Review a suspect order

Manually review a suspect order.

What is a suspect order?

A suspect order is an order that has been held by our scoring engine or an order rule due to an elevated risk of fraud. To review suspect orders, go to the Suspicious Orders page. hen you can decide whether these orders should be approved, canceled, or subject to SMS verification.

Review a suspect order in NS8

The Order Review page lets you review the details of an order.

To look for fraud, understand your customers. Potential fraud indicators include issues with the customer's device, location, or payment. Fraud review is not a one-size-fits-all process. You decide the criteria that are most relevant to your business. For example, a discrepancy between the customer's billing and shipping addresses might be a strong fraud indicator for some vendors. For a business whose products are often gifts, a discrepancy between addresses might be less of a risk. Another indicator is order size. An unusually large order often indicates fraud, but every business will have its own expected range of order sizes.

The Order Review page includes several elements that provide useful information about an order. These include:

  • Payment Issues: Lists the payment issues that have been identified, if any. If this payment poses a risk, you might SMS verify the order before taking further action.
  • Primary User Issue: Clarifies how we determined the order's risk level, if applicable.
  • Locations: Provides information about the customer's shipping address, billing address, and the location of the device used to place the order. Depending on the order, these locations may be the same, very close together, or far apart. Too much distance between these locations often indicates a high level of risk. All three locations appear on the world map using color-coded markers.
  • Navigation: Lists the pages that the user opened, the amount of time spent on each page, and the order in which they were visited. There may be gaps in navigation data if the user times out, opens a new window, or leaves the page idle before returning at a later time. If a user navigates pages with excessive speed or in a pattern that’s not consistent with normal behavior for your store, it can indicate a high level of suspicion.  
  • User Details: Provides details about the user that can help you identify fraudulent activity. For example, an email address that is a random selection of letters and numbers might be a throwaway account. Order history can also help you determine if a user is valid if they deviate from your store's norms.
  • Session Details: Provides information about the way a user accessed your site, like their device type and operating system. If these details do not align with the rest of the information gathered about a user, this is also a fraud indicator. For example, Safari is not available for products not made by Apple, so a user browsing through Safari on a Windows device (a combination that should not be possible) is suspicious.

Suspect order recommendations

The NS8 Status and NS8 Recommendation fields contain values to help you decide on an action.

  • Investigate - Indicates that there is a low to medium degree of suspicion associated with the order. Investigate the order further.
  • Cancel - Indicates that the order has a high level of suspicion. Consider canceling the order. This order might be marked as high risk because of an order rule, or because of a strong fraud indicator like an extreme payment risk. These orders will not automatically be canceled unless you create an order rule to do so.

Fraud review results

After you review these factors, you can decide on an action:

  • Approve: Accept the order and let it continue on your fulfillment path.
  • SMS Verify: Ask the customer to verify their order. If they respond positively, the order will be approved.
  • Cancel: Cancel the order and communicate the cancellation to your ecommerce platform accordingly.