Fraud prevention for small stores
The kinds of fraud a small store actually sees, the platform tools that catch most of it, and the manual checks worth doing on the rest.
The short answer
A small store sees four kinds of fraud. Stolen cards used to buy goods that are resold. Friendly fraud, where a real customer disputes a real order after receiving it. Account takeover, where a customer’s login is used by someone else. And abuse of promotions, referral codes and returns. The platform’s fraud analysis and the payment provider’s checks catch most stolen-card fraud without the store building anything; the store’s job is to read the flags before fulfilling and to act on them with judgement. Friendly fraud is fought with evidence rather than detection. Account takeover is prevented with two-factor and rate limits. Promotion abuse is limited by the rules of the offers. None of it needs a fraud department; it needs a routine.
The four kinds and the response
| Kind | What it looks like | Prevention | Response |
|---|---|---|---|
| Stolen cards | New customer, high value, rushed shipping, billing and shipping countries differ, several attempts | Platform fraud analysis; payment authentication; address verification | Review flagged orders before fulfilment; contact or cancel |
| Friendly fraud | Dispute after delivery: “not received”, “not as described”, “did not order” | Clear descriptions; confirmations; delivery proof; visible policy | Answer every dispute with evidence |
| Account takeover | Orders from a real account to a new address; changed details | Two-factor for customers where offered; rate-limited logins; alerts on detail changes | Contact the customer; hold the order |
| Promotion and returns abuse | Repeated welcome codes; serial returns; wardrobing | Single-use codes; new-customer checks; returns policy with limits | Flag repeat patterns; enforce the policy |
The review routine
- Enable fraud analysis and payment authentication, and set the platform to hold high-risk orders for review rather than fulfilling automatically.
- Review flagged and high-value orders daily before fulfilment: five minutes for an ordinary store.
- Check the signals: address match, country consistency, quantity, shipping speed, order history, contact details that look real.
- Contact the customer when in doubt, by the phone number or email on the order; genuine customers answer.
- Cancel and refund when the evidence points to fraud; do not ship and hope.
- Keep evidence for every order: confirmations, tracking, delivery proof for higher values.
- Answer every chargeback with that evidence, promptly, in the format the provider asks.
Evidence against friendly fraud
Product pages that describe and show the product honestly, so “not as described” fails. Order and shipping confirmations with tracking. Delivery confirmation with a signature or photo for higher values. A returns and refunds policy visible at checkout and in the confirmation. Records of customer contact. With that file, a dispute is answered in minutes and many are won; without it, the store pays.
What this means for you
Turn on the platform’s fraud analysis and payment authentication, hold high-risk orders for a five-minute daily review, contact customers when in doubt, keep evidence on every order and answer every dispute with it. Add two-factor and rate limits against account takeover and single-use rules against promotion abuse. A small store does not need a fraud department; it needs the routine, and the routine takes minutes.
Frequently asked questions
How much fraud should a small store expect?
A small share of orders, varying by product category, price point and markets; high-value, easily resold goods attract more. What matters is not the rate but the response: platform fraud analysis enabled and read, flagged orders reviewed before fulfilment, chargebacks answered with evidence. Stores that do those three keep losses to a footnote.
Should we cancel every order the platform flags as high risk?
Review, not auto-cancel. High-risk flags include genuine customers with unusual patterns: a gift shipped to another address, a business buying in quantity, a traveller. Check the signals, contact the customer if in doubt, and cancel when the evidence points to fraud. Auto-cancelling loses real orders; auto-fulfilling loses money.
What is friendly fraud and how do we fight it?
A real customer disputing a real order: they forgot, a family member ordered, or they want the goods free. The defence is evidence: a clear product description and images, order and shipping confirmations, delivery confirmation with signature or photo for higher values, and a returns policy shown at checkout. Answer every dispute with that evidence; many are won.
Sources
- Shopify Help Center: Fraud analysis (accessed 2026-09-12)