Shopify flagged an order as high risk. What should you do before fulfilling it?
First, check the fulfillment status
Everything about this request depends on one fact: has the order shipped yet. If it is unfulfilled, you have options. If it is fulfilled or in transit, you are no longer editing an order, you are arranging an exchange, and the conversation with the customer changes completely. Check the order timeline before you promise anything, because the wrong promise here creates the refund dispute you were trying to avoid.
In the Shopify admin, open the order and look at the fulfillment status first, the payment status second. An unfulfilled, paid order is the easy case. A partially fulfilled order means some items can still change and some cannot, which you need to explain clearly. Train whoever answers customer messages to check this before typing a reply; most bad outcomes in this scenario come from promising an edit that was never possible.
When you can edit the order
For unfulfilled orders, Shopify lets you edit: add or remove line items, change quantities, and adjust the order total, with the customer charged or refunded the difference. This is the cleanest path when the customer wants a different size or color of the same product. Make the edit, confirm the new total with the customer in writing, and note that the edit itself is the confirmation; do not also send a separate "we changed it" email that confuses the thread.
Edits have limits worth knowing. You cannot change the order into something unrecognizable without confusing your own records, and editing does not work once fulfillment has started. If the price difference is significant, get explicit approval before charging the extra amount; an unexpected charge on a card is how a simple size swap becomes a chargeback.
When to cancel and reorder instead
Cancel and reorder is the right call when the change is extensive (half the items are different), when the customer wants to add items that change shipping weight or method, or when the original order is already fulfilled. It is also cleaner when the customer is clearly unsure; a fresh order with a fresh confirmation beats three rounds of edits that nobody can follow.
The mechanics matter: cancel the original, issue the refund promptly, and create the new order, ideally as a draft order you send for the customer to approve and pay. Do not cancel without the replacement ready, or the customer experiences it as "my order was cancelled" rather than "my order was fixed." Speed of the refund is the whole ballgame here; a same-day refund turns a hassle into a loyalty moment.
What to tell the customer
The message template that works: confirm what you are doing, state the timeline, and name the money. "I have updated your order to the blue in size medium. The $12 difference has been refunded and should appear in 3 to 5 business days. Your order still ships Thursday." Every element answers a question the customer would otherwise ask in a follow-up message, which is the real cost driver in these exchanges.
If you cannot do what they asked, say so in the first sentence and offer the alternative immediately. "That order already shipped this morning, so I cannot change it, but here is what I can do: refuse the delivery or send it back with this prepaid label, and I will ship the correct item today." Bad news first, solution second, no hedging in between.
Preventing it next time
A sizing chart linked at the point of size selection, a clear "final sale" flag on items that cannot be changed, and an order confirmation email that arrives within minutes all reduce these requests. The confirmation email is the cheapest intervention: customers who catch their own mistake within the hour are easy to help, while customers who notice three days later are not.
Track how often this happens and why. If size swaps dominate, your size guide is failing. If customers keep adding forgotten items, your checkout may be rushing them. The pattern in the requests is free product-page research, and merchants who read it stop answering the same email every day.
The order looks normal until you open it: a red high risk flag and a recommendation not to fulfill. For a small store, every cancelled order hurts, and every fraudulent one hurts more. What matters is knowing what to check in the ten minutes before you decide.
What the flag is actually telling you
Shopifys fraud analysis scores orders against patterns from across its network: mismatched billing and shipping details, an IP address far from both, a card tested repeatedly before succeeding, unusually fast checkout, or an email pattern linked to prior chargebacks. A high risk result means several weak signals stacked up, not that the order is certainly fraud.
That distinction matters because legitimate orders trip the same wires. Gifts ship to different addresses, travelers order from hotel wifi, and a customer whose first card expired looks like a card tester. The flag is a prompt to verify, not a command to cancel, and merchants who treat it as a verdict lose good customers along with the bad ones.
The checks that actually resolve it
Start with the details already in the order: does the billing postcode match, was the card security code verified, and does the customers order history with your store exist. Then use the cheapest verification in commerce: contact the customer. A short email or call asking them to confirm the order details resolves most cases, because fraudsters rarely answer, and real customers almost always do, quickly.
For higher value orders, ask for something a stolen card cannot produce, such as confirmation from the email on the order or a small verification step your store defines in advance. Decide your threshold before you need it: many stores verify everything flagged over a set amount and ship low value flagged orders, pricing the occasional loss against the cost of friction.
When to cancel, and how
Cancel when the signals compound and verification fails: no response from the customer, details that contradict each other, and an order profile that matches pure resale fraud, multiples of the same high value item to a freight forwarder, for example. At that point the expected loss from shipping exceeds the value of the sale by a wide margin.
Cancel and refund in one motion, and keep the message neutral: the order could not be verified. Accusing a customer of fraud in writing is a mistake even when you are right, and occasionally you will be wrong. A neutral cancellation preserves the relationship with the honest minority and gives the dishonest nothing to screenshot. Your future self, reading the chargeback that never came, will endorse the policy.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: How does store credit work on Shopify, and when should a store offer it?, How do I add a tracking number to a Shopify order after it ships?, and A customer wants to keep the order but get some money back. How do partial refunds work?.
Frequently asked questions
What does a high risk flag on Shopify actually mean?
It means the orders fraud analysis found several risk signals, such as mismatched billing and shipping information, a distant IP address, or repeated card attempts. It is a statistical warning, not a finding of fraud. Many flagged orders are legitimate gifts, travel purchases, or returning customers with new details, which is why verification comes before cancelling.
Should you ever fulfill a high risk order?
Yes, after verification. If the customer responds and confirms the details, and the order value is within your tolerance, fulfilling is reasonable and common. Stores often set a value threshold: verify every flagged order, ship the verified ones, and accept rare losses on small orders rather than adding friction for every customer.
What is the fastest way to verify a flagged order?
Contact the customer using the details on the order and ask them to confirm it. Genuine customers almost always reply quickly; fraud operations almost never do. For higher value orders, add a confirmation step the card thief cannot complete, such as replying from the order email or confirming specific order details.
What happens if you ship an order that turns out to be fraudulent?
Typically a chargeback weeks later: the payment is reversed, a chargeback fee is added, and the product is gone. That triple loss is what the verification step is priced against. A cancelled order costs a sale; a shipped fraudulent order costs the sale, the goods, and the fee.