Payment Gateway Fraud Rules on Shopify

Every Shopify store already runs fraud checks it may not even think about. The moment a card is entered, the payment gateway fires a battery of tests before the charge is approved. These gateway-level rules are your first line of defense, and they're genuinely useful. But they were designed to answer one narrow question, "is this card valid and authorized?", not the broader question you actually care about: "is this order going to hurt me?"

Understanding what the gateway checks, and what it can't, is the key to building fraud defense that actually holds.

What the gateway checks

When a transaction hits your processor, several automated checks run in milliseconds.

• AVS (Address Verification Service): Compares the billing address the customer entered against what the card issuer has on file. A full match is a good sign; a mismatch on street or ZIP raises a flag.
• CVV verification: Confirms the customer knows the 3- or 4-digit security code, which usually means they physically hold the card.
• Velocity checks: Watches for suspicious patterns like the same card being tried many times in a short window, or many cards from one source.
• Issuer authorization: The bank itself decides whether to approve, factoring in its own fraud models and the account's standing.
• 3D Secure (where enabled): Adds an authentication step that can shift liability for fraud to the issuer.

Shopify Payments layers its own fraud analysis on top of this, surfacing a risk level (low, medium, high) on each order in your admin.

Where gateway rules fall short

Gateway checks are powerful for what they measure, but they have real blind spots.

They validate the card, not the buyer's intent. A fraudster with a full set of stolen data, card number, CVV, and the real billing address, can pass AVS and CVV cleanly. The checks say "valid card." They can't say "stolen card."

They don't see network context. The gateway generally doesn't care whether the order came through a VPN, a proxy, a Tor exit node, or a country you don't ship to. That connection-level risk is invisible to it.

They're reactive, not preventive. AVS mismatches often result in the charge going through anyway, just flagged. It's then on you to cancel manually, after the order exists.

They don't block before checkout. Gateway rules run at the moment of payment. They can't stop a known-bad visitor from ever reaching your checkout in the first place.

They can be blunt. Aggressive gateway settings sometimes decline legitimate customers, hurting conversion, while loose settings let fraud through. You have limited control over the dials.

The two-layer model

The smart approach isn't gateway rules or app-level rules. It's both, arranged in layers, each covering the other's gaps.

Layer 1, the gateway: Handles card validity. AVS, CVV, velocity, issuer authorization, and 3D Secure confirm the payment instrument is real and authorized. Keep these enabled and reasonably strict.

Layer 2, the app level: Handles context and intent, the things the gateway can't see. This is where you filter by:

• Geography: Block or flag orders from countries you don't serve or that show disproportionate fraud.
• Connection type: Block VPNs, proxies, Tor, and anonymizing services that fraudsters hide behind.
• Bot and automation signals: Stop scripted checkout attempts before they place orders.
• Behavioral risk: Use AI scoring to weigh combinations of signals that no single rule would catch.

Crucially, layer 2 can act before checkout, stopping bad traffic rather than cleaning up after it.

How it fits together on Shopify

Here's a realistic flow with both layers running:

1. A visitor lands on your store. App-level filtering checks their IP, connection type, and location. A Tor connection from a non-shipping country gets blocked at the door, no order created.
2. A legitimate-looking visitor proceeds to checkout. The gateway runs AVS, CVV, and velocity checks, confirming the card is valid.
3. The order is placed. AI fraud scoring weighs the full context, billing/shipping mismatch, device signals, order value, and flags anything that looks off despite passing the card checks.
4. You review only the small number of genuinely ambiguous orders, instead of every transaction.

Each layer catches what the other misses. The gateway stops invalid cards; the app stops risky context.

Setting it up

You already have layer 1 through Shopify Payments and your gateway settings, review them and make sure AVS/CVV rejection is configured sensibly. For layer 2, an app like Shieldy — Fraud Filter adds checkout-level blocking for IPs, countries, VPN, proxy, Tor, and bots, plus AI fraud scoring, all managed from rules you control without touching code.

A quick illustration of the layering payoff: suppose gateway checks alone let through 15 fraudulent orders a month that passed AVS/CVV because the fraudster had full stolen data. Many of those would carry network red flags, VPN use, mismatched geography, that a context layer catches. Blocking even 10 of them saves you the chargebacks and protects your ratio, with the gateway still doing its job on card validity.

The takeaway

Gateway fraud rules are necessary but not sufficient. They prove the card is real; they can't prove the order is safe. Layer app-level filtering on top to cover geography, connection type, bots, and behavioral risk, and you close the gaps that gateway checks leave open.

Want to add the context layer your gateway can't provide? Explore the options on the Shieldy pricing page.