Table of contents
AI tools make it easier than ever for fraudsters to target online stores. Across Shopify we are blocking 17 times more card-testing attacks than we were in January—and most businesses never noticed, because the defenses were already running.
Fraud protection is not new to Shopify, but we are investing in it more than ever. Today, we are introducing Shopify Protect, which brings all of our fraud and dispute tools together across the life of an order: stopping attacks before they become orders, helping you ship the good ones with confidence, and winning the charge-backs that follow. A lot of it works automatically for every business on Shopify Payments, at no extra cost.
The hidden cost of fraud
When we block an attack, it costs you nothing. When fraud gets through, it costs you in more ways than most businesses ever see.
What a charge-back really costs you
When the real owner of a stolen card asks their bank to reverse the charge, the amount on the dispute is not what it costs you. You have already shipped the product. You still pay the network dispute fee. Someone on your team spends the better part of an hour pulling together receipts, delivery records, and messages.
Add it up and a $100 dispute costs a business about $238[1].
Where the $238 goes
Fraud today costs you good orders tomorrow
The second cost is almost never budgeted for: damage to a store’s reputation with banks. Banks track how often they decline a store’s payments for suspected fraud and how often their customers dispute charges. As those rates rise, banks become more cautious and decline more payments, including purchases from legitimate customers. That damage can persist long after the fraud stops.
So a run of fraud in the spring does not just cost you in the spring. It affects how many of your genuine customers get approved months later. Businesses whose fraud disputes run at around 0.5% of sales have a median bank approval rate 7.4 percentage points lower than businesses with almost none[2].
Stores with less fraud get more of their good orders approved
Both the charge-back and the lower approval rate start with a fraudulent order. Cancelling it or winning the dispute later gets back only part of the cost. The cheapest place to stop fraud is before the payment reaches the bank.
How Shopify Protect works
Shopify Protect is built to stop fraud as early as possible—ideally before it becomes an order. If an order gets through, we explain its risk. If it’s disputed, we help you win.
The worst checkouts never become orders
Because Shopify powers the checkout, we can act while a customer is still on the page rather than after the money has moved. We have already been doing this quietly in the background: spotting card-testing bots before they can run stolen cards through your checkout, and, when a payment looks risky, asking the customer to confirm it is really them, through a code or a tap in their banking app, which a real customer passes in seconds.
Now we go further and stop the worst of it outright. When we are near-certain a payment is fraudulent, it is declined before it is sent to the banks for authorization—no order to cancel, no refund to issue.
2.8 billion
high-risk payments prevented by Shopify Payments in the past six months[3].
Every decision explained
We do not stop there. A new report in Analytics will show what Shopify Protect blocked, what it challenged, and what that was worth to you in dollars.
Every order that does come through now carries a plain-language explanation of its risk and the reasons behind it. When you are deciding whether to ship, you can see what we saw.
Your disputes, already answered
When a dispute lands, Shopify is already fighting for you. Our new AI tooling helps you fight back and win more disputes. We use card network rules to gather the most compelling evidence that banks look for, pull delivery photos from your shipping carrier, and format responses that win across our entire merchant base. Every dispute we fight teaches us which evidence wins, and every business inherits what won for the others.
Up to 1.6×
higher dispute win rates by category since this year’s rebuild[4].
Shopify fills in everything it already knows and asks you only for what you alone have, like a photo of the packed box, which you can add right from the order.
Skip the charge-back fight entirely
Some businesses would rather not think about charge-backs at all. Shopify Protect already covers eligible Shop Pay orders: if one is disputed as fraud, we cover the loss and handle the response, and you keep the sale. There is no fee for it and nothing to install. Next up, we are extending charge-back coverage beyond Shop Pay.
Your rules, tested before they go live
If you want more control over your policies and which checkouts can be converted to orders, the new Shopify Protect: Rule Builder app lets you build rules around your business, with no coding.
Choose the signals that matter to you, then either block the payment, request 3D Secure, or hold the order for review. Before a rule goes live, you can preview what it would have done to your past 90 days of orders.
Only Shopify sees the whole sale
Fraud is not a payments problem. It is a commerce problem. The clues start long before checkout and run all the way to delivery—the store visit, the cart, the checkout, the shipment. Other fraud tools only see the payment. Shopify sees the whole sale, because the whole sale happens on Shopify. And it happens across millions of businesses and hundreds of millions of buyers, so a card flagged on one store is already known at the next.
Every store on Shopify makes every other store smarter and safer.
Shopify Protect is on today for every business on Shopify Payments.
Get Started with Shopify Payments
Sources
1: Shopify Payments source data and Mastercard / Datos 2025, handling cost per case. ↩
2: Shopify Payments, May 2026 sales cohort, disputes observed through August 31. Businesses with at least 100 bank attempts. ↩
3: Shopify Payments data, April-October 2026. ↩
4: Shopify Payments dispute data, 2026. ↩
