Order fraud review and customer verification

How do we review an order flagged for fraud by having the customer verify identity on a secure screen, then release or cancel the order with the decision recorded?

Turn a fraud flag into a verification the customer can pass in minutes. When the fraud rules flag an order (a velocity signal, a mismatch between billing and shipping, a new account with a high value, a risky device or address, a failed address verification), Callvu holds the order with the stock, classifies the flag and the verification it warrants, sends the customer a secure link to verify (a one-time code to the card's bank-registered phone or email, a micro-charge confirmation, a document check for the highest risk), chases the verification inside the hold, reads the result with the fraud score and the evidence, releases a passed order by rule, routes a failed, ambiguous or high-value case to the fraud desk in the Decision Desk with only the allowed outcomes, cancels and refunds a declined order with the customer told, and writes the decision to the order management system.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The fraud queue held the order for three days, the reviewer emailed a form asking for a photo of the card, and the real customer cancelled.

Today, without Callvu

Fraud screening flags orders, and the flagged orders go to a queue where a reviewer looks at the signals and decides, often by emailing the customer for proof. The requests are slow, inconsistent and sometimes dangerous (asking for a photo of the card). True customers leave; fraudsters answer the email convincingly. The queue grows and the conversion falls.

A flag has a risk level, and each level has a verification that a real customer can pass and a fraudster usually cannot: a code sent to the contact the bank holds, a tiny charge the cardholder confirms from their statement, a document check for the riskiest cases. The verification should be a secure screen, not an email, and the card data should never be asked for because the PCI standard and good sense forbid it. The decision should be the fraud desk's only when the verification does not settle it.

A verification the customer completes in two minutes is a sale saved and a queue emptied.

How it runs

From the requestto the system of record.

The fraud rules flag an order at checkout or before fulfilment. Callvu holds the order and opens the review.

Customer: Completes the verification on a secure screen from their phone.
Fraud desk: Decides failed, ambiguous and high-value cases in the Decision Desk.
Payment provider and data vendors: Supply the authentication, the risk score and the verification channels.
Callvu: Holds, classifies, sends the verification, chases, reads the result, releases or routes, cancels and writes.

Hold and classify
The order is held with the stock and the customer told the order is under review; the flag's signals (velocity, billing and shipping mismatch, new account and high value, a risky device or address, a failed address verification, a match to a prior fraud case) and the order's value classify the risk level and the verification it warrants: a one-time code to the bank-registered contact, a micro-charge confirmation from the statement, or a document and selfie check for the highest risk.
Chase and verify
The customer receives a secure link in their channel to complete the verification (never a request for the card number or a photo of the card); the verification is chased inside the hold; the result is read with the fraud score, the authentication and the evidence (the device matches the account, the contact is the bank's, the document matches the name and the address).
Decide
A passed verification inside the rules releases the order by rule; a failed verification, an ambiguous result (a partial match, a document that cannot be read), a value above the desk's threshold, or a signal the rules reserve (a match to a prior case, a reshipper address) goes to the fraud desk in the Decision Desk with the evidence and only the allowed outcomes (release, require a stronger verification, cancel and refund, or cancel and block the account).
Write back
A released order goes to fulfilment and a cancelled order is refunded with the stock released and the customer told, and the review with the signals, the verification, the decision and the person is written to the order management system, the system of record, against the order and the account, feeding the rules with the outcome.

Where it ends: The flagged order was verified by the customer on a secure screen matched to the risk, released by rule or decided by the fraud desk, and the decision is on the order with the signals and the outcome the rules learn from. The Decision Trace shows the classification, the verification result and any decision; the Audit Trace shows the hold, the verification and the release or cancellation with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

PCI DSS: A verification must never ask the customer for the card number, the security code or a photo of the card; the retailer's systems and agents stay out of the cardholder data environment, and the verification runs on a secure page with the payment provider's tokens and the bank-held contact channels, which the standard's scope rules and the networks' security requirements expect.
Card network rules on authentication and liability (the EMV 3-D Secure programs; the Visa and Mastercard fraud monitoring programs): An order authenticated through the issuer's program shifts fraud liability to the issuer; the networks' fraud monitoring programs penalize merchants whose fraud ratios exceed thresholds, which the review keeps down by stopping fraudulent orders before fulfilment.
Identity verification and privacy rules (the FTC Act on reasonable security; the state privacy laws and GDPR on processing identity documents; the retailer's fraud policy): A document and selfie check processes sensitive personal data under a lawful basis with retention limits, so it is reserved for the highest risk and the images are deleted on the policy's schedule; the fraud policy sets the risk levels, the thresholds and the desk's authority.

Company policies

The verification matches the risk level; a card number or a card photo is never requested.
A passed verification releases the order by rule; the desk decides only failures, ambiguities and reserved signals.
Identity documents are used only at the highest risk level and deleted on schedule.
The order management system holds the review, and the outcome feeds the fraud rules.

Controls

Order hold with customer notice.
Risk classification and verification selection.
Secure verification link in channel with chases.
Result reading with score and evidence.
Decision Desk for failures and reserved signals.
Release or cancellation with order management write.

Clocks and deadlines

Review hold: The policy's period from the flag, with the verification chased inside it and the order cancelled at its end if unverified.
Verification validity: The code or the micro-charge confirmation valid for the policy's window.
Document retention: Identity images deleted on the policy's schedule after the decision.

Documents and checks

The flag and its signals
The verification sent and its result
The decision with the person
The release or the cancellation and refund
The order management record

In the Decision Trace

The risk classification and the verification chosen.
The result and any desk decision.

In the Audit Trace

The hold and the notice with time.
The verification with time (no card data).
The release or cancellation.

The handoff

Between the front doorand the back office.

The front door

The secure verification link in the customer's channel; no email forms, no card photos.

The back office

The fraud desk decides only what the verification did not settle; fulfilment receives released orders.

The Decision Desk

A failed or ambiguous verification, a value above the threshold or a reserved signal goes to the fraud desk in the Decision Desk with the evidence and only release, require a stronger verification, cancel and refund, or cancel and block.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

What does the customer have to do?

Complete a verification on a secure screen matched to the risk: a code sent to the contact the bank holds, a micro-charge confirmed from their statement, or a document check for the highest risk; never a card number or a card photo.

How long is the order held?

For the policy's review period, with the verification chased inside it; an unverified order is cancelled at the end with the stock released and the customer told.

When does a person decide?

Only when the verification fails or is ambiguous, the value is above the threshold, or a reserved signal applies; the fraud desk then chooses release, stronger verification, cancel and refund, or cancel and block.

Related processes

Chargeback and fraud dispute Payment recovery on failed payments Account recovery and takeover Age verification for restricted products Compared with the alternatives Try it in the sandbox All travel and ecommerce processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.