🛡️ Shopify Anti-Fraud System. 🔬 A Specialist's Technical Guide to Fraud Detection Analysis · [2026]
## 🏗️ 1. Anti-Fraud Architecture
Shopify analyzes every order across multiple signals and assigns a risk level: 🟢 Low → 🟡 Medium → 🔴 High. The system operates on 5 layers:
🔧 **Layer 1 — Technical:** AVS, CVV, BIN check, IP analysis (geolocation, proxy/VPN/TOR, blacklist)
🤖 **Layer 2 — ML (Machine Learning):** pattern comparison against historical fraudulent transactions across all Shopify stores
🧠 **Layer 3 — Behavioral:** browser data scoring, click depth, navigation patterns, referral analysis
🌐 **Layer 4 — Ecosystem:** Shop Pay verification, cross-store Shopify network data, Shopify Protect
👁️ **Layer 5 — Manual:** verification department sees real-time activity — who's browsing, what they view, all user data
⚠️ Shopify Payments includes two fraud filters: **AVS** (address verification with bank) and **CVV** (card code check). Issuers prohibit CVV storage — requesting it confirms physical card possession.
## 📊 2. Scoring System: What Triggers Risk Points
Every order goes through a scoring model that sums risk points. Final score → 🟢 Low / 🟡 Medium / 🔴 High.
### 🔴 Factors that INCREASE risk score
— 🧬 Pattern matches known fraud (ML model) → strongest signal
— 📍 AVS mismatch → address doesn't match bank records
— 💳 CVV mismatch / unavailable
— 📮 ZIP mismatch → postal code doesn't match
— 🌀 IP = VPN / Proxy / TOR / Blacklisted
— 🔄 2+ cards or 5+ payment attempts
— 🌍 Billing and Shipping in different countries
— 📏 IP ↔ Shipping distance > 50 miles (80 km)
— 💰 First order immediately high-value
— 📧 Disposable / random email address
— 🚀 Express shipping from new buyer
— 📵 No phone or unresponsive number
— 🖥️ Hosting / Datacenter IP (not residential)
— ⏱️ > 3 orders from same IP per hour
### 🟢 Factors that DECREASE risk score
— ✅ AVS full match (Street + ZIP)
— ✅ CVV correct on first attempt
— 🏠 Residential IP from home ISP
— 📍 IP ≈ Shipping (< 50 miles)
— 🌐 Billing country = IP country
— ☝️ 1 payment attempt, 1 card
— 🔁 Returning customer with clean history
— 🖱️ Natural browsing behavior (2+ sessions, organic mouse movements)
## 🎨 3. Indicator Color System
Each parameter in the order card is color-coded:
🟢 **Green** — no risk. Lowers fraud score. Attribute matches "legitimate" orders.
Examples: CVV correct, AVS match, residential IP.
🔴 **Red** — Extreme Risk. Significantly raises fraud score. Matches fraudulent patterns.
Examples: AVS mismatch, proxy IP, multiple attempts.
⚪ **Gray** — neutral. No score impact. Additional context for manual review.
Examples: IP city location, IP address number.
All technical checks green (✅): CVV correct, AVS match, ZIP match, 1 attempt, 1 card, shipping 8 miles from IP, country matches, no proxy.
Two gray indicators: 📍 IP from Lake Ozark, Missouri + 🧬 "Some characteristics are similar to fraudulent orders observed in the past." The ML layer raised the score to Medium.
💡 **Takeaway:** even with perfect technical data, ML can elevate the risk level.
### 🔴 Case: Order #1018 — High Risk
Red banner ⛔ "High risk of fraud detected." Order blocked.
— 📧 abihawthorn@outlook.com — free email provider
— 🆕 1 order — first order, no history
— 📦 Economy shipping 8-12 days
🤔 **Paradox:** all tech checks (AVS, CVV, IP, 1 card, 1 attempt) are green. IP is 10 miles from shipping. But the metadata combination (🆕 first order + 📧 Outlook + 📵 no phone + 💰 high amount) outweighed the positive signals.
## 👻 5. How to Stay Invisible to Anti-Fraud
🌐 **IP address** → residential ISP only, same state/city. VPN/Proxy/TOR/Datacenter = ⛔
📏 **IP ↔ Shipping distance** → < 50 miles ✅ | > 50 miles = 🟡 | Different countries = 🔴
📍 **AVS** → full Street + ZIP match required ✅
💳 **CVV** → correct on first attempt ✅
🔄 **Payment attempts** → 1 attempt, 1 card ✅ | 2+ cards = ⛔
🏠 **Billing = Shipping** → same address or ≤ 50 miles ✅
📧 **Email** → real, established account 1+ years ✅ | Tempmail / random = ⛔
📱 **Phone** → working US number linked to name ✅ | No number / VOIP = ⛔
🖱️ **Behavior** → 2+ sessions over days, product browsing ✅ | 1 session + instant checkout = ⛔
⏱️ **Velocity** → < 3 orders from IP per hour ✅
💰 **Amount** → average for store ✅ | High on first order = ⛔
📦 **Shipping** → Standard / Economy ✅ | Express from new buyer = ⛔
💻 **Device** → stable browser ✅ | Switching mid-session / VM = ⛔
— 🗺️ **Maxmind GeoIP** — precise distance between IP and addresses
— 🔌 **SOCKS detection** — datacenter vs residential proxy
— 🖥️ **Browser fingerprinting** — Canvas, WebGL, fonts, plugins
— 🔗 **Referral analysis** — traffic source, browse depth, click count
— 📞 **411.com / TruePeopleSearch** — phone linked to billing address
— 🗺️ **Google Maps** — manual billing ↔ shipping distance check
— 🔐 **HaveIBeenPwned** — email in breaches (paradoxically confirms "realness")
## 🧠 6. Behavioral Analysis: Hidden Layer
— 🔗 **Traffic source** — organic, ads, direct URL. Direct from new visitor = ⛔
— 📖 **Browse depth** — 1 page → purchase = 🚩
— 🖱️ **Click count** — minimal interaction before checkout raises score
— ⏱️ **Time on site** — < 30 sec to purchase = 🚩
— 🖱️ **Mouse movements** — mechanical vs. natural with pauses
— 📊 **Session count** — ideally 2+ over several days
— 📋 **Conversion details** — Shopify shows: "1st session was direct, 1 session over 1 day" — 🟡 marker
✅ Normal buyer pattern: multiple sessions over 2-3 days → browse → cart → return → purchase. Google/Instagram referral. Natural mouse movements.
— 📍 **Geolocation** — city/state/country vs billing and shipping (Maxmind, ipinfo.io)
— 🔌 **Connection type** — Residential / Mobile / Datacenter / Hosting (ipqualityscore.com)
— 🌀 **Proxy/VPN/TOR** — Shopify built-in detection
— ⛔ **Blacklist** — known fraudulent IPs (abuseipdb.com)
— 🔓 **Ports** — open ports = server IP
— 🏢 **ISP / ASN** — home ISP vs hosting (ipinfo.io, bgpview.io)
📌 IP always visible: "This order was placed from IP address X.X.X.X." Merchants check via whatismyip.com, ip2location.com, infosniper.net.
## 🆔 8. Phone, Email, Identity
— 📞 Merchant may call with basic order questions
— 🔍 Number checked via 411.com, TruePeopleSearch.com
— ✅ Verified against name and billing address
— ⚠️ VOIP (Google Voice, Skype) = risk factor
— 🕐 Account age checked via Google
— 🔐 haveibeenpwned.com — breach presence paradoxically confirms realness
— 🚩 Random characters (xk47jf92@gmail.com) = red flag
— ⛔ Disposable services (tempmail) = blocked
🔗 **Cross-verification:** all data must be coherent — 👤 card name = shipping name, 📱 phone linked to same person, 📧 email not anonymous, 🌐 IP from same city.
💵 US chargeback fee: $15 (refunded on win).
— 🔄 **Duplicate / technical** → ~90% win ✅ → proof of refund/error
— 💳 **Credit not processed** → ~80% win ✅ → return policy, docs
— 📦 **Product not received** → ~70% win ✅ → tracking, POD
— 📝 **Not as described** → ~60% win 🟡 → description, shipping photos
— 😤 **Quality dispute** → ~50% win 🟡 → correspondence, policies
— 🎭 **Friendly fraud** → ~40% win 🔴 → delivery signature, IP data
— 💀 **Pure fraud** → ~20% win 🔴 → very difficult without AVS/receipt
📋 Process: buyer → bank → credit company → evidence request → 65-75 day review → decision. Files PDF/A, no audio/video.
## 🔐 10. Billing Descriptor Strategy (2FA)
⚙️ **Setup:** Settings → Payments → Shopify Payments → Manage → Customer Statement Descriptor → enter: `SP * StoreName 8426`. 🔄 Change code every 2-3 months.
🔑 **How it works:** on 🟡/🔴 risk, order goes on hold. Ask buyer for 4-digit code from banking app. ✅ Real cardholder sees it, ❌ fraudster without account access cannot.
📌 **Applied to:** Medium/High risk, multiple attempts, billing ≠ shipping, high-value orders, mismatched names.
📋 Chargeback protection for Shop Pay orders. Shopify covers 💰 full amount + shipping.
📌 **Requirements:** Shop Pay payment, fulfilled within 7 days, carrier handoff within 10 days, reason = fraud or "unrecognized."
— 🟡 **Shopify Protect** = potentially protected (pending)
— 🟢 **Protected by Shopify Protect** = fully covered
— 🔴 **Not protected** = conditions violated
⚠️ Risk may change within 24–72 hours. Wait for final ✅ "Protected" before shipping.
— 🏷️ Tag orders with billing/shipping mismatch
— 🏷️ Tag orders with multiple failed payment attempts
— 🔔 Push notification on High Risk
— 📊 Daily (10:00 AM) chargeback data + customer tagging
— 🔁 Repeat offender pattern detection
💡 Principle: the sooner on hold — the more time to verify before shipping.
## 📈 13. Dashboard: Real Store Analysis
📊 30-day data (Mar–Apr 2025): 1,548 sessions (+54%), $3,480 revenue (+515%), 17 orders (+467%), 0.78% conversion.
— 📈 467% order growth vs 54% session growth = disproportionate spike
— 📉 Low 0.78% conversion with order spikes = mass testing marker
— ⏱️ Sharp mid-March peaks → decline = carding attack pattern
## 🧩 14. External Anti-Fraud Services
🔌 Merchants can install additional apps:
— 🛡️ **NoFraud** — additional ML layer on top of Shopify
— 🔍 **SEON** — digital footprint, email social lookup
— 🚫 **Fraud Filter** — BIN, IP, geolocation rules, blacklists
— 💼 **Signifyd** — guarantee + chargeback insurance
— 🤖 **Kount** — AI scoring + device fingerprinting
🔒 External filters cannot be detected from outside.
Shopify's anti-fraud system analyzes not just the order, but the **buyer's account history** across the ecosystem. A "new" account with no organic activity is itself a scoring signal.
🧬 Shopify's ML model considers data across **all stores in the network**. An account that has existed for a long time, has purchase history, confirmed email and phone — its trust score is significantly higher. Fresh account with zero history + large order = 🔴.
— 🕐 Account aged 6+ months (ideally 1+ year)
— 👤 Name in profile matches billing data
— 📬 Active mailbox — newsletter subscriptions, Google footprint (not an empty inbox)
— 🔐 Email should appear in HaveIBeenPwned databases — paradoxically confirms account "life"
— ⛔ Avoid: tempmail, protonmail (anonymity association), random characters
— 📞 Real US number (not VOIP), linked to name through carrier
— 🔍 Number must pass checks via 411.com / TruePeopleSearch
— 🏠 Linked to same state/city as billing address
— ⛔ Avoid: Google Voice, TextNow, Skype numbers
— 🏠 Billing address = real, matches card data at the bank
— 📮 Exact ZIP code (AVS full match)
— 👤 Cardholder name = account name = shipping name
— 🏠 Residential IP from same state as billing + shipping
— 📍 Distance IP ↔ billing ↔ shipping < 50 miles
— ⛔ One IP address = one account. Don't mix
— 📧 Register email (or use an aged one)
— 👤 Fill out profile (name, address, photo)
— 🔔 Subscribe to newsletters from several Shopify stores
— 🛒 Create accounts at 3-5 Shopify stores
— 🔍 Browse products, add to wishlists
— 🖱️ Natural behavior — multiple sessions, different times of day
— 📱 Install Shop App (if available) — boosts ecosystem trust
3️⃣ **First Test Order (Days 8-14)**
— 💰 Small amount ($15-30) at a different store
— ✅ Let the order complete full cycle (payment → delivery → receipt)
— ⭐ Leave a review — creates a positive trail
4️⃣ **Building History (Days 14-30)**
— 🔄 2-3 additional small orders at different stores
— 📊 Gradually increase amounts
— 🏠 All orders to one address, from one IP
— ✅ Every order = clean cycle with no chargebacks
5️⃣ **Target Purchase (Day 30+)**
— 🎯 Account has history, trust score is built up
— 💡 Order amount within normal range for a buyer with history
— ❌ Empty account + immediate large order = 🔴 instant flag
— ❌ One email for multiple orders at different stores simultaneously
— ❌ Different names in email / billing / shipping
— ❌ Changing IP between farming sessions
— ❌ All orders in one day — doesn't look organic
## 🎮 Session Farming for Successful Purchase
Shopify tracks **in-store behavior** before purchase. Conversion details in the order card show: session count, days, traffic source. Direct visit → instant purchase = suspicious.
### 🧠 What Anti-Fraud Sees in Sessions
— 🔗 **Traffic source** — Google, Instagram, direct, referral link
— 📊 **Session count** — ideally 2-5 over 2-3 days
— ⏱️ **Session duration** — 3-10 minutes = normal
— 📖 **Pages viewed** — 5-15 pages per visit
— 🖱️ **Interaction depth** — clicks, scroll, hover, photo zoom
— 🛒 **Cart** — adding/removing items across different visits
— 📱 **Device consistency** — same browser/device throughout
⚠️ In Conversion summary anti-fraud sees: "This is their 1st order", "1st session was direct to your store", "1 session over 1 day" — all 🟡 Medium risk markers (visible in Fig. 1).
### 🗓️ Ideal Session Farming Scenario
**📅 Day 1 — First Visit (Session 1)**
— 🔗 Enter via Google (search for product keyword or brand)
— 📖 Browse homepage → catalog → 2-3 products
— 🖱️ Scroll descriptions, zoom photos, read reviews
— 🚪 Leave without buying — normal new buyer behavior
— 💡 **Don't touch the cart** on first visit
**📅 Day 1-2 — Return (Session 2)**
— 🔗 Enter via bookmark or direct URL (return visit)
— 📖 Browse other products + return to favorites
— 🚪 Leave without buying — "thinking about it"
**📅 Day 2-3 — Preparation (Session 3)**
— 📖 View pages: Shipping Policy, Return Policy, About Us, FAQ
— 🛒 Check cart — remove one item, keep target
— 📝 Check sizing chart, colors, variants
— 🚪 Can leave or proceed to purchase
**📅 Day 3-4 — Purchase (Session 4)**
— 🔗 Direct entry or from bookmarks
— ✍️ Fill forms without copy-paste (or slow paste with pauses)
— 📦 Select Standard / Economy shipping
— 💳 Payment → one attempt, one card
— 🖱️ **Page transitions:** 15-45 seconds (no instant switching)
— 📖 **Time on product page:** 1-3 minutes (scroll, zoom, read)
— 🛒 **Checkout time:** 2-4 minutes (fill forms, choose shipping)
— 🖱️ **Mouse movements:** non-linear, with pauses, "human" pattern
— ⌨️ **Typing:** varying speed, pauses between fields
— ⛔ **Direct → checkout in < 2 minutes** — machine behavior
— ⛔ **Copy-paste all fields** instantly — autofill without pauses
— ⛔ **1 session over 1 day** — no "thinking" before first purchase
— ⛔ **Straight-line mouse movements** — robot-like pattern
— ⛔ **Jump directly to product page** without browsing catalog
— ⛔ **No scrolling / interaction** with page content
— ⛔ **Instant page switches** (< 2 sec between clicks)
— ⛔ **Different device** across sessions (fingerprint mismatch)
### ✅ Final Pre-Purchase Checklist
— ✅ 2+ sessions over 2+ days ✔️
— ✅ First entry from Google (not direct) ✔️
— ✅ Cart used in a previous session ✔️
— ✅ Residential IP = billing = shipping city ✔️
— ✅ 1 payment attempt, 1 card ✔️
— ✅ Device fingerprint stable ✔️
1. 🏗️ **Multi-layered** — tech checks + ML + behavioral + manual. No single layer is sufficient.
2. 🎯 **Contextual** — same signals interpreted differently based on combination.
3. ⏱️ **Temporal** — risk can change over 24–72 hours as new data arrives.
4. 🤖 **Automation limits** — ML captures patterns, not causes → false positives.
5. 🌐 **Ecosystem** — effectiveness depends on payment method and merchant plan.
6. 👻 **Hidden layer** — behavioral analysis + fingerprinting can't be controlled technically alone.
7. 🔗 **Coherence** — all data must be logically connected and non-contradictory.