Our battler with automated fraud
If you sell digital products on Shopify, there's a decent chance you already know the feeling: an order notification pops up, and instead of the usual little thrill, your stomach drops. Is this a real customer, or another fraud order?
That was our reality at CraftedCharts for most of March and April this year. At the worst point, we tracked close to 380 fraudulent orders in a single month, 13 of which turned into full chargebacks. We want to walk you through exactly what happened, what we tried, what didn't work, and what finally did, in case you're going through the same thing right now.
How the fraud orders started
We started noticing a pattern of clearly fraudulent orders coming through our store. Card details that didn't match the billing address. Orders placed back-to-back within minutes of each other. Customers who never opened a single email after "purchasing." It escalated to the point where we were getting multiple fraud orders a day.
Check out our products
We did everything Shopify support suggested. Fraud filters, every recommended setting, all of it. None of it made a real difference. Support acknowledged the problem, said they'd loop in an internal team, and then... silence. Days went by with no follow-up.
The workarounds that didn't really work
With no help coming from Shopify itself, we tried the obvious fixes:
-
Manual order review. We turned this on so nothing shipped (or in our case, nothing got delivered) without us personally checking it first. It stopped the bleeding, but it meant checking and approving orders every single day, indefinitely.
-
Blocking international orders. This is a common Shopify recommendation, but it's essentially useless for a digital-products store. It only affects shipping, and digital goods don't ship.
-
Marking every product as "requires shipping." This trick shows up constantly in Shopify community forums as a workaround to force international blocking to apply to digital products too. We considered it and rejected it. With hundreds of products in our catalog, relabeling everything just to patch a fraud problem Shopify itself should be solving didn't make sense, and it shouldn't have to be the answer.
We also looked outside Shopify's for help. We reached out to several freelancers on Upwork to see if someone with fraud-prevention or Shopify security experience could set up a proper solution for us. None of them were able to actually address what we needed, the responses either didn't understand the specific problem of digital-product fraud and Tor/VPN-driven bot traffic, or proposed the same generic settings we'd already tried ourselves. That path turned out to be a dead end too.
What frustrated us most, honestly, was watching Shopify accept orders where the billing address obviously didn't match the card: wrong zip code, incomplete fields, information that clearly didn't line up. If that basic mismatch isn't a red flag to Shopify's own system, that's a real problem, and not one an individual store owner should have to compensate for on their own.
Deciding to pay for a Fraud Prevention App
We really didn't want to add another monthly expense just to fix something that felt like it should be Shopify's job. But manual order review wasn't sustainable, and the fraud wasn't slowing down. So we bit the bullet and started testing dedicated fraud-prevention apps. (If you're curious what our full Shopify app stack costs us across the board, not just fraud prevention, we broke it all down in our Pros & Cons of Shopify article.)
First attempt: Blockify
We installed Blockify and used its country-blocking feature, initially blocking every country except the US. It looked promising, the analytics showed a couple of visitors blocked within the first hour.
Then an order came through anyway. When we dug into it, the visitor had used Tor to mask and rotate their IP address, which meant simple country/IP blocking wasn't going to cut it. Blockify's answer was to upsell us to their enterprise tier (around $125/year) for Tor detection.
We started a trial of the higher tier, but the timing was bad, support was out for the weekend right as we needed help, and worse, we realized the trial's visitor analytics weren't showing real data, since we were on a trial tier. We couldn't actually verify whether the tool was working before being asked to commit to a full year. We cancelled rather than risk paying for something we couldn't confirm was effective.
Second attempt: A different App
We moved on to another fraud-blocking app, on a 7-day free trial, at a lower price point than Blockify's enterprise plan. This one showed real, trustworthy analytics from day one, actual blocked countries, actual VPN/proxy detections, actual visitor logs we could inspect ourselves. We set it to block all non-US traffic, then specifically allowed Canada back through since we wanted Canadian customers to be able to buy.
This app also caught something Blockify's dashboard never clearly showed us: legitimate US visitors using a VPN, versus fraudulent traffic. We accepted that a small number of genuine US customers on VPNs might get blocked, and decided that trade-off was worth it.
The one change that actually fixed it
Here's the part we think matters most for anyone else dealing with this: the single biggest improvement didn't come from country blocking or VPN detection. It came from a suggestion neither Shopify support nor Blockify had ever mentioned, requiring a customer account to complete checkout.
For a digital-products store, this makes sense anyway: a customer account lets buyers re-download their files later from order history. It's the same reason customers who buy something like our Real Estate Business Plan can always come back and grab their file again without digging through old emails. But it turned out this setting was also the single most effective fraud deterrent we implemented. Whatever automated process was placing the fraudulent orders, it apparently wasn't built to handle an account-creation step. After turning this setting on, the fraud orders dropped off almost entirely.
Combined with the new app's bot-blocking and VPN/proxy detection, we went from multiple fraud orders a day to a small handful over an entire week, and eventually, several consecutive days with none at all.
What we'd tell other Shopify store owners
If you're a digital-products seller dealing with the same thing, here's what we'd do first, based on going through it ourselves:
-
Require a customer account for checkout. This alone may filter out a large share of automated fraud, and it's free.
-
Add a dedicated fraud/bot-blocking app with real, verifiable analytics, not just country blocking, but VPN and proxy/bot detection specifically, since sophisticated fraud traffic routes around simple IP or country blocks.
-
Don't rely on "mark digital products as requiring shipping" as your main fix. It's a workaround for a gap Shopify should be closing, not a real long-term solution, especially with a large catalog.
-
Push Shopify support, but don't wait on them. We still believe Shopify accepting orders with clearly mismatched billing addresses and cards is a real gap on their end. We reported it. We're not confident it will be fixed anytime soon, so we didn't wait around for it.
Where we stand now
We're still keeping an eye on things, because fraud traffic has a way of finding you again the moment you let your guard down. But the combination of the account requirement plus a properly working bot/VPN-blocking app has given us something we didn't have in March and April: the ability to run our store without checking it multiple times a day.
We'll keep updating this if anything changes but for now, this is the setup that's actually worked for us.
