Hold risky orders for a person to review, and decide before the payment expires
Updated · By Ecomsellertool editorial team
Hold an order before fulfillment when Shopify's fraud analysis rates it high or medium risk, or when your own rules flag it, such as a large first order. Each held order goes to one review queue with its signals and a decision date set inside the payment authorization window. A person ships it, verifies it with the customer or cancels it, and the record is kept for any chargeback.
- Shopify rates an order's risk of a fraud-related chargeback as low, medium or high, and says to wait for fraud analysis to finish before you fulfill (checked November 11, 2026).
- Shopify Flow's Order risk analyzed trigger fires when fraud analysis is complete, and only for Shopify's own risk assessments, not third-party apps.
- Shopify Payments gives credit card payments a 7-day authorization period; capture after that and you might be unable to collect any money for the order.
- Shopify Protect keeps eligible Shop Pay orders protected only if you fulfill within 7 days with valid tracking, and changing the shipping address after checkout voids it.
- Canceling an order with an uncaptured payment marks it Voided; refunding a captured payment does not return the credit card transaction fee.
The step map: who runs each step
Trigger: Shopify finishes fraud analysis on a new order (the Order risk analyzed trigger), or a third-party fraud app writes a risk assessment, plus a scheduled check every hour of every held order against its decision date.
| Step | What happens | Who runs it |
|---|---|---|
| 1 | When fraud analysis is complete, rules read the order's risk level and recommendation, the fraud indicators, the Shopify Protect status, the order total, the customer's order count and chargeback history, and the billing and shipping addresses. | Rule |
| 2 | The signal table runs: any matching row holds the fulfillment order with a Shopify hold reason and a note that names the signals. Orders with no matching row go to fulfillment as usual. | Rule |
| 3 | Each held order joins one review queue with its signals, the date its payment authorization ends and a decision date set two days before that. | Rule |
| 4 | An AI model writes a short summary of the signals from the order data only, and drafts a verification email when the row asks for one. It never sends, releases or cancels. | AI model |
| 5 | A person reviews the order, approves or edits the verification email, and decides: release and ship, keep waiting for the customer, or cancel and refund. | Person |
| 6 | Rules carry out the decision: release the hold and capture payment, or cancel with restock and the customer notice, then save the review notes, signals and messages to the order's record. | Rule |
| 7 | The hourly check moves any order still undecided on its decision date to a second person, and a weekly list shows held orders, decisions and any chargebacks on orders that were released. | Rule |
5 rule steps · 1 AI model step · 1 person step. A rule follows fixed logic you approve; an AI model handles messy input and its output is checked by rules; a person makes the calls listed below.
What stays with a person
- Releasing, verifying or canceling every held order
- Every message to the customer before it is sent, since a real customer can read a fraud check as an accusation
- Whether to hold a Shopify Protect order at all, since holding it past 7 days costs the protection
- Any change to the shipping address on a held order
- The signal table itself: the order value limit, which rows hold and which only flag
Which tools can run it
- Shopify Flow: the Order risk analyzed trigger, Hold fulfillment order and an alert, if you rely on Shopify's fraud analysis
- Shopify Flow or Shopify webhooks plus Zapier, Make or n8n, to add a review board, a verification email draft and the decision date
- Custom code on your accounts, for fraud app scores, the authorization clock, capture and void, and the evidence record
Systems it connects
- Shopify orders and fraud analysis
- Shopify Flow
- Shopify Payments or your payment provider
- Third-party fraud app, if you use one
- Helpdesk or email
- Slack or a review board
- 3PL or warehouse system
Build size: Medium
Shopify supplies the risk data and the hold; the work is the rule table, the authorization clock and keeping a clean record of each decision.
Most stores handle risky orders one of two ways. Either nobody looks, and the order ships before anyone reads Shopify's warning, or someone looks when they have time, and a real customer's order sits for a week until the payment can no longer be collected. Both cost money. This recipe puts every risky order in one queue, says why it is there, and gives a person a decision date that comes before the payment runs out. It is one page of our automation library.
Which signals should hold an order, and who decides?
Start with a written table, because "risky" means different things to different people on your team. Each row below names a signal, where the workflow reads it, what the rule does on its own and what stays with a person. Shopify's fraud analysis page rates each order's risk of a fraud-related chargeback as low, medium or high, and lists indicators such as address verification (AVS), the card security code (CVV), location against the payment method, unusual device or network activity and more than one card tried (checked November 11, 2026). The rows after those are your own rules. Copy the table and change the values.
| Signal | Where it comes from | What the rule does | What a person decides |
|---|---|---|---|
| Shopify risk level is high | The order's risk summary, read when the Order risk analyzed trigger fires | Hold with the high risk of fraud reason, top of the queue | Verify, cancel or refund |
| Shopify risk level is medium, or the recommendation is to investigate | The same risk summary; the recommendation values are accept, cancel, investigate and none | Hold, draft a verification email | Whether to send it, and what the reply proves |
| Address verification fails or the security code was wrong | The fraud indicators on the order | Flag on the queue card; hold only with another signal | Whether the mismatch has an innocent reason |
| More than one card tried at checkout | The fraud indicators on the order | Hold, because it often comes with other signals | Whether the customer's story fits |
| Customer's location does not match the card, or unusual device or network activity | The fraud indicators on the order | Flag; hold only with another signal | Whether to ask the customer |
| Billing and shipping addresses differ | Your rule on the order's two addresses (Shopify does not list this as an indicator) | Flag only; a gift or an office address is common | Whether it matters next to the other signals |
| First order from a new customer above your value limit | Your rule on the order total and the customer's order count | Hold for review | Ship, verify or cancel |
| Several orders from one customer in 24 hours | Your rule, or Shopify's Flow template for it | Hold all of them together | Whether it is a reseller, a test or a real repeat buyer |
| Customer has a recent chargeback | The customer's order history; Shopify's Hold fulfillment order page lists a template for this | Hold and alert operations | Whether to sell to them again |
| A third-party fraud app scores the order risky | The app's own risk assessment on the order | Hold, like Shopify's high risk | Same as high risk |
| The order shows Shopify Protect | The order's protection status | Do not hold past day 5; never change the address | Whether a hold is worth losing the protection |
| The customer asks to change the shipping address | A message or an order edit | Hold, and run the address check | Whether to accept the new address |
Two rules keep the table honest. A signal that is common among real customers, such as a different billing address, only flags; it holds when it appears next to another signal. And every hold carries one of Shopify's fulfillment hold reasons, such as high risk of fraud or incorrect address, plus a note naming the rows that matched, so the person opening the queue sees why at a glance. The value limit is yours to set; Shopify's own Flow template holds orders above $1,000.
How long can a held order wait before payment runs out?
Not long. Shopify's page on payment authorization and capture says Shopify Payments gives credit card payments a 7-day authorization period, and that you need to capture before it ends to receive any money from the order (checked November 11, 2026). Extended authorizations exist only for Shopify Plus stores on Shopify Payments: up to 30 days for Visa, Mastercard and American Express and up to 10 for Discover and JCB, with a 1.75% charge for capturing after the standard 7 days. Other payment providers set their own periods.
That clock only matters if you capture manually. Shopify's capturing payments page says card payments are captured automatically by default, and the authorization page lists reviewing the fraud analysis before you capture or cancel as a reason to switch to manual capture. Shopify's Flow templates include "Capture payment if order is not high fraud risk", so clean orders still get captured at once. On automatic capture, a canceled risky order becomes a refund, and Shopify's canceling orders page says credit card transaction fees are not returned when you refund. Cancel before capture and the payment shows as Voided.
A worked example of the review timeline
Here is an illustrative timeline for one order on a store that uses Shopify Payments with manual capture and the standard 7-day authorization. The days are examples, not advice for your store.
| When | What happens | Who |
|---|---|---|
| Day 0, 10:05 am | The customer checks out; the card is authorized, nothing is captured | Shopify |
| Day 0, a few minutes later | Fraud analysis completes: medium risk, two cards tried, a first order above the value limit. The order is held with the high risk of fraud reason and joins the queue with "authorization ends day 7, decide by day 5" | Rules |
| Day 0, afternoon | The reviewer reads the summary, edits the drafted email and sends it, asking the customer to confirm the order from the email address on file | Person, with a model draft |
| Day 2 | No reply. A shorter reminder goes out after the reviewer approves it | Person |
| Day 4 | The customer replies and confirms the order, but the details do not match the card's country | Person |
| Day 5 | Decision date. The reviewer cancels: the payment is voided, the items restocked and the customer told. Had the reply checked out, the hold would be released, payment captured and the order sent to the warehouse that day | Person decides; rules carry it out |
| Day 6 | Any order still undecided has already gone to a second person | Rules |
| Day 7 | The authorization would end; nothing is left in the queue for this order |
The decision date sits two days before the end of the authorization on purpose. It leaves a day to capture and a day for a slow approval, and it means the queue never holds an order the store can no longer charge for. On Shopify Plus with an extended authorization, the same rule can move the decision date out, though capturing after day 7 adds the 1.75% charge.
What changes when an order has Shopify Protect?
The hold itself can cost you. Shopify's page on protecting an order with Shopify Protect says it covers eligible Shop Pay orders for merchants in the United States with a US Shopify Payments account, for physical items that ship (checked November 11, 2026). To stay covered, you fulfill within 7 days of the order with valid tracking from a supported carrier, and the carrier marks it in transit within 10 days. Changing the shipping address after checkout voids the coverage. If a protected order gets a fraudulent chargeback, Shopify says the merchant is reimbursed the amount and the fee.
So the queue treats protected orders differently. The rule does not hold them past day 5, because the 7-day fulfillment window and the 7-day authorization end together, and it never edits their address. Shopify's protection status page says an order that was not fulfilled within the timeframe ends up "Not protected by Shopify Protect" (checked November 11, 2026). Shopify's fraud analysis page also says to review the protection status separately from the fraud indicators. Protection is for fraudulent and unrecognized chargebacks only, so a person still decides whether to ship.
Can Shopify Flow run the queue on its own?
Partly. The Order risk analyzed trigger starts a workflow once fraud analysis is complete, not when the order is created, and runs only for Shopify's own risk assessments (checked November 11, 2026). Its templates send high-risk orders to Asana or Trello for review, cancel high-risk orders, and capture or notify before capture. The Hold fulfillment order action takes a reason, notes and an option to notify the merchant. Our guide to what Shopify Flow automates covers the basic hold.
| Job | In Shopify Flow | Where a workflow tool or custom code takes over |
|---|---|---|
| Read the risk result | Order risk analyzed trigger and the order's risk fields | A third-party app's score: the app writes an assessment, and Shopify sends the orders/risk_assessment_changed webhook |
| Hold with a reason | Hold fulfillment order | Nothing more needed |
| One queue with a decision date | A task in Asana or Trello, or a Slack message | A board sorted by decision date, with the signals on each card |
| Verification email | Not practical: no draft-and-approve step | A model draft a person edits and sends from the helpdesk |
| Escalate an undecided order | A scheduled workflow can find held orders | A clock per order tied to its authorization |
| Keep the review record | Order notes and tags | A dated record of signals, messages and the decision |
In the Admin API, each order carries a risk summary with its assessments and a recommendation, and each assessment has a risk level of high, medium, low, none or pending (checked November 11, 2026). A pending result means the workflow waits. The same risk check also comes first in our Shopify orders to a 3PL rule table, which this queue feeds: once a hold is released, the order goes to the warehouse through the normal route. For how risky orders fit the wider routing problem, see the order routing gap.
What should you keep for a chargeback?
Everything the reviewer saw and did, saved on the day it happened. A released order can still turn into a fraudulent chargeback weeks later, and the strongest answer is a record that shows you checked: the risk level and indicators at review time, who reviewed the order and when, every message to and from the customer, the decision and its reason, and the tracking once it shipped. The workflow saves this as one dated file on the order's record. Our chargeback evidence recipe picks it up from there, so the pack for a Fraudulent dispute starts with the review instead of a blank page.
Canceled orders need a record too. Shopify's canceling page says to track canceled orders that were not refunded for follow-up, to avoid chargebacks. If you choose "Later" for the refund, the queue keeps the order open until the refund is done. The weekly list then shows what the table is costing and catching: orders held, how long they waited, how many were canceled, and any chargebacks on orders you released. If many held orders share one discount code, the code has probably spread beyond its audience, and our discount code leak alerts are the place to deal with it. Change the rows when those numbers tell you to, and keep support-ticket triage routing the customer's replies back to the order.
Who builds a high-risk order review queue?
Ecomsellertool builds workflow automation on your own Shopify store, payment settings, helpdesk and warehouse connection. We have built software on Amazon's seller APIs since 2017 and shipped 50+ tools for 100+ teams. We write the signal table with you first, then build the holds, the queue, the authorization clock, the drafts and the evidence record. Decisions stay with your team. Send a project brief or read how our workflow automation service works.
The building blocks are work we have shipped:
- Orders from every channel in one queue. For Seller7 we built one order table across Amazon, Walmart, Target Plus, Shopify and Mirakl, with marketplace status on each order and a single action to process it, replacing the back-and-forth between seller centrals.
- Rules with criteria, a schedule and a log. For TRAKTOR we built rule-based automation that runs advertising rules on a set frequency when their criteria are met and records each run in an action log. The signal table and its decision record work the same way.
The queue can run on Ecomsellertool Growth OS beside your order routing and returns workflows.
Get your review queue built
Send us the orders you worry about
Describe the workflow you want automated. We reply with a written plan: scope, timeline and a fixed price.
Frequently asked questions
How do I automatically hold high-risk orders in Shopify?
Use Shopify Flow's Order risk analyzed trigger, which fires once fraud analysis is complete, with a condition on the risk level and the Hold fulfillment order action. Shopify publishes a template that holds fulfillment when risk is high. Add a tag and an alert so someone reviews each held order, and keep cancel decisions with a person.
Should I cancel every high-risk order Shopify flags?
No. Shopify's guidance for high-risk orders is that you can verify the order, cancel it or refund it, and its recommendation can be to confirm with the customer before fulfilling. Some flagged orders are real customers, such as gift buyers or travelers. Review the indicators, contact the customer when it is unclear, and cancel when the answer does not hold up.
How long can I hold an order before the payment expires?
On Shopify Payments, credit card authorizations last 7 days. If you capture manually, capture before that or you might not collect the money. Shopify Plus stores on Shopify Payments can get longer authorizations for some card brands, up to 30 days for Visa, Mastercard and American Express, with a 1.75% charge for capturing after the standard 7 days.
Does Shopify Protect mean I can skip fraud review?
For eligible orders it changes the math. Shopify Protect covers fraudulent and unrecognized chargebacks on eligible Shop Pay orders from US merchants on Shopify Payments, if you fulfill within 7 days with valid tracking and the carrier has it in transit within 10 days. Holding a protected order too long, or changing its address, loses that cover.
Does a third-party fraud app work with Shopify Flow's risk trigger?
Not with the Order risk analyzed trigger, which runs only for Shopify's own risk assessments. Fraud apps can write their own assessment to the order through the Admin API, and Shopify sends an orders/risk_assessment_changed webhook when one is created, so a custom workflow can listen for that instead.
What should I keep in case a held order becomes a chargeback?
Keep the risk level and indicators at the time of review, who reviewed the order and when, every message with the customer, the decision and the reason, and the tracking once it ships. That record feeds the evidence pack if the cardholder later disputes the charge.
