A small store does not need an enterprise fraud platform, but it does need more than hope. A single fraudulent order can cost the product, the shipping, the processor’s dispute fee and an hour of someone’s time, and a run of them can attract the attention of your payment provider. At the same time, an over-eager rule that cancels honest customers costs sales you will never see, because the customer simply leaves. The craft of fraud rules for a small store is catching the obvious cases cheaply without punishing the many people who buy honestly.
This guide describes the signals that tend to matter, how to combine them into a simple score, how to route orders so that people look only at the doubtful ones and how to calibrate and monitor the rules. It assumes you already use your processor’s built-in tools; the rules here sit on top of them. It sits beside our guide to chargeback prevention for online stores, which covers the wider layers, and the rule-building ideas in Shopify order automation rules.
What fraud looks like in a small store
| Type | How it works | What it costs you |
|---|---|---|
| Stolen card orders | A criminal uses stolen card details to buy goods that are shipped to them | The goods, shipping, the chargeback and a fee |
| Card testing | Many small attempts to find which stolen cards work | Processor fees, risk to your account and noise in your data |
| Account takeover | A genuine customer’s account is used to buy with saved details | A refund and an upset customer |
| Friendly fraud | A genuine customer disputes a purchase they made | A dispute and the order value |
| Reshipping and mule schemes | Goods go to a forwarding address and onward | The goods and a dispute weeks later |
Friendly fraud and returns abuse are covered in our dispute and returns guides; this guide focuses on stolen-card and takeover orders at the point of sale.
The signals that earn their place
Not every odd detail is a warning. A weak signal on its own is noise, since many honest customers do unusual things. A signal earns its place if it appears much more often in bad orders than in good ones in your own history. These are the families that most often do.
| Signal family | Examples | Strength | Caution |
|---|---|---|---|
| Address and card checks | Address verification mismatch, security code failure, repeated failed attempts | Strong | Not all banks and countries support address checks |
| Billing and shipping mismatch | Different countries, or a shipping address far from the billing address | Moderate | Gifts are legitimate and common |
| Order shape | Unusually large quantity, several high-value items, many expensive items of one type | Moderate | Wholesale and bulk buyers look like this |
| Speed and automation | Checkout in seconds, many orders from one device, bursts of failed payments | Strong for card testing | Fast checkout apps can look quick |
| Identity and contact quality | Disposable email, mismatched name and email, phone that does not fit the region | Moderate | Privacy-minded customers use alias emails |
| Delivery pattern | Freight forwarder or reshipper addresses, last-minute address changes, express shipping on a first order | Moderate to strong | Expats and travellers use forwarders legitimately |
| History | Previous dispute or confirmed fraud with the same email, address or device | Strong | Needs a record kept lawfully and carefully |
| Product risk | Items that are easy to resell, such as electronics, gift cards, designer goods | Moderate | Depends entirely on what you sell |
Notice how many strong signals depend on data from your processor. Use their address and security checks, their risk scores and their authentication tools, and treat your own rules as a second layer for what they cannot see, such as your delivery patterns and your product mix.
Combine signals into a score
A rule such as block all orders where billing and shipping countries differ will reject many honest gift buyers. A score avoids this by adding up modest evidence. Give each signal a number of points, add them and act on the total. The points need not be sophisticated; what matters is that several weak signals together raise suspicion while one alone does not.
| Signal | Points (example) |
|---|---|
| Address check fails | 25 |
| Security code fails or several failed attempts | 25 |
| Billing and shipping countries differ | 15 |
| First-time customer with an order above your high-value line | 15 |
| Shipping address matches a known forwarder | 20 |
| Express shipping on a first order | 10 |
| Disposable or mismatched email | 10 |
| Many orders from the same device or address in an hour | 25 |
| Previous dispute linked to this email or address | 40 |
| Returning customer with a long, clean history | minus 30 |
Example points only. Calibrate your own using your history, as described below.
Credit for good signals matters as much as penalties for bad ones. A customer with five previous orders and no problems should be much harder to flag than a stranger. Without negative points, a small store ends up annoying its best customers.
Route orders three ways
| Score band | Action | Who acts | Target time |
|---|---|---|---|
| Low (for example under 30) | Accept and fulfil as normal | Automatic | Immediately |
| Middle (30 to 59) | Hold fulfilment and review | A person, with a checklist | Within a few hours |
| High (60 and above) | Hold, contact or cancel | A person decides | Same working day |
The middle band is where the value is. A person looks at the order, perhaps checks the address on a map, searches the email, and sometimes emails the customer to confirm. Most middle-band orders turn out fine and are released, which is exactly why a person should look instead of the system cancelling them. Measure how long review takes; a held order that waits two days is a customer who has already gone.
What the reviewer checks
- Does the shipping address exist, and does it look like a home or business or a forwarding service?
- Does the name on the card plausibly match the name and email?
- Is the order consistent with what this customer or this kind of customer buys?
- Is there prior history with this email, address or device?
- Would a short, polite message asking to confirm the order resolve it?
Give the reviewer a standard message to send, and a clear outcome for each answer: release, ask for more proof, cancel and refund. Record the decision and the reason, because those records are how you improve the score later.
Keep false positives under control
Fraud work is lopsided: a fraudulent order is a visible, painful event, while a wrongly declined honest customer is invisible. That imbalance pushes rules to become stricter over time, until the store is quietly turning away real buyers. Counter it by measuring false positives deliberately.
- Track every held order’s outcome: released as genuine, cancelled as fraud, or unresolved.
- Report the release rate. If most held orders are released, your thresholds are too tight.
- Sample declined orders occasionally by contacting the buyer to see whether they were genuine, where it is legal and sensible to do so.
- Treat repeat customers kindly. Give strong negative points for clean history.
- Avoid blanket bans by country or email provider. They catch honest people and may breach other obligations, so take advice on trade restrictions separately.
- Be fair. Do not use characteristics such as name, ethnicity or religion as signals, and make sure your rules do not discriminate indirectly.
Calibrate with your own history
The example points above are only a start. To make them fit your store, take your last six to twelve months of orders and mark the ones that became chargebacks or confirmed fraud. Then, for each signal, compare how often it appeared in the bad orders with how often it appeared in all orders. A signal that appears in sixty percent of bad orders and ten percent of all orders deserves high points. A signal that appears in the same share of both deserves none. With a few dozen confirmed cases, you can set rough weights; with only a handful, lean on your processor’s tools and keep your own rules simple.
| Step | What to do | Output |
|---|---|---|
| 1. List the bad orders | Chargebacks and confirmed fraud over twelve months | A set of orders to learn from |
| 2. Tag signals | For every order, record which signals applied | A table of orders and signals |
| 3. Compare rates | Signal frequency in bad orders versus all orders | A ranking of useful signals |
| 4. Set points and bands | More points for stronger signals, then choose thresholds | A first version of the score |
| 5. Back-test | Apply the score to history and count caught fraud versus held honest orders | Catch rate and review workload |
| 6. Review quarterly | Repeat with new data | Updated points and thresholds |
A worked example
Suppose a store takes 2,000 orders a month and sees 14 fraud-related chargebacks a month, a loss of about $2,200 including fees and lost goods. A score is back-tested on last year’s data. It would have placed 11 of every 14 fraud orders in the middle or high bands, and it would have held about 80 honest orders a month in the middle band. Review takes five minutes per held order, which is about seven hours a month. If review catches nine of the eleven and prevents about $1,700 of loss, the net benefit is clear, but note the honest orders that wait: 80 customers experience a delay. The store therefore sets a rule that a review must start within four working hours, and it tests whether a quick confirmation email lets most of them through faster. Illustrative numbers like these are the basis for deciding where to set the line.
Build, buy or combine
A small store can run a points score in a spreadsheet and a few rules in its store admin, or use a fraud tool from its processor. As volume grows, scoring, a review queue, history lookups and reporting deserve a proper build. Our fraud screening service builds the scoring and the review queue with your thresholds and clear records, and return fraud prevention applies the same thinking to refund abuse. For dispute handling after a fraud order slips through, see chargeback and dispute responses.
Sources and further reading
Figures and rules in this guide come from the primary pages below. Platform limits and prices change, so open the page before you build on a number.
- Stripe documentation: Radar and risk, processor risk scoring and rules
- Shopify Help Center: fraud analysis, risk levels and order protection
- Stripe documentation: 3D Secure, authentication and liability