NS8 User Guides

Reviewing a Suspect Order

How to perform a manual review of a suspect order.

What is a Suspect Order

A suspect order is an order that has been quarantined by NS8's EQ8 Scoring Engine as potential fraud. An order can be quarantined as suspect due to NS8's review of the order or because of an Order Rule that you created. In either case, you will need to decide whether order will be approved, SMS Verified, or canceled.

Potential fraud indicators include issues with the user's device, location, or payment, among other things. Fraud review is not a one-size-fits-all process; therefore, you need to decide how the fraud review process will work best for your business. Contact our support team using the chat icon below if you need assistance with reviewing your order data.

Most businesses will use automation to verify a majority of suspect orders and save manual review for marginal cases. This article explains how to manually review a quarantined order and will help you understand some of the best practices for fraud screening automation.

Automated Fraud Screening

Suspect Order Recommendations

The NS8 Status field and NS8 Recommendation fields contain values to help guide your course of action.

Recommendation: Investigate

This recommendation indicates that there is a low to medium degree of suspicion associated with the order, and further investigation is warranted.

Recommendation: Cancel

This recommendation indicates that the order carries a high level of suspicion and you should consider canceling the order. This can be due to an Order Rule that marks the order as high risk, or because of a strong fraud indicator like an extreme payment risk. These orders will not be automatically canceled unless you create an Order Rule to do so.

Reviewing a Suspect Order in NS8 Protect

The Order Review screen is where you can review the details of an order. The steps below will help you apply that information to your customer profile. Understanding your good customers is key to fraud screening. For example, a billing and shipping address mismatch may be a strong fraud indicator for some vendors, but for other businesses where products are often sold as gifts, a mismatch may pose less of a risk. Another indicator is order size, since unusually large orders often indicate fraud. These are some key factors to consider in your manual fraud review:

  • Payment Issues: The information in this screen indicates whether potential issues with a payment have been identified. If there are payment issues identified, you will probably want to SMS Verify or contact the customer before approving the order.
  • Primary User Issue: The risk factor identified will indicate how NS8 Protect determined the risk level associated with the order.
  • Locations: Locations can be a strong indicator of fraud by comparing billing and shipping information to the device location to evaluate an order's risk. Depending on the profile of your customers, orders shipped to a different country than from where the order originated may be an example of a high risk order. A device located in a different country than the orders addresses can also be a fraud indicator. The ISP Organization field should also be reviewed; for example, a user located in a data center is unlikely to be human and therefore is highly suspicious.
  • Navigation: Navigating ten pages very quickly or in a pattern inconsistent with normal behavior for your store is an indicator of suspicion.
  • User Details: The details of the user can help you identify fraudulent activity. For example, an email address that is a random selection of letters and numbers can indicate a throwaway account. Order history can also help you determine a user's validity if they deviate from your store's norms.
  • Session Details: If these details do not align with the rest of the information gathered about a user, this is also a fraud indicator. For example, the browser Safari is not available for products not made by Apple, so a user with Safari as a browser and Windows as a platform would be deemed suspicious.
  • Identity Check: This is a beta service, currently for Shopify customers only. The Identity Check will verify the user's information and compare it to records indicating who owns a physical address, email address, and phone number. When compared to the details of your order, this information can be very helpful in determining suspicion.

Fraud Review Results

Once you have reviewed these factors, you can decide what action to take based on your review:

  • Approve: This will accept the order and have it continue down your fulfillment path.
  • SMS Verify: This will ask the customer to verify their order. If they respond positively, the order will be approved.
  • Cancel: This will cancel the order and communicate the cancellation to your website to act accordingly.

Many merchants will either email or call a customer if they want to verify an order where fraud review leaves them with some degree of suspicion. Using automation and the data available in NS8 Protect, this should only be required a small amount of the time.

What's Next

After reviewing an order, it is a good idea to analyze the ability to automate review based on patterns in your store. For example, if you find that orders with billing and shipping mismatches with different states are reason to investigate an order, you can build a rule to SMS Verify the orders automatically. Building Order Rules to automate the review process can help you act both safely and efficiently.

Reviewing a Suspect Order


How to perform a manual review of a suspect order.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.