraud Control app, which needs Shopify Payments, and order actions in Shopify Flow. If you had Fraud Filter rules, rebuild the ones that mattered in one of the two.
What's the best fraud app for Shopify?
There is no single best: it depends on where the money leaks. For stolen cards at checkout, a checkout fraud app such as Signifyd, NoFraud or Riskified. For the return portal, a returns app such as Loop Returns or AfterShip Returns. For repeat refunds, linked accounts and chargeback evidence after the order, RefundSentry works beside both. For answering disputes at volume, a recovery app such as Chargeflow or Justt.
Does Shopify submit chargeback evidence for me?
Partly. Shopify pre-fills and sends basic order information: the products, the shipping company and tracking, the fulfillment date, the addresses, the order date, and the customer's IP address and country. On Shopify Payments it sends the response saved on the dispute at the due date. Anything more, such as the refund already made or the buyer's other accounts, is yours to add before then.
Primary sources cited on this page
- Shopify Help: fraud analysis
- Shopify Help: the Fraud Control app
- Shopify Help: Shopify Flow
- Shopify Help: managing high-risk orders with Shopify Flow
- Shopify Help: Shopify Flow actions
- Shopify Help: Shopify Protect
- Shopify Help: protecting an order with Shopify Protect
- Shopify Legal: terms for Shopify Protect
- Shopify Help: resolving a chargeback
- Shopify Help: reserves on Shopify Payments
- shopify.dev: the orderRiskAssessmentCreate mutation
- shopify.dev: deprecation of the Order Risk APIs, 2024-04
Last reviewed 27 September 2026. Shopify changes its tools and pages often; check the linked page before you decide. Disclosure: RefundSentry sells return-fraud software for Shopify, so we have a stake in how the return-fraud category is described.
Start
See who is behind your refunds.
Install, approve a plan to start the 14-day free trial, and RefundSentry reads your history first. Then you choose what, if anything, runs on its own.