Online shop

Hold risky Shopify orders for a manual check

Risky order automation checks every paid Shopify order against Shopify’s fraud analysis and a set of rules you choose. Orders that look wrong are held before packing, and the team decides in Slack whether to release, verify or cancel them.

An example of how the studio would build it. No live services are connected.

From a paid order to a held parcel and a quick human check.

  1. Step 01

    Order paid

    Shopify reports a paid order through a webhook.

  2. Step 02

    Risk checked

    Read Shopify’s risk assessment and apply your own rules, such as a first order of high-value items to a new address.

  3. Step 03

    Fulfilment held

    Place a fulfilment hold on the order, so it doesn’t reach the packing queue.

  4. Step 04

    Team asked

    Post the order to Slack with the reasons it was held and what the team can check.

  5. Step 05

    Released or cancelled

    A person releases the hold, asks the customer to verify, or cancels and refunds the order in Shopify.

The result

Suspicious orders caught before they leave the building.

The automation only ever holds orders. Releasing, cancelling and refunding are always a person’s decision, and an order is held once however many times it is checked.

Before we connect it.

Where this is useful

Useful for shops selling electronics, designer goods or other easily resold items, where a fraudulent order means losing both the goods and the payment. A sensible first version holds only orders Shopify rates as high risk, then adds your own rules once you have seen what comes through.

What we need to connect

  1. 01Shopify access to orders, risk assessments and fulfilment holds.
  2. 02A Slack channel for held orders and the people who can release or cancel them.
  3. 03Your own warning signs, such as order value, a billing country that differs from the delivery country or several orders in a short time.

What needs careful handling

A flagged order may well be genuine, such as a gift sent to another address, so the default is to hold and check, never to cancel automatically. Holds need releasing quickly in busy periods, so orders held too long are raised again rather than forgotten. Any contact to verify a customer uses the details on the original order, never a phone number or link supplied later by someone claiming to be them.

Questions people ask.

Doesn’t Shopify already do this?

Shopify provides fraud analysis, and Shopify Flow can act on it, which may be all you need. A custom flow helps when you want your own rules, a clear discussion in Slack and a record of each decision.

Will it delay genuine orders?

Only the ones that are held, and only until someone looks. With tight rules and prompt checks, the aim is that genuine customers notice no difference.

All automation examples