Shopify's risk level is a coarse triage, not a verdict. 'High' catches obvious fraud (a few percent of orders), but Aurai's book shows the majority of actual chargebacks come from 'low' and 'medium' risk orders — because friendly fraud looks legitimate at checkout by definition. The indicators panel (AVS result, IP distance, card attempts) is more useful than the headline color, and pairing it with a chargeback-trained model catches what checkout-time rules can't.
What the levels mean
Shopify's model scores every order and buckets it:
- Low — no meaningful signals fired. ~90%+ of orders.
- Medium — some signals fired (AVS partial match, IP/shipping distance). Worth a look before fulfilling.
- High — strong signals (CVV fail, proxy IP, multiple card attempts). Shopify recommends not fulfilling.
The model optimizes for *stolen-card* fraud — the kind visible at checkout. It's decent at that. It cannot see the fraud that happens after checkout.
The indicators that matter most
Ranked by predictive weight in Aurai's chargeback outcome data:
- CVV mismatch or not provided — strongest single checkout signal.
- Multiple card attempts before success — card-testing fingerprint.
- IP location far from shipping address — meaningful over ~500 miles, noisy below.
- AVS partial match — street matched but ZIP didn't (or reverse).
- Disposable email domain — weak alone, strong combined with #2 or #3.
One firing = noise. Two or more = review before fulfillment.
The friendly-fraud gap
60–75% of ecommerce chargebacks are friendly fraud — real customers disputing real orders. Those orders pass every checkout signal: correct CVV, matching AVS, home IP. Shopify's panel shows green because at order time nothing is wrong.
Catching that category takes chargeback-outcome data, not checkout rules — which orders, customers, and patterns historically turn into disputes. That's what Aurai Prevent scores on top of Shopify's panel, and it's included free with Aurai on the Shopify App Store.
Frequently asked questions
Should I cancel every high-risk Shopify order?
Review, don't auto-cancel. High-risk flags include false positives — VPN users, travelers, gift senders. Check the indicator combination first.
Why did a low-risk order become a chargeback?
Most chargebacks are friendly fraud — legitimate at checkout, disputed later. Checkout-time analysis can't see them; only dispute-outcome data can.
Post reflects public documentation, industry surveys, and Aurai's own book of disputes as of the publish date. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.