Shopify Protect is genuinely free and genuinely useful, and it's the reason a lot of US merchants have stopped thinking about chargebacks. That's the risk.

The Terms of Service define exactly two "Acceptable Reason Codes" for a Protect claim: Fraudulent and Unrecognized. Everything else is out. Shopify's dispute documentation uses a separate taxonomy of seven categories — credit not processed, duplicate charge, product not received, product unacceptable, subscription canceled, and general, alongside fraudulent transaction — and only the fraud-related ones map to Protect.

Product mix excludes orders too. A single digital item or a single buy-online-pickup-in-store item disqualifies the whole order, not just that line.

And the eligibility conditions are tighter than the marketing suggests. Ship after day seven and coverage is gone. Change the shipping address post-checkout and coverage is gone. Use a carrier that appears on the help center's list of 13 but not the Terms of Service definition of 5, and you're in territory where Shopify's own two documents disagree.

Below: what Protect actually covers, the nine ways it silently doesn't, and the free stack that handles everything outside those lines — starting with the one lever that moves liability off you entirely. Research date: September 1, 2026.

The short version

Protect is not insurance, and the Terms say so in those words: "Shopify Protect does not constitute insurance" and Shopify is not an insurer. It's a credit issued against a specific class of loss under specific conditions.

Two reasons, not all chargebacks. Fraudulent and Unrecognized only. Everything a customer files because the box never showed up or the subscription kept billing is on you.

Physical, fulfilled, fast, and unchanged. Every non-refunded line item must be Fulfilled. Tracking must be on within 7 days and in transit within 10. One digital item or one store-pickup item voids the whole order. Shop Pay Installments is excluded. Subscriptions get first order only. A post-checkout address change voids coverage.

3D Secure is the lever that covers cases Protect can't. Shopify's help center states that enabling 3D Secure at checkout means a fraudulent chargeback can't be filed against that order at all. That's liability shift, and unlike Protect it isn't restricted to Shop Pay orders or physical goods. It has its own boundaries though: Shopify documents 3D Secure as an authorization method for online Visa and Mastercard transactions, and liability shift applies to fraud disputes only.

Two things most merchants still have wrong: Shopify's own Fraud Filter app has been pulled from the App Store, and the Order Risk REST/GraphQL API has been deprecated since April 2024.

What Protect actually covers

Shopify Protect is free and applies to eligible Shop Pay orders — including Shop Pay express checkouts on Facebook, Instagram, and Google. Eligibility requires being located in the US with a US Shopify Payments account; the Terms add that the payout bank account must be at a US bank in the business's name.

When a protected order is disputed, the dispute amount and the chargeback fee are debited and immediately credited back. You do nothing. If the issuing bank later resolves in your favor, the funds and fee return and Shopify reverses its credit. Protected orders are warrantied for 365 days, and the chargeback notice must arrive within 12 months of the order date.

One more clause worth knowing: if your store lands in a card network's chargeback monitoring program, Shopify suspends Protect. The safety net is withdrawn precisely when you'd need it most.

The nine ways coverage disappears

Condition	What voids it
Dispute reason	Anything other than Fraudulent or Unrecognized
Product type	One digital item or one BOPIS item voids the entire order
Fulfillment	Any non-refunded line item not marked Fulfilled
Ship-by	No valid tracking within 7 days of the order
In-transit	Carrier hasn't marked it in transit within 10 days
Carrier	Any item shipped on an unsupported carrier voids the whole order
Payment	Shop Pay Installments
Address	Shipping address changed after checkout
Recurring	Subscription orders after the first

The carrier row deserves a note. The help center lists thirteen supported carriers: SFN, USPS, UPS, Canada Post, DHL Express, FedEx, TForce Final Mile, Lone Star Overnight, United Delivery Service, CDL Last Mile, Lasership, GLS, and Ontrac. The Terms of Service definition of "Supported Tracking Number" lists five: USPS, UPS, Canada Post, DHL Express, and FedEx. These documents do not agree. If you're routing volume through a regional last-mile carrier and relying on Protect, the conservative reading is the Terms.

We also could not find any stated dollar ceiling on protected orders in either the help center or the Terms. That means unstated, not unlimited.

The free stack for everything Protect doesn't cover

All five of these are free, available on Basic, and available outside the US. Two of them — Fraud Control's chargeback health status and its checkout rules — require that you process on Shopify Payments. Order matters.

Turn on 3D Secure

Settings → Payments → Shopify Payments → Edit → Fraud prevention → 3D Secure.

The help center's line is unusually direct: enabling 3D Secure at checkout means a fraudulent chargeback cannot be filed against that order. Successful 3DS authentication shifts liability for fraud disputes from you to the issuing bank.

Three caveats. Liability shift has a ceiling — Visa withdraws it from merchants receiving more than $7,500 in fraudulent chargebacks in a month. 3DS covers fraud disputes only; product-not-received and product-unacceptable claims are unaffected. And Shopify defines 3D Secure as an additional authorization method for online Visa and Mastercard transactions, with no documented treatment of other networks such as JCB or American Express.

On behaviour: Shopify states generally — not only for PSD2 regions — that "Shopify Payments is optimized to minimize the use of 3D Secure, and only uses 3D Secure when required by the issuing bank." What is scoped to PSD2 regions is Dynamic 3DS, the automatic 3DS checkout flow for stores located there. Outside those regions the toggle is available, but the documentation doesn't spell out whether turning it on forces authentication on every transaction or still defers to the issuer. Ask Shopify Support before you rely on one reading.

Switch payment capture to manual

Review high-risk orders before the money lands. This is also a prerequisite for any Flow workflow that controls capture — those workflows simply don't function on automatic capture.

Install Fraud Control and find out where you stand

First, a correction that outdates a lot of published advice: Shopify's own Fraud Filter app is no longer available on the App Store. The page returns "this app is currently not available on the Shopify App Store." Guidance that says "Advanced plans and up get Fraud Filter" no longer describes reality.

The replacement is Fraud Control — Shopify-built, free, available on every plan in Shopify Payments regions. Its most useful output is the chargeback health status, with published thresholds: under 0.4% is good standing, 0.4% to 0.6% is at risk, above 0.6% is elevated risk. That status only appears if you actually process on Shopify Payments; without it the dashboard shows just acceptance rate, high-risk orders, and orders canceled due to fraud.

Two mechanics behind that number surprise people. Winning a dispute does not remove it from your chargeback rate — the rate counts filings, not outcomes. And the rate that governs Shopify Payments account monitoring, reserve thresholds, and Shop app eligibility is the NDRP-inclusive rate, which includes disputes auto-resolved before they became formal chargebacks.

Build Flow rules on the right trigger

Shopify Flow is free and available from Basic — not an Advanced-plan feature, despite common belief.

Use the Order risk analyzed trigger, not Order created. Shopify documents this explicitly: risk analysis takes time, so Order created fires before a verdict exists. Fraud Control ships templates for capturing non-high-risk orders, cancelling and restocking high-risk ones, cancelling orders from known-bad email addresses, and capping customers at five orders per day.

Block at checkout, before an order exists

Fraud Control's checkout rules filter on email, address attributes, and IP, and stop the checkout before an order is created. This feature requires Shopify Payments. Blocked attempts land in abandoned checkouts, and the customer sees a generic error rather than a fraud notice.

Stopping things pre-order matters more than it sounds. Shopify's card-testing guidance warns that cancelling or voiding a high-risk order doesn't eliminate chargeback risk: the authorization hold can still appear on the real cardholder's statement, and if they report it, a chargeback can follow even though you never captured the funds.

A note on AVS and CVV

AVS rejection is off by default in Shopify Payments, and Shopify warns in writing that enabling it may increase payment failures. Also worth knowing: stored-card transactions such as Shop Pay don't retain the CVV and are processed without CVV verification — so "Shop Pay orders passed CVV" is not a thing.

Five fraud apps compared

	Fraud Control	Beacon Fraud Prevention	Blockify Fraud Filter, Blocker	Wyllo	Signifyd
Developer	Shopify (CA)	Lizuna KK (Tokyo)	Blockify (VN)	Wyllo, LLC (US)	Signifyd (US)
Built for Shopify	No	Yes	Yes	No	No
Rating / reviews	2.4 / 20	4.6 / 13	4.9 / ~1,580	4.8 / 152	4.5 / 71
Entry price	Free	$0.03 per order	Free (paid from $9.99/mo)	Free (guarantee from $250/mo)	Undisclosed, billed externally
Billing unit	None	Per order / monthly	Flat monthly	1–1.5% of revenue plus monthly minimum	Not verifiable
Chargeback guarantee	No	No	No	Yes, fraud only ($500 / $1,000 / $2,000)	Yes, fraud and non-fraud
Guarantee caps and exclusions	—	—	—	Not stated on listing	Not stated on listing
Pre-order blocking	Yes (Shopify Payments required)	Yes	Yes	Yes	Listed as instant approve/decline at checkout
Shopify Flow	Templates only	Yes	Yes	Yes	Not listed
Identity verification / OTP	No	Yes (both)	No	Identity verification only	Not listed

Reading the table

The guarantee is the whole decision, and it's the least documented part. Only Wyllo and Signifyd offer one. Neither publishes its coverage caps or exclusions on the App Store listing. Wyllo's plan names — $500, $1,000, $2,000 — are the guarantee ceilings, but whether that's per transaction or per period isn't stated; the vendor's own review replies note that the maximum per-transaction reimbursement varies by account history, monthly volume, and vertical. All three guarantee tiers are also scoped on the listing to merchants under $50K/month, with custom pricing above that. That's a contract negotiation, not a pricing page.

The recurring complaint about guarantee products is that the guarantee doesn't pay. Across Signifyd's 8 one-star and 2 two-star reviews, the same theme repeats over multiple years: approved orders charged back, claims declined for one reason or another, fine print described as full of holes. Other reviews describe false positives blocking thousands of legitimate orders and billing that continued on cancelled orders. These are merchant claims, not verified facts — but they're the questions to put in writing before signing.

First-party doesn't mean good. Fraud Control sits at 2.4 stars, with one- and two-star reviews making up 55% of the total. The repeated criticisms are specific and credible: it's effectively a Flow template collection, it can block High risk but not Medium risk, and it can't block by domain — so an attacker cycling addresses at one domain has to be blocked one address at a time. It's free and worth installing for the dashboard. Don't expect it to stop fraud.

Blockify's risk is your own configuration. 4.9 across roughly 1,580 reviews looks unimpeachable until you read the low ones: a double-negative label on the "Block Countries" screen that blocked the US along with everything else and effectively took a store down for hours (the vendor acknowledged the UX flaw), and a beta bot-blocking feature incompatible with a merchant's theme that blocked 95% of checkout attempts after $2,000 of ad spend. Roll it out in stages and verify. The listing gives the developer's address as Hanoi, Vietnam.

Beacon is the outlier on billing model. $0.03 per order with no contract and no minimum, from a Tokyo-based developer, with Built for Shopify certification and features other apps here don't list — OTP identity verification and cash-on-delivery validation. Thirteen reviews is too small a base to draw conclusions from, and there's no guarantee. But for a store that wants per-order economics instead of a $250 monthly floor, it's the only one structured that way.

One structural limitation on this table: App Store listings render compatibility requirements client-side, so we could not verify whether these apps require Shopify Payments — except Fraud Control, confirmed via the help center. Ask the vendor.

Names that changed

• NoFraud Fraud Protection is now Wyllo (the listing itself reads "Wyllo (NoFraud + Yofi)"). The old handle nofraud-fraud-protection no longer serves a listing as of September 1, 2026; the live handle is nofraud-chargeback-prevention-and-protection.
• Fraud Filter (Shopify) is discontinued. Fraud Control replaced it.
• The Order Risk REST and GraphQL APIs are deprecated as of April 2024. order-risk, field-order-risks, and field-order-riskLevel give way to OrderRiskAssessment and the orderRiskAssessmentCreate mutation, with a new orders/risk_assessment_changed webhook topic.

That last change explains something visible in your admin: OrderRiskAssessment.provider is documented as "the app that provided the assessment; null if provided by Shopify." It's why Shopify's verdict and your fraud app's verdict now appear side by side on the order page.

Before you decide

• Is 3D Secure on? It covers cases Protect doesn't, and it isn't tied to Shop Pay or to physical goods — though Shopify documents it for Visa and Mastercard transactions, and it shifts liability for fraud disputes only.
• Is capture still automatic? Manual capture is the prerequisite for every useful Flow rule.
• Do you know your chargeback rate against the 0.4% / 0.6% thresholds?
• Do your Flow workflows use Order risk analyzed rather than Order created?
• Does your product mix include digital goods or BOPIS? If so, Protect is structurally unavailable to those orders no matter what you do.
• Are you shipping on a carrier that appears in the help center list but not the Terms definition?
• If you're evaluating a guarantee product, have you asked in writing for the cap basis, the exclusion list, and the false-positive rate?
• Is your dispute evidence process built around the 7-to-21-day submission window? There is no appeal — the decision is final.

Bottom line

Know the shape of the coverage you have. Two reason codes, physical goods, seven-day ship, unchanged address. Everything else — and that's most of the dispute taxonomy — is unprotected regardless of how good Protect is at what it does.

Fill the gaps with the free stack first. 3D Secure, manual capture, Fraud Control for visibility, Flow for automation, checkout rules for pre-order blocking. Five things, no cost, no plan requirement above Basic.

Treat guarantee products as a contract, not an install. At $250/mo minimum, a guarantee needs to beat your actual annual chargeback losses to make sense — and you can't evaluate that without the cap basis and exclusion list, neither of which is published.

Every figure here reflects Shopify's help center, developer docs, Terms of Service, and App Store listings as of September 1, 2026. Protect's eligible regions, app pricing, and review counts all move — re-check before you commit.