> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.omegatheme.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# A complete guide: Fraud Filters

## Overview

**Fraud Filters** helps you spot risky orders and decide what happens to them. Shopify checks every order for fraud and gives it a **Fraud order score** and an **Order type** (**Low risk**, **Medium risk** or **High risk**); Blockify adds what it knows about the IP address the order came from. You can review the list, act on one order at a time, or let Blockify cancel or flag high- and medium-risk orders for you. The switch and the automatic actions live under **Fraud Filters** in the sidebar; the order list lives under **Analytics > Orders**.

## What you'll learn

* [How to turn on Fraud Filters?](#2-how-to-turn-on-fraud-filters)
* [How risk scores work?](#2-how-risk-scores-work)
* [The fraud order list](#2-the-fraud-order-list)
* [The order details window](#2-the-order-details-window)
* [The "Order from VPN/Proxy" field](#2-the-order-from-vpnproxy-field)
* [How to find and filter orders?](#2-how-to-find-and-filter-orders)
* [How to analyze old orders?](#2-how-to-analyze-old-orders)
* [How to act on a single order?](#2-how-to-act-on-a-single-order)
* [Automatic actions](#2-automatic-actions)
* [Export fraud orders](#2-export-fraud-orders)
* [Who can use this feature?](#2-who-can-use-this-feature)

## How to turn on Fraud Filters?

**Step 1:** Open the **Blockify** app and click **Fraud Filters** in the sidebar.

**Step 2:** Click **Turn on**. The first time, Blockify asks for permission to see your orders; approve it to continue.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/20260519-131238_11j8h71.png)

From now on, new orders get a score as they come in and show up in the order list. The **Risk-based actions** card opens below the switch (see [Automatic actions](#2-automatic-actions)).

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/a-complete-guide-fraud-filters_4xsf16.png)

| Important: If you later move to a plan that does not include Fraud Filters, Blockify turns the feature off for you. Orders already in the list stay there.

## How risk scores work?

| Field | Source | What it means |
|---|---|---|
| **Fraud order score** | Shopify | 0 to 1. The closer to 1, the more likely the order is fraudulent. |
| **Order type** | Shopify | The score grouped into **Low risk**, **Medium risk** or **High risk**. Automatic actions use this tier. |
| **Order from VPN/Proxy** | Blockify | **Yes** or **No**: whether the order came through a VPN or proxy, a service that hides the shopper's real location. See [The "Order from VPN/Proxy" field](#2-the-order-from-vpnproxy-field). |
| **IP Risk Score** | Blockify | How risky Blockify thinks the IP address is, from 0 to 100. It rates the connection, not the order. |

A high-risk order is not always a VPN order, and a VPN order is not always high-risk, so look at the fields together.

**Fraud order score starts at** appears under **Auto-block visitors placing fraud orders** once that switch is on. Blockify blocks the IP address of new orders whose **Fraud order score** is at or above this value. It does not hide orders from the list, and **Risk-based actions** do not use it; they act on the **Order type**.

| Note: Blockify does not score orders itself. If Shopify has not checked an order, it has no score and no Order type, and Blockify does nothing with it.

## The fraud order list

Open **Analytics > Orders**. The summary shows **Total order**, **Total high risk order**, **Total medium risk order** and **Total low risk order** for the selected period. Each order below is a row with these columns:

| Column | What it shows |
|---|---|
| **Order** | The order name, for example `#1100`. Click it to open the order details. |
| **Created time** | When the order was placed. |
| **Order value** | The order total in your store currency, as in Shopify. |
| **Source** | The sales channel or app the order came from, for example **Online Store**; **Unknown** when Shopify does not report one. |
| **Fraud order score** | Shopify's 0–1 score. |
| **Order type** | **Low risk**, **Medium risk** or **High risk**. |
| **IP address** | The IP address the order was placed from. |
| **ISP** | ISP (internet provider): the company that supplies that IP address, for example a home broadband or mobile provider. |
| **IP Risk Score** | How risky Blockify thinks that IP address is, 0–100. |
| **Order from VPN/Proxy** | **Yes** or **No**. |
| **Action** | The **Block IP** and **Cancel order** buttons (they read **Blocked** / **Canceled** once used) and the **...** menu. |

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/a-complete-guide-fraud-filters_1kmd7zp.png)

| Note: **ISP** and **IP Risk Score** show **Unknown** and **N/A** for orders Blockify has not checked yet. Run [Analyze old orders](#2-how-to-analyze-old-orders).

### Copy an order name

Hover over a row to see the copy icon next to the order name and click it. You get the full name with `#`, the same as in Shopify; delete the `#` after pasting if you only need the number.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/20260923-110438_1748u91.png)

## The order details window

Click an order name to open the **Order details** window inside Blockify. The copy icon next to the order name is always visible here. The left block shows **Channel**, **Payment status** (for example **Paid**, **Pending**, **Authorized**, **Refunded**, **Voided**, **Canceled**), **Is VPN**, **Risk score** and the payment gateway; the right block shows the customer's email, IP address, browser, device, country, province and city; below them is the **Shipping address**. Click **Close** to go back to the list. You can check the order without switching to Shopify.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/a-complete-guide-fraud-filters_5whaud.png)

## The "Order from VPN/Proxy" field

**Order from VPN/Proxy** tells you whether the IP address an order was placed from belongs to a VPN or proxy service, so you have one more clue besides the score Shopify gives the order. It sits next to **IP address**, **ISP** and **IP Risk Score** in the list and shows one of two values:

| Value | Meaning |
|---|---|
| **Yes** | The order came from an IP address that belongs to a VPN or proxy. |
| **No** | Blockify did not find a VPN or proxy behind the order's IP address. |

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/20250908-133943_fmfalf.png)

Use the **Order from VPN/Proxy** filter under **Manage filter** to list only VPN orders, and combine it with **Order type** to find orders that are both high-risk and placed through a VPN.

Blockify checks the order's IP address (using the Proxycheck service) to fill in this value, while **Fraud order score** and **Order type** come from Shopify's own check of the order. Because they look at different things, the two do not always agree.

### Case 1: A high-risk order is not necessarily a VPN/Proxy order

Shopify can rate an order **High risk** even when the customer is on a normal connection. Typical reasons:

* **Incorrect order information:** customer or delivery details look inaccurate or inconsistent.
* **Payment issues:** the card was declined or the payment attempt had problems.
* **Unusual shopping patterns:** for example, many orders placed right after creating an account.
* **Linked to earlier fraud:** the order shares details with orders already known to be fraud.

### Case 2: A VPN/Proxy order is not necessarily high-risk

Plenty of real customers shop through a VPN, and Shopify may still rate their order **Low risk**. Common reasons:

* **Security and privacy:** the customer uses a VPN for everyday privacy.
* **Country limits:** the customer wants to reach websites or stores that are limited in their country.
* **Public Wi-Fi:** the customer protects their connection in a café, hotel or airport.
* **Workplace or school networks:** the customer gets around the limits on the internet where they work or study.
* **Hiding the IP address:** the customer does not want websites and advertisers to follow them.

| Tip: Treat **Yes** as one signal, not a verdict. A VPN order that is also **High risk** deserves a closer look before you ship; a VPN order with low scores is usually a normal customer.

## How to find and filter orders?

The list has search, sort, a date range and filters. You can use them together, and **Export** downloads exactly what you narrowed the list to: see [Export fraud orders](#2-export-fraud-orders).

* **Search:** type an IP address or an order name in **Searching by IP address, order**.
* **Date range:** pick a period with the date picker at the top of the page.
* **Sort:** sort by **Created time** or **Fraud order score**, **Ascending** or **Descending**.
* **Tabs:** the list has one tab, **Order Analytics**. While your store has no fraud orders yet, a second tab, **Show data demo**, fills the list with sample orders so you can see how it works.
* **Drill down from a total:** click a number in the summary (for example **Total high risk order**) to open the list already filtered to that tier.

Click **Manage filter** to add filters. The most used ones also appear as shortcuts next to the search box.

| Filter | Use it to |
|---|---|
| Per page | Choose how many orders each page shows. |
| **Order type** | Show **Low risk**, **Medium risk** and/or **High risk** orders. |
| **Order from VPN/Proxy** | Show orders where the value is **Yes**, **No** or **Not Detected**. |
| **ISP** | Show orders from one or more internet providers in your list. |
| **IP Risk Score** | Show orders whose IP address is a **Low risk IP**, **High risk IP** or **Dangerous IP**. |
| **Risk score** | Show orders with one or more exact **Fraud order score** values. |
| **Action** | Show orders already **Blocked** or **Canceled**. |
| **IP address** | Show every order placed from one or more IP addresses. |
| **Country** | Show orders from one or more countries. |
| **City** | Show orders from one or more cities. |
| **Email** | Show orders placed with the email you type. |
| **Order value** | Show orders whose value is **Equal to**, **Greater than**, **Less than** or **Between** the **Min** and **Max** you enter. |

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/20260923-110038_1y563lk.png)

Each active filter shows as a tag above the list; click its **x** to remove it.

## How to analyze old orders?

Orders placed before you turned Fraud Filters on, or before the **ISP** and **IP Risk Score** columns existed, are missing or show **Unknown** / **N/A**. **Analyze old orders** brings them in.

**Step 1:** In **Analytics > Orders**, click **Analyze old orders** at the top right.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/imgv30215qfd38b6fd-5d03-4dce-8_1hhl9b.png)

**Step 2:** Enter **The range for getting old orders (max 30 days)** and confirm.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/a-complete-guide-fraud-filters_13bszil.png)

A banner shows the analysis is waiting to start, then "Analyzing past N days of orders" while it runs; you can leave the page. When it finishes, the banner reads **Old order analysis completed** and the orders appear with ISP and IP Risk Score filled in. If it fails, click **Try again** or contact support.

| Note: Analyzing old orders only adds them to the list. Blockify does not go back and cancel or flag orders that were already placed.

## How to act on a single order?

Every row has two buttons in the **Action** column, **Block IP** and **Cancel order**, plus a **...** menu with **Mark as legit** and **Mark as fraud**. You do these by hand: Blockify does exactly what you click, nothing more.

| Action | What it does |
|---|---|
| **Block IP** | Adds the order's IP address to **Block & Re-director > Blacklist** as a Block rule, so that IP address cannot visit your store again. The button then reads **Blocked**. |
| **Cancel order** | Cancels the order in Shopify, using the cancellation options you set in **Risk-based actions**. The button then reads **Canceled**. |
| **Mark as legit** | Opens a confirmation where you record that the order is genuine (optionally with a reason). A **Legit** badge appears next to the order name. |
| **Mark as fraud** | The same, for an order you have confirmed as fraud. A **Fraud** badge appears next to the order name. |

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/a-complete-guide-fraud-filters_1bwi4q0.png)

| Tip: **Block IP** stops future visits, not the current order. To stop the order as well, cancel it too.

## Automatic actions

Under **Fraud Filters > Risk-based actions** you can tell Blockify to **Cancel order automatically** or **Flag order** per tier (**High-risk orders** and **Medium-risk orders**), choose the cancellation options and get an email each time Blockify takes one of these actions: see [Configure risk-based actions for fraud orders](https://help.omegatheme.com/en/article/configure-risk-based-actions-for-fraud-orders-f6ntu0/). [Auto-block visitors placing fraud orders](https://help.omegatheme.com/en/article/auto-block-visitors-placing-fraud-orders-c1a78ef3-lna9c5/) adds the IP address of every new high-risk order to your Blacklist, and [Stop repeated checkout attempts](https://help.omegatheme.com/en/article/stop-repeated-checkout-attempts-1m94r4s/) stops many checkouts in a row that reuse the same details. You set daily reports and instant alerts in **Settings > General settings > Notifications**: see [Configure fraud order email notifications](https://help.omegatheme.com/en/article/a-complete-guide-general-settings-1wxvhcm/).

## Export fraud orders

You can download the fraud order list as a CSV file to review it offline or share it with your team. The export uses your current filters, and you choose between every matching order or only the page in front of you.

**Step 1:** Open **Analytics > Orders**.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1t7e4dw.png)

**Step 2:** (Optional) Narrow the list with the search box or **Manage filter** — for example **Order type**, **Risk score**, **IP address** or a date range. Skip this step to export everything.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1qchf8m.png)

**Step 3:** Click the **Export** icon at the top right of the list.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_8stdgo.png)

**Step 4:** Pick one of the two options. Both use your current filters and show how many orders the file will have.

| Option | What it exports | Use it when |
|---|---|---|
| **Export filtered results (X orders)** | Every order matching your current filters, across all pages. With no filters, your whole fraud order list. | You have narrowed the list (for example, only **High risk** orders, or one IP address) and want all of them. |
| **Export current page (X orders)** | Only the filtered orders shown on the page you are viewing. | You just need what is on screen. |

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/how-to-export-fraud-orders-01-_deguh4.png)

Your browser downloads the CSV file.

| Note: If the list is empty, or your filters return no orders, the **Export** icon is disabled and shows **No orders to export**.

## Who can use this feature?

* Fraud order list and Shopify scores: available on all plans, including **Free**.
* **Export** of the fraud order list: available on all plans, including **Free**.
* **Order from VPN/Proxy**, **ISP** and **IP Risk Score** columns: available on the **Premium** plan and above.
* **Risk-based actions** and **Auto-block visitors placing fraud orders**: available on the **Enterprise** plan and above.

## FAQs

1. **Does Blockify detect fraud on its own?**
No. The **Fraud order score** and **Order type** come from Shopify's own fraud check. Blockify adds what it knows about the IP address (**Order from VPN/Proxy**, **ISP**, **IP Risk Score**) and lets you act on the result.

2. **Why does an order show Unknown for ISP, N/A for IP Risk Score, or an empty Order from VPN/Proxy column?**
It was placed before you turned Fraud Filters on, or before you upgraded to a plan that includes them, so Blockify did not check it. Run **Analyze old orders** to fill them in for orders from the last 30 days.

3. **Does Blockify cancel orders placed through a VPN?**
No. The **Order from VPN/Proxy** column is for your information only; automatic actions in **Risk-based actions** follow Shopify's **Order type**, not this column. To stop VPN visitors before they place an order, use the **Proxy and VPN blocker** in **Settings > Risk Mitigator**.

4. **I cancelled an order by mistake. Can I get it back?**
Yes. Blockify cancels the order in Shopify, and you can restore it from the order page in your Shopify admin.

5. **Does Mark as fraud cancel the order?**
No. **Mark as legit** and **Mark as fraud** only save your decision and add a badge in the list. To stop the order, click **Cancel order**; to keep that IP address out of your store, click **Block IP**.

6. **The list is empty and the Export icon is greyed out even though Fraud Filters is on. Why?**
Only orders Shopify has checked appear. Widen the date range or clear your filters, or run **Analyze old orders**. **Export** becomes active as soon as the list has orders.