Card-not-present orders taken by hand (drafts, phone, invoice links) skip [Shopify's fraud analysis](/blog/shopify-fraud-analysis-explained) and capture no browser/IP session evidence — and disputes on them start evidence-poor. Compensating controls: send invoice links for customer-completed payment where possible (restores card-field verification), verify identity manually on phone orders, and document the human interaction — the call notes ARE the session data.
What drafts skip
A draft order paid by manually-entered card bypasses: fraud analysis (no risk score generated), session capture (no IP, no device data on the order), and depending on entry path, full AVS/CVV verification.
Dispute impact: a fraud claim on a draft order starts with an empty evidence locker — no session to match, no risk assessment to cite, sometimes no AVS result. Fraud rings probe for exactly this: a 'corporate buyer' calling in a large order, card details read over the phone, rush shipping requested.
Compensating controls
- Prefer invoice links over manual entry: a draft-order invoice the customer pays themselves runs through card verification and captures their session — restoring most defenses with zero friction.
- Phone verification protocol: for true phone entry, verify billing address against the card (manual AVS), call back on a number independently found (not caller-provided), and log both in the order note.
- Document the interaction: who called, what was discussed, callback confirmation — narrative evidence for the dispute that session data would otherwise anchor.
- Threshold rule: above ~$500, manual entry needs manager sign-off or conversion to an invoice link.
Aurai treats draft-order disputes with the evidence that does exist — payment verification results, interaction notes, fulfillment records — and Prevent flags anomalous draft patterns (volume, value, velocity) that suggest the phone-channel probe.
Frequently asked questions
Do draft orders get Shopify fraud analysis?
No — fraud analysis runs on checkout sessions. Manually-entered draft payments generate no risk assessment and no session data.
Are phone orders higher fraud risk?
Structurally yes — no digital verification, and fraudsters specifically target the human channel. Invoice links restore most defenses; use them wherever the customer can self-pay.
Post reflects public documentation, industry surveys, and Aurai's own book of disputes as of the publish date. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.