An ecommerce fraud review workflow is the set of rules, queues, checks and decisions that determines what happens to an order your automated screening can’t confidently approve or decline. Done well, it stops fraudulent orders, protects good customers from false declines and gives your team a repeatable way to decide. This guide walks through each stage, from the moment an order is flagged to the metrics that tell you whether the process works.
TL;DR
- Automate the clear approvals and clear declines, and send only the uncertain middle to human review.
- Give every flagged order the same checks: score, triggered rules, device, IP, address match, order history and, when needed, step-up verification.
- Prioritize the queue by order value and age so legitimate customers aren’t left waiting.
- Log every decision with its reasoning. That record feeds chargeback disputes and rule tuning.
- Track fraud rate, block rate, false positive rate and review rate, and revisit rules on a fixed cadence.
Table of Contents
- What a fraud review workflow is, and why merchants use one
- How an order moves from screening to a decision
- What reviewers should check
- Document every decision
- Measure whether the workflow works
- Compliance considerations in the U.S.
- Our perspective
- Staffing the workflow with a managed team
- Getting started: a 30-day setup
- FAQ
- Sources
What a fraud review workflow is, and why merchants use one
Most payment and risk platforms treat review as a distinct state. Orders that match criteria defined in your risk rules are held for manual review before capture, a approach merchants use to cut fraudulent payments, including on high-value orders or when entering higher-risk markets. In that state the transaction is authorized but not automatically captured, so the money doesn’t move until a person decides.
Manual review is common. A 2017 CyberSource benchmark found 79% of North American businesses used it, with roughly 25% of orders inspected. That figure is dated, and many merchants have since cut their review rates, but it shows how heavily the industry once leaned on people.
The lesson is not that review is bad. It is expensive and slow, so it should be reserved for the orders where human judgment adds something a model can’t. One practitioner view is that manual review should convert high-risk “in-between” orders rather than serve as a primary defense, because it is time-intensive and doesn’t scale as volume grows. Visa makes a similar point: manual review is slow and costly, and businesses are moving to instant digital screening to reduce how often it’s needed.
For the operations leader, that frames the real question. It isn’t “should we review orders?” It is “which orders deserve a person’s time, and how do we make each review fast, consistent and defensible?”
How an order moves from screening to a decision
A workable flow has four stages.
- Real-time screening. Automated systems screen transactions as they arrive and, based on risk thresholds, approve, decline or challenge them.
- Case creation. A challenged result creates a case. Per the same documentation, if the reviewer continues, the transaction goes on to authorization; if they stop it, it doesn’t.
- Review. An analyst works the case using a standard checklist (below).
- Resolution. The order is approved, declined or escalated, the outcome is logged and the order status updates.
The design choice that matters most is where you set the thresholds between the three outcomes. Set the review band too wide and your queue floods. Set it too narrow and you push uncertain orders into either fraud losses or false declines. Start with a band that your team can clear in a day, then adjust using the metrics later in this guide.
Prioritize the queue
A queue worked first-in, first-out lets a $4,000 order sit behind a $19 one. Sift’s guidance is to prioritize by order value and age to prevent the backlogs that frustrate legitimate customers. In practice, many teams sort by value, then set a maximum age after which an order escalates automatically to a senior reviewer.
Also route by order type. Digital goods and next-day-shipping orders leave your control quickly, so they deserve a shorter service window than a made-to-order item that ships in two weeks.
What reviewers should check
Give reviewers a fixed checklist, so two analysts looking at the same order reach the same conclusion. Start with what the system already knows: the score, the rules that triggered, the device and the IP. Knowing which rule fired tells the reviewer what to investigate first.
Then look at the signals analysts commonly weigh, which Stripe lists as red flags:
- Billing and shipping addresses that don’t match
- Velocity anomalies, such as several orders in a short window
- Unusual session behavior
- An order composition that departs from the customer’s usual purchases
No single signal decides a case. A mismatched address is normal for gifts. A first-time buyer ordering five of the same high-resale item to a freight forwarder is a different story. Train reviewers to look for clusters of signals and to write down which ones drove the decision. For a broader view of why these controls matter to the business, see why ecommerce cybersecurity matters.
Verification steps before you decide
When signals conflict, verify. Common steps include:
- Checking identity details, device fingerprint and reputation, and behavior against history, with step-up verification for cases that are unclear but risky
- Reviewing the customer’s transaction history and comparing the IP address with prior purchases
- Contacting the customer or the issuing bank to confirm shipping and billing details
Contact is where customer experience and fraud control collide. Keep the message short, neutral and specific. Ask the customer to confirm something only the real cardholder would know or can easily do, and never imply an accusation. Set a response window, such as 24 hours, and state it in the message. If the customer doesn’t reply by then, apply a consistent default (usually cancel and release the authorization) rather than leaving the order in limbo.
A simple decision frame
| Outcome | When it fits | What happens next |
|---|---|---|
| Approve | Signals are explained and verification passed | Capture payment, release for fulfillment, consider adding to an allow list |
| Decline | Fraud is confirmed or verification fails with strong risk signals | Cancel, release the authorization, add confirmed identifiers to a block list |
| Escalate | High value, unusual pattern or conflicting evidence | Senior reviewer or fraud lead decides; note why |
The three outcomes mirror the approve, decline or escalate options used in operational playbooks, including the practice of adding identifiers to a block list only once fraud is confirmed. Be careful with that last step. A block list built on suspicion rather than confirmation quietly turns into a false decline machine.
Document every decision
Undocumented decisions are the most common weakness in review programs. Three reasons to fix that:
- Consistency. New reviewers learn from past cases instead of guessing.
- Disputes. Effective workflows record every decision in a log with supporting reasoning, which helps in later chargeback disputes.
- Tuning. The same log lets management refine automated thresholds based on actual chargeback outcomes.
A useful log entry is short: order ID, reviewer, signals observed, checks performed, decision, reason, and any customer contact. Also push the result back to your order system. Platforms support webhooks that update order status after a decision, and documenting the proper status lets reviewers factor it into future decisions on the same customer.
If a fraudulent order does turn into a dispute, the evidence your reviewers recorded becomes your representment file. Our guide to the chargeback dispute process covers the acquirer deadlines and what a strong response contains.
Measure whether the workflow works
A review process can look busy and still be failing. The core measures are:
| Metric | What it tells you |
|---|---|
| Fraud rate | Confirmed fraud dollars against transaction dollars |
| Block rate | Share of orders declined |
| False positive rate | Legitimate orders incorrectly blocked |
| Review rate | Share of orders sent to a person |
The same playbook suggests setting targets using comparable traffic and investigating results outside the planned range. Read the metrics together. A falling fraud rate with a rising false positive rate means you bought safety with lost revenue. A falling review rate with a rising chargeback count means automation is approving too much.
Add two operational measures your team controls directly: median time in queue and reviewer agreement on audited cases. If the first climbs, customers wait. If the second is low, your checklist isn’t specific enough.
A review cadence
One suggested rhythm: clear the queue daily, check false positives and fraud losses weekly, review rules monthly and rerun threshold sweeps quarterly. Treat it as a starting point and shorten it during peak seasons, when fraud patterns move fast and volume swells.
Compliance considerations in the U.S.
Most merchants selling goods aren’t financial institutions, but some businesses are. The FTC’s Red Flags Rule applies to financial institutions and certain creditors with covered accounts, which must maintain a written identity theft prevention program. The FTC guidance notes that reasonable procedures for verifying a new account may include obtaining a name, address and identification number. If you offer installment plans or store credit, ask counsel whether you fall within scope.
Separately, collect only the data a reviewer needs. Reviewers shouldn’t see full card numbers, and notes shouldn’t hold sensitive personal data. If your reviewers work with identity documents, our KYC verification playbook shows how a staged process keeps verification proportionate.
Our perspective
We see fraud review as an operations problem as much as a risk problem. The model flags the order, but the outcome depends on whether a trained person with a clear checklist, a realistic queue and a defined escalation path handles it the same way every time.
Three patterns come up again and again in ecommerce support operations:
- Review work is spiky. Volume surges around promotions and holidays, and a fixed in-house team either backs up or sits idle the rest of the year. A managed team that scales with demand fits this better.
- Fraud and service are connected. The reviewer who emails a customer is representing your brand. Tone, speed and bilingual capability affect whether a legitimate buyer stays.
- Process beats heroics. Written SOPs, audited decisions and regular rule reviews matter more than any single sharp analyst.
That is why we build nearshore teams with cultural alignment to U.S. customers, structured SOPs and measurable performance frameworks. If you also handle returns, returns management deserves the same discipline, since return abuse often shows up in the same signals. And for teams weighing outsourcing of fraud-adjacent work, our 30/90/180 plan on outsourcing risks lays out how to phase it responsibly.
— Daniela
Staffing the workflow with a managed team
If your queue is growing faster than your headcount, a managed nearshore team can absorb order review, customer verification outreach and case documentation while your fraud lead keeps ownership of rules and thresholds. Altiam CX provides managed team extension and ecommerce customer experience support, with bilingual agents and scalable deployment from Latin America. You keep control of policy, and we run the day-to-day under agreed SOPs and reporting.
See how Altiam CX services fit your operation, or talk with us about a team built around your review queue.
Getting started: a 30-day setup
- Week 1: map the flow. Write down where orders are approved, declined and sent to review today, and who decides.
- Week 2: write the checklist. Turn the signals and verification steps above into a one-page SOP with decision criteria and escalation triggers.
- Week 3: set up logging and priorities. Add the log fields, queue sorting by value and age, and a customer contact template.
- Week 4: baseline the metrics. Record fraud rate, block rate, false positive rate, review rate and time in queue, then schedule your first monthly rule review.
For the wider support picture around fulfillment and customer contact, see our overview of ecommerce support operations.
FAQ
What is the difference between manual review and automated fraud screening?
Automated screening scores each order in real time and approves, declines or challenges it. Manual review is what happens to challenged orders: a person examines the evidence and decides. The two work best together, with automation handling clear cases and people handling uncertain ones.
How many orders should go to manual review?
There is no universal number, because it depends on your products, customers and risk tolerance. Set a review band your team can clear daily, track review rate beside false positive rate, and adjust thresholds as outcomes come in. A rate that keeps climbing usually signals that rules need tuning.
How long should a reviewer take to decide?
Set a service window based on how fast the order ships. Fast-shipping and digital orders need decisions within hours, while slower fulfillment allows longer. Prioritize by value and age so high-risk, high-value orders never wait behind small ones.
Should we contact the customer during review?
Yes, when signals conflict and verification can resolve them. Keep the message neutral, ask for something only the genuine buyer can confirm, state a response deadline and apply a consistent default if there’s no reply. Log the contact and its outcome.
Sources
- Case management, Adyen Docs
- The Manual-Review Question, Digital Transactions
- Manual Review, FraudPractice
- Fraud management explained, Visa
- Fraud management overview, Worldline
- Getting Started with Manual Review, Sift
- Playbook: Running Fraud Operations
- Payment Fraud Red Flags, Stripe
- Manual Review, Payments and Risk
- Review Order: Fraud review and detection, Signifyd
- Order Fraud Review SOP Template
- Fighting Identity Theft with the Red Flags Rule, FTC
- Why ecommerce cybersecurity matters
