Order Risk Score and Blacklist

Every storefront order gets a risk score between 0 and 100; you can blacklist suspicious e-mails, phone numbers and IP addresses so they cannot place…

Where to find: Left menu → Orders → Risk & Blacklist · the Risk column in the order list · the Risk assessment card on the order detail Who it's for: Especially stores that accept cash on delivery and suffer from fake/prank orders In short: Every storefront order gets a risk score between 0 and 100; you can blacklist suspicious e-mails, phone numbers and IP addresses so they cannot place orders.

What is it for?

With cash on delivery enabled, a fake order means shipping cost and a return. Twenty orders in a row from the same IP, a phone number that keeps cancelling, records whose address does not match the city… Spotting these by hand is impossible.

This feature offers two layers:

Risk score — a few rules run while the order is created and write a 0-100 score plus a list of reasons onto the order. It provides visibility only.
Blacklist — the e-mail / phone / IP addresses you choose cannot create orders in your store.

A high-risk order is NEVER cancelled automatically. The settings screen says so: "The risk score is for visibility only: a high-risk order is never cancelled automatically, it is only flagged." The decision is always yours.

Where do you see the risk score?

In the order list

A coloured badge appears in the Risk column: Low risk, Medium risk, High risk. Hovering shows the score ("Risk score: 62/100"). With the filter in the top bar you can list only orders at a given risk level.

Some orders show one of these instead of a badge:

Label	Meaning
Calculating	The score is being computed in the background; refresh the page in a moment.
Not scored	Scoring was off when the order was created, or was switched on later.
Out of scope	The risk score is only calculated for storefront orders; manual and marketplace orders are not scored.

On the order detail

The order detail has a Risk assessment card containing:

The Risk score and its level,
The calculation time,
Which rules were triggered and why (e.g. "7 orders were placed from the same IP address in the last 24 hours."),
The order identities (e-mail / phone / IP) with an Add to blacklist shortcut next to each.

If no rule was triggered: "No risk rule was triggered."

The rules (why does the score go up?)

There are seven rules. You can change the weight of each in the settings:

Rule	When does it trigger?
Many orders from one IP in a short window	When many orders arrive from the same IP address within the last 24 hours.
One IP, several phone numbers	When different phone numbers appear behind a single IP address.
One phone, several e-mails	When a single phone number is paired with different e-mail addresses.
Repeat orders from one e-mail	When the same e-mail address places multiple orders within 24 hours.
Order total deviation	When the order total is far above the store's average basket.
Address / city mismatch	When the written city contradicts the selected city or the billing city.
Past cancellation rate	When most of the same customer's past orders ended in cancellation/failed payment.

On their own these rules are not an accusation. Two colleagues ordering from the same office also trigger the "same IP" rule. That is why the score is a signal, not a verdict.

Risk settings

Orders → Risk & Blacklist → Risk settings tab:

Setting	What does it do?
Risk scoring enabled	When off, new orders are not scored; existing scores stay as they are.
Phone confirmation for high-risk cash on delivery	When on, high-risk cash-on-delivery orders are flagged as "awaiting confirmation".
Medium-risk threshold	Orders at or above this score count as medium risk.
High-risk threshold	Orders at or above this score count as high risk.
Look-back window (days)	Repeat and cancellation rules look back this many days.
Rule weights	How much each rule contributes to the score. A weight of 0 disables the rule in practice.

The high-risk threshold cannot be lower than the medium-risk threshold.

If you over-tuned the settings, Reset to defaults brings the ready-made weights back.

Phone confirmation (cash on delivery)

While the setting is on, high-risk cash-on-delivery orders are flagged as "awaiting confirmation". From the Phone confirmation (cash on delivery) card on the order detail:

Status	What it means
No confirmation needed	The order is not in scope.
Awaiting confirmation	Calling the customer is recommended.
Confirmed	You spoke to them, the order is verified.
Unreachable	The customer could not be reached.

You can write a Confirmation note (e.g. "customer confirmed the order"); who confirmed it and when stays on the card.

This step does not block shipping. If you try to create a shipment for an unconfirmed order you get a warning ("This order has not been confirmed by phone. Create the shipment anyway?") but you can choose Continue anyway. The decision is yours.

Blacklist

Orders → Risk & Blacklist → Blacklist tab.

"Blacklisted e-mails, phone numbers and IP addresses cannot place orders in your store. Customers only see a generic message; the real reason stays here."

Adding an entry

Press Add to blacklist.
Choose the Type: E-mail, Phone or IP address.
Enter the Value (e.g. name@example.com, 0532 111 22 33, 88.240.1.2).
Write a Reason — visible in the panel only, never to the customer.

Formatting does not matter: phone numbers and e-mails match regardless of formatting; 0532… and +90532… count as the same entry.

A faster route: use the Add to blacklist shortcut next to the relevant value in the Order identities section of the order detail.

What you see in the list

Every entry shows the number of Blocked attempts (how many orders it prevented), who Added it and the reason. You can search by value, reason or the person who added it.

The blacklist now uses the same toolbar as the panel's other lists (products, orders):

The Type filter narrows the list to e-mail, phone or IP entries only. On narrow screens the same filter opens from the Filters panel.
More actions → Customize Columns hides the columns you do not need.
When the list grows, pagination and a Rows per page selector appear at the bottom; your choice is remembered in the browser.

Editing and removing an entry

The ⋮ menu at the end of each row holds Edit (only the reason can be changed) and Delete.

When you delete an entry you get a warning: "… will be removed from the blacklist and will be able to order again."

What does the customer see? When a blacklisted person tries to order, they only see a generic error message. They are never told "you are blacklisted" — a deliberate choice for both customer relations and security.

Step by step: fighting fake orders

Open Orders → Risk & Blacklist → Risk settings and make sure Risk scoring enabled is on.
If you accept cash on delivery, turn on Phone confirmation for high-risk cash on delivery.
Set the Risk filter in the order list to High risk and review the resulting orders one by one.
On an order you are convinced is fake, open the detail → Order identities → Add to blacklist for the relevant phone/e-mail, and write the reason.
A few weeks later, look at the Blocked attempts counts to see whether the blacklist is doing its job.

Frequently asked questions

Is a high-risk order cancelled automatically? No. The system only flags it; cancelling is your call.

Why does my manually created order say "Out of scope"? The risk score is only calculated for storefront orders. Manual and marketplace orders are not scored.

The score is stuck on "Calculating". At busy moments scoring moves to the background. Refresh the page a little later.

A rule does not fit our business and keeps firing for nothing. Set that rule's weight to 0 under Risk settings → Rule weights; it stops having any effect.

A customer I blacklisted ordered again. They may have used a different e-mail/phone/IP. Add the new values as well from the Order identities section of the order detail.

Does the blacklist delete past orders? No. It only prevents new orders; past orders stay as they are.

Is blocking an IP address risky? It can be — a school, an office or a mobile operator network may share the same IP. Prefer blocking the e-mail/phone first and use IP as a last resort.

Order Risk Score and Blacklist

On this page