Ecommerce Fraud Detection for Small Stores: A Review Queue With AI

A small store can build a fraud review queue in a spreadsheet: score each order on a handful of risk signals, hold anything above a set score before shipping, verify it with the customer, and log every outcome. AI helps design the scoring, draft the verification messages and read your chargeback history. Software becomes worth paying for once the queue takes too long.

The aim is not to catch every fraudster. It is to stop the few orders where stacked signals say "look twice", without insulting the honest majority. A queue that holds one order in thirty and clears most within a day costs little. A queue that holds one in five sends customers to a competitor.

Follow me on Instagram@sagnikteaches

What your payment provider already does, and what it leaves to you

Before building anything, learn what you already get. Card payments pass through checks run by the card issuer and your payment provider. Stripe's documentation on its Radar fraud tool, for example, says all transactions are screened by its default rules, and notes that a payment can still succeed when a card's security-code or address check fails, because card issuers weigh many factors when approving. So a "passed" payment is not proof of an honest buyer.

Connect on LinkedInSagnik Bhattacharya

The same documentation describes a review queue (payments that match a review rule are processed normally but listed for you to look at) and says custom rules depend on your plan. It also says that when 3D Secure authentication succeeds, liability for fraud-related disputes typically moves from the seller to the card issuer, which is a strong reason to turn authentication on for riskier orders where your provider offers it. Read your own provider's page, because the details and the plan that includes them differ.

Subscribe on YouTube@sagnikteaches

Shopify's help page on payment authorisation and capture says you can set the payment capture method to Manually (under Settings, then Payments), and names reviewing an order's fraud analysis before capturing as one reason to do it. That is the cleanest "hold" there is: the card is authorised, but nothing is taken until you decide. The trade-off is time. Shopify Payments gives a 7-day authorisation period for card payments, other providers set their own, and once the period ends you may not be able to collect the money at all, so build your queue's deadline from your provider's figure.

What none of this does is learn your shop. Your fraud looks different from a clothing chain's. A seller of small electronics gets attacked with high-value resale orders, a seller of digital downloads with stolen cards used in bursts. The queue below is how you learn your own pattern cheaply, and it is also the evidence that tells you which paid tool to try later.

A shop to follow: 420 orders a month

The figures are illustrative. Picture a small online shop selling headphones and phone accessories, about 420 orders a month, average order value $64, shipping within one working day. Last quarter it received six chargebacks on orders totalling about $1,100, and lost the goods and the payment on each. The owner wants a daily check that takes under twenty minutes.

Looking back at those six orders, the owner finds that five were first-time customers, four shipped to an address different from the billing address, four chose the fastest shipping, three used free email addresses made of random-looking characters, and two were the same product in quantities of three. None of these signals alone is damning, since thousands of honest orders share each of them. But all six had at least three together. That is the whole idea of a score: evidence stacks.

The signals worth scoring, and why each is only a clue

Choose signals you can read from your order export without special tools. Each gets points, and the weights come from your own history. Starting weights that suit the headphones shop:

Set the hold threshold at 5 points to begin. That means a first order (1) shipped to a different address (2) with express shipping (2) lands in the queue, while a returning customer ordering to a new flat does not. Adjust after two weeks, using the outcome log below.

The last line deserves emphasis: a hit on your own past chargebacks is the only signal that is strong enough to act on alone. Everything else is context. Keep a short list in a separate sheet tab (card last four digits are not enough on their own, so record the customer email, shipping address and order number) and check each new order against it.

Set up the sheet, with AI doing the formulas

Export last month's orders and keep these columns: order number, order date, customer type (new or returning), order total, shipping method, billing postal code, shipping postal code, billing country, shipping country, payment check results if your provider gives them. Remove names and street addresses; postal codes alone are enough to see a mismatch. If you want help with the export itself, the older tutorial on using ChatGPT in Excel covers formulas in general.

Then ask an assistant to write the scoring formulas. A prompt that gives good results:

I have a spreadsheet of online-shop orders with columns A to J: order_number, order_date, customer_type (New/Returning), order_total, shipping_method (Standard/Express), billing_postal_code, shipping_postal_code, billing_country, shipping_country, payment_check (Pass/Fail/Unavailable).
Write one formula for column K (risk_points) that adds: 1 if customer_type is New; 2 if billing_postal_code differs from shipping_postal_code; 2 if shipping_method is Express and customer_type is New; 2 if order_total is more than 3 times the average of column D; 2 if billing_country differs from shipping_country; 2 if payment_check is Fail. Then a formula for column L that shows HOLD if K is 5 or more, otherwise RELEASE. Give formulas for Excel and for Google Sheets, and explain each part in one line.

A typical result adds the six tests with IF statements and a final IF returning HOLD or RELEASE. Check it by hand on five rows you understand. Copy a row with a known mismatch and see if 2 points appear. Assistants sometimes compare postal codes with extra spaces or letter case as different, so ask for a version that trims and ignores case if you see false mismatches.

Now run last quarter's orders through the sheet, including the six chargebacks. This is the back-test. If five or six of the six land in HOLD, and fewer than about one in twenty of the other orders do, your weights are sensible. If only two of the six are caught, add weight to the signals they shared. If one in four honest orders is held, raise the threshold. Pick the setting by looking at both numbers, never one of them.

The daily routine: ten minutes, in a fixed order

Do the check at the same time each day, before the day's shipping goes out. A routine that is easy to forget is a routine that stops. The steps:

1. Export new orders since yesterday's check, paste into the sheet and let the formulas score them.
2. Check each order scoring HOLD against your chargeback list (customer email, shipping address). A match is a stop. Cancel and refund, or ask your provider how to handle it if payment has settled.
3. For the others on HOLD, apply the cheapest check that fits the signal. A mismatched address on a mid-value order needs a short email. A high-value resale item needs the verification steps in the next section.
4. Release everything else.
5. Record every held order in the log with the outcome.

In the headphones shop, a typical day has 14 orders and one or two holds. At two holds a day, the routine takes about ten minutes, plus waiting for replies. If your store is bigger, the same sheet can sort the HOLD rows to the top so you handle the worst first.

Hold and verify: what to ask, in what order

Verification should be proportionate. Start with the lightest check that answers the doubt, and escalate only when it fails. Here is the ladder for the headphones shop, from lightest to heaviest:

1. Email confirmation. Send a short message asking the customer to confirm the order details and delivery address. Most honest customers reply within hours.
2. A matching detail. Ask the customer to confirm something only the cardholder would readily know, such as the billing postal code as it appears on their statement. Never ask for the full card number, the security code or a photo of the card. Nobody honest needs to send those to you, and you should not hold them.
3. A phone call to the number on the order for higher-value orders, if you have one. A short call is often faster than three emails.
4. Stronger authentication at payment. If your provider supports 3D Secure, ask for it on the next attempt; per Stripe's documentation, a successful authentication typically shifts fraud-dispute liability to the issuer.

Draft the first message with an assistant, and edit it so it reads as routine, not accusing:

Write a short, friendly email from a small online shop to a customer whose order is on a routine security check. Say the order is paid and reserved, that we check some orders before dispatch, and ask them to reply confirming (1) the delivery address as written below and (2) that they placed the order. Say we will ship within one working day of their reply and that if we do not hear back within 3 days we will cancel and refund. No accusations, no mention of fraud, under 90 words. Use [first name], [order number] and [address] as placeholders.

A realistic output: "Hi [first name], thanks for your order [order number]. It is paid and reserved. We run a quick check on some orders before they go out. Could you reply to confirm you placed it and that we should send it to: [address]? Once we hear from you we will dispatch within one working day. If we have not heard by Friday we will cancel and refund in full, so nothing is lost either way. Thanks, [your name]." Adjust the deadline sentence to your own timing, and take care that "Friday" is a real date in the message you send, not the template word.

Silence after three days is a signal, but a weak one, because some people miss emails. Cancel and refund, and tell the customer how to reorder. A cancelled honest order is a small loss. A shipped fraudulent one costs the goods and the payment.

The chargeback log: where the queue learns

A chargeback is a dispute where the cardholder asks their bank to take the money back. Every one should become a row in a log, because the log is how the queue improves. Keep one sheet tab with these columns:

• Order number, order date, chargeback date and reason code as your provider shows it
• Order total and the cost of goods lost
• The risk points the order scored at the time, and whether it was held
• Which signals fired (copy the six or seven columns)
• How you responded and whether you won
• Customer email and shipping address (for the stop list)

The point of the third and fourth columns is the question every review asks: "would the queue have caught this?" If a chargeback scored 3 and was released, which signal was missing? Perhaps the order was shipped to a freight forwarder address, a signal you did not have. Add it with points and re-test. Over a few months the log becomes the evidence behind each weight. Responses to disputes are worth their own work: the tutorial on a chargeback response template covers the writing side.

Every three months, give the log to an assistant, stripped of personal details:

Here is a table of 14 chargebacks from our online shop: order_total, shipping_method, customer_type, billing_vs_shipping_match, risk_points_at_order, product_category, hour_of_day_ordered. Describe what these orders have in common that the general order population probably does not, say which patterns appear in three or more rows, and flag anything where fourteen rows is too few to conclude. Do not invent patterns.

With fourteen rows an honest assistant will say most patterns are thin. That is useful: it tells you not to rewrite your weights on a hunch. Wait for more rows or change one weight at a time.

How a queue held an honest order, and what the owner changed

One week in, the headphones shop held an order for a pair of $240 headphones: new customer, express shipping, shipping address different from billing, value over three times the average. Score: 1 + 2 + 2 + 2 = 7. The owner emailed. The reply came the next morning: the customer was buying a birthday present for a brother who lived in another city and needed it by Saturday. The order shipped a day late and the customer left a polite note about the delay.

The honest customer paid a price, so the owner re-read the weights. Gift orders trip three of the signals at once: new, different address, express. The adjustment was to add a gift check at checkout. A "this is a gift" tickbox that the customer can use, and a rule that a ticked gift box reduces the address-mismatch signal from 2 points to 1. Fraudsters can tick the box too, so the weight drops only a little, but it removes a lot of friction. A week later, held orders per day dropped from about two to about one, and the chargeback list did not grow. Always judge a change by both numbers, orders held and chargebacks, over at least a month.

One day of orders through the queue

To see the routine at work, take an illustrative day in the headphones shop with 14 orders. Eleven are routine, score 0 to 3 and are released within a minute: returning customers, matching addresses, standard shipping. Three need a closer look. Order A is a first-time customer, matching addresses, standard shipping, $59: score 1, released. Order B is a first order for three of the same $85 earbuds ($255, more than three times the average), express shipping, billing and shipping different: 1 + 2 + 2 + 2 + 3 = 10, held, and the customer's email matches nothing on the stop list. Order C is a returning customer of two years sending a gift to a new address: 2 points, released, because returning customers with clean history are the shop's best asset.

For order B the owner sends the confirmation email and waits. Two days pass in silence. The owner cancels and refunds, and writes "no reply, cancelled" in the log. Two weeks later a chargeback arrives from a different order that scored 4, which tells the owner the threshold is slightly too high for orders shipped to freight-forwarding addresses. The owner lowers the threshold to 4 only for orders where the shipping address matches a short list of forwarding addresses collected from the log, rather than for every order, so honest customers stay unaffected.

That last decision is the pattern to copy: when a miss appears, add a narrow rule for the pattern you saw, not a blunt change that touches everyone. Narrow rules keep the queue small, and the log shows whether each one earns its place.

What to leave alone: bias, blocks and privacy

Three limits keep the queue fair and legal. First, do not score signals that stand in for who the customer is: name, apparent ethnicity, a country's general reputation. They are unfair, they are often wrong, and in some places they are unlawful. Score order behaviour only. Second, do not auto-cancel on score. Every hold goes through a person, because the thing the queue measures is risk, not guilt. Third, keep what you store to what the log needs, tell customers in your privacy notice that you carry out fraud checks, and ask a qualified adviser if you are unsure what your notice must say where you sell.

Be careful with the stop list, too. A customer email on it should be there because of a confirmed chargeback or confirmed abuse, not because of a hunch. Review it twice a year and remove entries that have no good reason to stay.

When the spreadsheet stops being enough

Four signs say it is time to try a paid tool, and they are all measurable from the log. Review takes more than about an hour a day. Orders ship within minutes of payment, so there is no time to hold. Chargebacks rise even though the queue is running, which suggests fraud your signals cannot see. Or you sell in so many places that the signals differ too much to score by hand. When one of these is true, you will arrive at a vendor demo with a back-tested set of signals and a log of what you have lost, which is a much stronger position than asking a salesperson what you need.

Before buying, check what your payment provider's own paid tier already offers, because a rule set inside your payment dashboard costs nothing to integrate. The comparison of paid AI tools for a small store helps weigh the rest. The return side of the shop has its own pattern, covered in the tutorial on finding repeat abusers in a returns export, and the log you keep here and the returns data there will inform each other. For where this fits in the daily rhythm of an online shop, see AI for ecommerce operations.

Questions about a do-it-yourself fraud queue

Is a spreadsheet queue enough for a small store?

For a few hundred orders a month, usually yes, and it teaches you your own fraud pattern before you pay for software. It stops being enough when review takes more than an hour a day, when orders ship within minutes of payment, or when your chargeback rate keeps climbing despite the queue.

Which single signal matters most?

No single signal does. A billing and shipping mismatch is normal for gifts, and a new customer is normal for any growing shop. Risk shows up when several signals stack, such as a first order, a high-value resale item, express shipping and a mismatched address together. That is why the queue uses points.

Can I paste order data into an AI assistant?

Work with order numbers and yes-or-no flags rather than names, emails, addresses or card details. Compute flags in your spreadsheet and give the assistant the flags only. Check your assistant's data settings and your own privacy notice before sharing anything that identifies a customer.

Should I cancel suspicious orders automatically?

No. Hold, verify, then decide. Automatic cancellation rejects honest customers, and each rejected honest customer costs a sale and goodwill. Reserve automatic blocking for patterns you have confirmed as fraud more than once, such as a card that has already caused a chargeback.

Further reads

• Ecommerce AI Chatbot Examples: 7 Store Conversations to Copy — Conversation scripts that hand suspicious cases to a person.
• How to Spot Patterns in Complaints, Returns, and Defects With AI — Find patterns in complaints and returns alongside fraud.
• AI Accounting for Ecommerce: Reconciling Payouts and Fees — Match payouts to orders so missing money shows up fast.
• How to Catch Duplicate Invoices and Payment Fraud With AI — A parallel checklist for supplier-side payment fraud.
• AI Tools for Ecommerce Websites: What a 50-Orders-a-Month Store Needs — Which AI tools a small store needs, in order.
• AI for Ecommerce Analytics: Shopify Reports, GA4 or ChatGPT First? — Choose where to read your order and payment numbers.
• Find Overseas Suppliers With AI: Shortlists, RFQs and Red Flags — AI drafts the spec, shortlist scorecard and RFQ. You verify registration, samples and the bank name before paying a cent.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Stripe Radar rules documentation (review queue, card and postal-code checks, 3D Secure liability); Shopify Help Centre on payment authorisation and manual capture (7-day authorisation on Shopify Payments). Scoring weights and all store figures are illustrative.