Fraud orders are eating your stock: the reservation problem and the cleanup

Friday, 9:40 pm. An order lands for fourteen phone stands — your bestseller — and ten minutes later a second order from the same name with a different email. Shopify's fraud analysis flags both as high risk. You don't fulfill. You also don't cancel until Monday, "to see what happens." By Monday the fraudster has moved on, but those 28 units spent the whole weekend locked in Committed: unsellable to everyone else, invisible in your available count, sitting directly on top of a promo weekend. The fraudster never paid a cent, and your bestseller still went out of stock for part of Sunday.

That's the half merchants miss. A fraudulent order is a payment problem and a stock problem at the same time. The payment dispute has its own playbook — this article is the other side: what a fraud order does to your quantities while it sits, the cleanup sequence that releases them without losing any, and the one checkbox that quietly corrupts your counts when it gets missed.

What a fraud order actually does to your inventory

The moment any order is placed — fraud or not — Shopify moves its units from Available into Committed. Committed inventory is defined by Shopify as units in an unfulfilled order, reserved in a draft order, or in a transfer marked ready to ship (Shopify Help Center, "Understanding inventory states," accessed November 2026). Committed units are physically on your shelf but cannot be sold to anyone else.

So a fraud order doesn't just threaten a chargeback. It occupies stock, exactly like a real customer would, for as long as you let it sit. If Available, Committed, and On hand aren't yet second nature, the inventory states guide maps all five states and how units move between them. Every ending to that order affects your numbers differently:

The last row is the sneaky one. While you wait and see, the order reads as demand in your unfulfilled queue, and its units read as unavailable in your stock — both interpretations are wrong, and both skew decisions you make this week. (If you treat the unfulfilled backlog as a buying signal, it's worth separating real backlog from noise — reading unfulfilled orders as an inventory signal covers that.)

The cleanup, in order

When you decide a suspect order is in fact fraud, the sequence matters. Every step below traces to the Shopify Help Center's canceling-orders documentation, accessed November 2026.

1. Cancel before fulfillment, not after. A partially fulfilled order can't be canceled outright — you'd have to cancel the fulfillment first. If you're unsure what state the order is actually in, the order status translation guide maps each Shopify status to the inventory state it produces. Canceling before anything ships is also what keeps you on the easy side of the payment dispute line.
2. Check the Restock inventory box. In the cancel dialog, restocking is selected by default, and deselecting it means the canceled items are not returned to your inventory. That default exists for a reason — but bulk-cancel flows and fast clicking defeat defaults. This single checkbox is where most stock damage from fraud cleanup happens.
3. Choose the refund option deliberately. You get three: full refund to the original payment method (the default), full refund to store credit, or refund later. For suspected fraud: if the payment was only authorized and never captured, canceling voids the authorization — nothing to refund at all. If payment was captured, "later" lets you investigate before money moves. Store credit pays a fraudster in your own currency; skip it.
4. Confirm the units actually came back. Open the variant's inventory page. Available should have risen by exactly the canceled units. If it didn't, fix it now with an adjustment — not at the next count, when the miss has already polluted a week of decisions.
5. Void the shipping label if you bought one before canceling.
6. Log it in one line. Order number, date, units, SKU, action taken. The cancel dialog has a staff note field for the order's own record; your fraud log is for the pattern. Six months of one-line entries is how you notice that the same city, carrier, or product keeps showing up — and it feeds a graduated response the same way return abuse does, which is the pattern work in return abuse detection.

The damage, worked with real numbers

Deskedge Supply sells phone stands and desk accessories. Here's one incident, end to end (all figures illustrative):

Setup. Thursday close: SKU PHN-STND-BLK shows Available 30, Committed 2, On hand 32. Weekend promo velocity is running about 7 orders per day.

The hit. Friday 9:40 pm, a high-risk order takes 12 units. Committed jumps to 14; Available drops to 18.

The weekend. Legit demand of roughly 21 orders over Friday-to-Sunday competes for 18 sellable units. By Sunday evening Available hits zero while the promo is still live — an estimated 3 orders' worth of demand went unserved, roughly $72 in estimated lost revenue at the $24 retail price. Estimated, because you can't see the carts that bounced off a sold-out flag; the estimate is deliberately conservative.

The misclick. Sunday night, a staff member cancels the fraud order — with the restock checkbox deselected. Those 12 units were never physical, so nothing comes back. At the phone stand's unit cost of $9.80, the books now show $117.60 of phantom shrinkage. Next month's count chases twelve ghosts, and if nobody catches the cause, the count variance gets booked as theft that never happened.

The correct ending. Same weekend, restock left on: Sunday's cancel returns 12 units to Available mid-promo, the sold-out hour ends early, and Monday's numbers reconcile to the shelf without a story to explain.

Two failure modes, then, and they compound in opposite directions. The un-restocked cancellation understates stock forever — corrupting your accuracy rate, your next reorder, and any valuation you show a lender. The too-long hold understates availability in real time — causing you to over-order on a panic PO or to turn away demand that was actually servable. One corrupts the record; the other corrupts the week.

Prevention that costs minutes, not money

Shopify gives you three native layers, as of November 2026:

• Fraud analysis on every order. Each order is reviewed automatically and flagged low, medium, or high risk, with indicators like AVS and CVV checks, IP address details, and unusual purchase patterns (Shopify Help Center, "Protecting orders from fraud"). The discipline is simply to look before you fulfill — the flags are free; fulfilling high-risk orders unreviewed is how stock leaves for good.
• Flow automation for the gap. Shopify Flow workflows can cancel and restock orders that meet specific fraud criteria — which closes exactly the "left open all weekend" hole from the scenario above. A workflow that auto-cancels-and-restocks confirmed-pattern fraud keeps the stock problem at zero while you handle the payment side by hand.
• Fraud Protect, where eligible. For eligible US merchants on Shopify Payments, Fraud Protect guarantees payment on orders classified as protected and handles the chargeback process for you. Check your eligibility in the admin; it changes the calculus on borderline orders because the payment risk moves to Shopify.

When a fraud order was fulfilled and paid, the stock question is over — the fight becomes evidence, deadlines, and the double-refund trap, and that's where the Shopify chargeback playbook takes over. This article's boundary is everything before that.

One honest note on tooling: cleanup should stay manual, because no app should be canceling orders and moving your money without a human deciding. What we built on the watch side of InventoryX is narrower — run-out risk alerts priced in dollars and a per-SKU ledger of out-of-stock days — so a weekend like Deskedge's shows up as a flagged line item on Monday morning instead of a dim memory in week three.

Common questions

Does a fraudulent order hold my Shopify inventory? Yes. The instant the order is placed, its units move from Available to Committed and can't be sold to anyone else. They stay locked there until you cancel the order with restocking enabled, or fulfill it. An untouched fraud order can hold your bestseller hostage for days while real demand bounces off it.

Does Shopify restock items automatically when I cancel an order? The cancel dialog's Restock inventory option is selected by default and returns canceled items to available stock — but it can be deselected, and fast clicking or bulk canceling defeats defaults easily. Always confirm the variant's Available quantity rose by exactly the canceled units before you close the incident.

Should I refund a suspected fraudulent order right away? Use the cancel flow's options deliberately. If payment was only authorized, canceling voids the authorization and nothing needs refunding. If payment was captured, choose refund-later while you investigate. Store credit hands a fraudster spending power, and refunds don't return your transaction fees either way.

Can Shopify auto-cancel high-risk orders? Yes, through Shopify Flow: workflows can cancel and restock orders meeting specific fraud criteria, and fraud analysis already flags every order low, medium, or high risk automatically (Shopify Help Center, as of November 2026). Fraud Protect adds guaranteed payment on protected orders for eligible US merchants using Shopify Payments.

What does a caught fraud order actually cost me? Usually fees and minutes: a voided or refunded payment (refunds don't return transaction fees), a voided shipping label if you made one, and some staff time. The expensive part is stock damage — units held unsellable during a promo, or permanently miscounted if the restock step was missed.

Next step

Before you touch the next suspicious order, write down the SKU's Committed quantity. Cancel with Restock inventory on, confirm Available rose by the same units, and log the order in your one-line fraud log. That's the whole protocol, and it takes about two minutes per incident. If the payment side is your live fire — evidence, deadlines, the double-refund trap — hand the case to the Shopify chargeback playbook, which picks up exactly where this cleanup ends.