Understand Risk Scores & Risk Factors
Once order risk analysis is on, every order gets a risk score from 0 to 100 and a risk level of Low, Medium, or High. This article explains where the score comes from and how to read an order's risk breakdown.
Prerequisites
- Order risk analysis must be enabled. See Set Up Order Risk Analysis.
How the score works
Each order is checked against eight risk factors. Every factor that triggers adds its points to the order's total - up to 100. The more factors that fire, and the heavier they weigh, the higher the score.
| Risk factor | What triggers it | Points |
|---|---|---|
| Bot detection | Automated or headless browser | 25 |
| VPN/Proxy detection | VPN or proxy connection (via VPNapi.io) | 20 |
| IP ≠ Shipping country | IP location doesn't match shipping address | 15 |
| Multiple orders from same IP | More than your threshold of orders from one IP in 24 hours | 15 |
| High order value | Order total above your value threshold | 10 |
| New customer | First order from this customer | 5 |
| High-risk country | Shipping to a country on your high-risk list | 5 |
| Suspicious email | Disposable / temporary email provider | 5 |
The score then maps to a risk level:
- Low - score 0-30
- Medium - score 31-69
- High - score 70-100
You control which factors count and their thresholds in Settings → Order protection. Turning a factor off removes it from every future score.
Open the Order protection page
In the sidebar, click Order protection.
The page opens with summary cards - Total orders, High risk, Medium risk, and Low risk - and a list of analyzed orders.
Filter and sort
Find the orders you care about most:
- Use the All / High / Medium / Low tabs to focus on a risk level.
- Search by order ID or email.
- Filter by Status (Resolved / Unresolved), Country, or Date range.
- Sort by Risk Score (Highest first) to put the riskiest orders on top.
Open an order's risk detail
Click any order to open its detail page. Here you'll find the full breakdown:
- Risk score - the order's score out of 100, with its risk badge.
- Risk factors - how many of the factors triggered, and the detail for each one. For example, IP location: Hanoi, VN - Shipping to: US for an IP/shipping mismatch, or First order from this customer for a new customer.
- Order information - order number, total, created date, and customer type (New / Returning).
- Customer - email and IP address.
- Location - IP location, shipping, and billing addresses.
- Actions taken - whether the order was tagged, pushed to Shopify Admin, emailed, or auto-cancelled.
Use View full order to jump to the order in Shopify Admin.
Mark orders as resolved
After reviewing an order, keep your queue tidy:
- Select one or more orders and choose Mark as resolved (or Mark as unresolved) from the bulk actions.
- Resolved orders are filtered out of your default view so you can focus on what still needs attention.
Tip: Click Refresh to re-analyze recent orders if you've just changed your risk factor settings.
Tips
- High score ≠ guaranteed fraud - the score is a signal, not a verdict. Always open the detail and judge the factors in context before cancelling.
- Watch your highest weights - Bot detection (25) and VPN/Proxy detection (20) move the score the most. If those fire together, the order is already at high risk before any other factor.
And there you have it! You now know how risk scores are built and how to review an order's risk detail. Ready to act on them automatically? See Automate Order Actions.