Fraud Prevention for B2B & Wholesale Stores

B2B fraud rarely looks like the card testing you see on a DTC store. The amounts are bigger, the tactics are slower, and the losses land on invoices instead of chargebacks. A wholesale store extending net-30 terms to a fraudster can lose $10,000 on a single order and not realize it until the payment window closes. If you sell to businesses on Shopify, your fraud controls need a different shape.

How B2B fraud actually happens

• Net-terms default fraud. A "business" applies for credit terms, places a large first order, receives the goods, and never pays. Often the entity is real-looking but shell-thin or freshly registered.
• Fake or altered purchase orders. A forged PO on a copied letterhead, sometimes impersonating a genuine, well-known company whose name lends credibility.
• Business email compromise (BEC). A fraudster spoofs or hijacks a real buyer's email domain, then requests a shipment to a new "warehouse" address or asks to change payment details.
• Reseller and diversion fraud. Buyers pose as authorized resellers to get wholesale pricing, then divert goods to gray markets.
• Account takeover of an established wholesale account, changing the shipping address on a trusted buyer's next order.

The common thread: the *identity* of the buyer matters far more than any single payment signal.

Verify the buyer before extending trust

For B2B, verification is your first and best control. Do it before approving an account, and re-verify before shipping large or first orders.

• Confirm the legal entity. Ask for a business registration number, tax/VAT/EIN ID, and match it against a public registry. A company that can't produce this is a red flag.
• Independently verify contact details. Call the phone number listed on the company's *official* website — not the number on the order. Confirm the person and the order exist.
• Check the email domain. Free domains (gmail, outlook) on a five-figure wholesale order deserve scrutiny. Verify the domain was not registered last week.
• Validate the shipping address. Is it a real commercial location, a residence, or a freight forwarder? Freight forwarders on a first order are a diversion signal.
• Run a trade reference or credit check before granting net terms, and start new accounts on prepayment or a low credit limit.

Controls for large and first-time orders

Size your friction to the risk. A repeat customer's $500 reorder needs little; a new account's $15,000 order needs a lot.

• Hold first orders for manual review, regardless of amount, until the account is verified.
• Set value thresholds. Auto-hold any order above, say, $2,500 from an unverified account.
• Require deposits on large custom or first orders (30–50%).
• Cap net terms at a conservative limit and raise it only after a clean payment history (for example, three on-time invoices).
• Lock shipping-address changes on trusted accounts, or require re-verification when the ship-to changes on a large order — this defeats both BEC and account takeover.

Use checkout-level signals even in B2B

Wholesale buyers are still humans behind a browser, and the technical fraud signals still apply. Shieldy — Fraud Filter runs on Shopify Functions, so it can screen wholesale checkouts in real time:

• Flag VPN, proxy, Tor, and datacenter IPs. A "domestic distributor" logging in through an anonymizing network doesn't add up.
• Detect geo mismatches between the business's stated location, the IP, and the shipping country.
• Auto-hold high-value orders from new or unverified accounts for manual review before they proceed.
• Block or hold accounts and IPs tied to a previous default or a confirmed impersonation attempt.
• AI fraud-order scoring combines these signals so a high-risk wholesale order surfaces instead of slipping through on trust.

The point isn't to add friction to your loyal buyers — it's to make sure the *first* interaction with an unknown account is verified before you extend inventory or credit.

Spotting a fake purchase order

POs are easy to forge. Before you honor one:

• Match the requester's email domain to the company on the PO. A Gmail address ordering on behalf of a Fortune 500 is a giveaway.
• Confirm authorization. Call the company's main line and verify the named buyer actually placed it.
• Watch for urgency and address changes. "Ship today to this new address" plus "we'll pay on terms" is the classic combination.
• Compare against known good POs from the same account for formatting inconsistencies.

A B2B starter framework

• Verify every new account: entity registration, tax ID, independent phone confirmation.
• First orders and orders over $2,500 from unverified accounts → manual review.
• New accounts start on prepayment; net terms unlock after a clean history.
• Deposits (30–50%) on large or custom orders.
• Lock or re-verify shipping-address changes on trusted accounts.
• Screen every checkout for VPN/proxy/Tor, geo mismatch, and high-risk scoring.

B2B fraud is patient, so your defenses should be structural — verification and thresholds baked into the process, not a scramble after an invoice goes unpaid.

Selling wholesale on Shopify? See how Shieldy — Fraud Filter screens high-value checkouts, or check the pricing for the plan that fits your volume.