# Screen every new Shopify order for payment fraud risk

> Every new order gets screened for payment fraud and proxy or VPN use before picking starts, with risky ones tagged and posted to Slack.

- Workflow type: agent
- Services: Shopify, IPQualityScore, Slack
- Categories: Operations, Finance
- Published: 2026-08-04

## What it does

- Checks every new Shopify order the moment it lands, pulling the billing name and address, contact details, order value, and the shopper's connection details.
- Scores the order for payment fraud and separately checks whether the buyer was hiding behind a proxy, VPN, or Tor.
- Tags risky orders as fraud-review in Shopify and writes the score plus the specific reasons into the order note, so your fulfilment team sees it right in the admin.
- Posts a Slack alert with the order number, value, risk score, and top red flags. Clean orders pass through silently and ship as normal.

## What you'll need

- A Shopify store you can connect, with permission to read and update orders
- An IPQualityScore account for the fraud and proxy checks
- A Slack workspace and a channel where your fulfilment team works
- No changes to your checkout or your payment provider

## Prompt

When a new order comes into my Shopify store, I want it screened for payment fraud before anyone picks and packs it. Use a webhook trigger on Shopify order creation so this runs the moment the order lands, not on a schedule.

Start with Shopify Get Order, using the order ID from the webhook payload, to pull the full order record. From it collect the billing first and last name, the complete billing address (street, city, state or province, postcode, country), the customer email and phone number, the order total and currency, the order number, and the shopper's browser IP address recorded on the order.

Submit that bundle to IPQualityScore Transaction / Payment Fraud Scoring: billing name, billing address fields, email, phone, order value, and the browser IP together in one call. Keep the returned fraud score and every risk signal it reports, such as a risky or undeliverable billing address, a disposable or freshly created email, a phone that does not match the billing region, or a name that looks fabricated.

Separately run the same browser IP through IPQualityScore IP Reputation & Proxy/VPN Detection to catch buyers hiding their real location. Keep the IP fraud score, the proxy, VPN, Tor, bot, and recent abuse flags, and the country and city the IP resolves to.

Now decide whether the order needs review, using thresholds that tighten as the order value rises, because a bad 40 dollar order is a cheap loss and a bad 900 dollar order is not. IPQualityScore returns 0 to 100, where 75 and above is suspicious and 90 and above is high risk. As a starting point: for orders under 100, flag at a transaction score of 90 or above; for orders from 100 to 500, flag at 80 or above; for orders above 500, flag at 65 or above. On top of that, flag any order above 500 where the IP is a Tor exit node, a high-risk proxy, or shows recent abuse, and flag an order at any value where the IP country differs from the billing country and the transaction score is already 60 or above. Everything else is clean.

For an order that needs review, use Shopify Update Order to add a fraud-review tag and record why. Shopify replaces the entire tag list and the entire note when you update them, so take the existing tags and note from the Get Order result and write them back with the new content appended. Never overwrite what is already there. The note should carry the transaction risk score, the IP risk score, and the specific reasons in plain language, for example: "Fraud review: transaction score 88, IP score 72. Connection is a commercial VPN. Billing country GB does not match IP country NG. Email domain registered 3 days ago." Keep it to a few lines so it stays readable in the Shopify admin.

Then post to the fulfilment channel with Slack Send a Message. Include the order number, the order value, the transaction risk score, and the top three red flags in priority order, plus a direct link to the order in the Shopify admin so someone can open it in one click. Write it for a picker who is not a fraud analyst: say what looks wrong and what to check, not just the raw numbers.

If the order comes back clean, do nothing at all. Do not tag it, do not touch the note, and do not post to Slack, so the channel only ever surfaces genuine review candidates and the team keeps trusting it. One exception: if either IPQualityScore lookup fails, or the order has no recorded browser IP, do not quietly treat that as clean. Score the order on whatever signals are available, and if it still looks risky, say clearly in the Slack message which check could not run.

## How to customize

- Move the value bands and score cutoffs to match your margins, for example being much stricter on anything above 500.
- Send alerts to a different Slack channel, or split high-value flags into their own channel so they are impossible to miss.
- Rename the tag, or add extra checks such as flagging orders where the billing country does not match where the shopper appears to be.

## FAQ

### Will this cancel or hold orders automatically?

No. It only tags the order, writes the reasons into the order note, and posts a Slack alert. A person still decides whether to refund, cancel, or ship. That is deliberate, since automatic cancellations on a false positive cost you a real customer.

### What makes an order count as risky?

Two things combined: a fraud score for the whole transaction (billing details, contact details, order value) and a separate reputation check on the shopper's connection. The cutoffs scale with order value, so a cheap order needs a very high score to get flagged while an expensive one is held to a stricter standard.

### Will my team get spammed with alerts?

No. Clean orders are left completely untouched, with no tag, no note, and no Slack message. The channel only ever shows genuine review candidates, which is what keeps the team paying attention to it.

### Does this work with any payment provider?

Yes. It reads the order details from Shopify after checkout, so it works the same whether the customer paid with Shop Pay, PayPal, a credit card, or anything else your store accepts.

### What if the customer is just using a VPN for privacy?

A VPN on its own does not flag an order. It is one signal weighed alongside the billing details, the order value, and the overall fraud score, so a privacy-conscious shopper buying a low-value item flows straight through.

Use this prompt in General Input: https://www.generalinput.com/prompts/screen-every-new-shopify-order-for-payment-fraud-risk