import { Image } from ‘astro:assets’;
Last Updated: April 2026
Open your Shopify chargeback dashboard and look at the disputes from the last six months. If you sell internationally, a pattern almost always emerges: a small set of countries account for a disproportionate share of the losses. The 5% of orders that come from one or two specific regions can quietly generate 30–50% of your chargebacks — and the friendly fraud, card testing, and disputed deliveries that come with them.
This isn’t bad luck. It’s geography. Chargeback rates vary so dramatically by country that the global average looks meaningless once you drill into the data. Brazil sits at roughly 3.55%. Mexico at 2.82%. Russia at 0.82%. France at 0.65%. Germany at 0.54%. Most of the rest of the world sits comfortably under 1% — many under 0.3%.
For a Shopify merchant, that gap is the difference between a healthy store and one constantly burning cash on disputes, lost merchandise, and rising payment processor scrutiny. It’s also a strategic opportunity: when you know where the risk concentrates, you can block, restrict, or scrutinize traffic from those regions without touching the markets that drive your real revenue.
This guide breaks down the global chargeback map — which countries drive the most disputes, why, and what each pattern means for your store — and shows how to turn that data into a surgical geographic blocking strategy with Kedra Shield.
Why Geography Predicts Fraud Risk
The first instinct, when looking at chargeback data by country, is to feel uncomfortable. No one wants to talk about regional risk profiles. But the data isn’t a moral judgment — it’s a reflection of underlying conditions: payment infrastructure maturity, regulatory environments, fraud ecosystem sophistication, and consumer behavior patterns. Some countries simply have more vulnerabilities that fraudsters systematically exploit.
For a merchant trying to protect margins, ignoring this data costs real money. Treating it like actionable intelligence saves it.
What Drives Country-Level Chargeback Rates
A handful of factors explain most of the variance:
- Card-not-present fraud sophistication. Countries with active dark-web marketplaces for stolen cards see disproportionate “card testing” — fraudsters running small purchases against fresh stolen card numbers to verify they work before larger fraud.
- Friendly fraud culture. In some markets, “I didn’t authorize this” disputes are a casual workaround for buyer’s remorse, treated almost like a return policy. Issuers reflexively side with the cardholder.
- Payment infrastructure age. Markets that adopted EMV chip cards late, or where 3D Secure 2 is inconsistently enforced, see more successful unauthorized-use fraud.
- Cross-border arbitrage. Fraudsters frequently use cards issued in one country to attack merchants in another, knowing dispute resolution is slower across borders.
- Logistics and delivery fraud. “Item not received” claims spike in markets with unreliable last-mile delivery — sometimes legitimate, sometimes opportunistic.
- VPN and proxy abuse. Some hotspots aren’t really hotspots — they’re mid-tier countries where attackers route traffic through to mask their origin. (More on this later.)
Each of these factors contributes to country-level patterns. Combined, they produce the wildly uneven chargeback map merchants face today.
The Global Chargeback Map: A Country-by-Country Breakdown
Let’s get specific. The numbers below come from cross-merchant studies, payment processor data, and the major chargeback research reports for 2025–2026. Treat them as directional rather than precise — your store’s data may differ — but the rank order is consistent across virtually every dataset.
Tier 1: Extreme-Risk Countries (Chargeback Rates Above 2%)
Brazil — ~3.55% chargeback rate
Brazil consistently tops every chargeback ranking by a wide margin — more than 4x the global average. Several factors drive this:
- A massive domestic ecommerce market combined with active card fraud rings.
- A consumer dispute culture that leans aggressively pro-cardholder.
- High mobile commerce penetration with looser authentication norms.
- Sophisticated friendly fraud, where “didn’t recognize the charge” is a common claim against legitimate purchases.
For non-Brazilian merchants without a localized fulfillment, payment, and customer service operation, Brazil is the single most expensive country to accept orders from. Most cross-border merchants either block it, require pre-authorization phone confirmation, or restrict it to manual review.
Mexico — ~2.82% chargeback rate
Mexico ranks second globally and shares many drivers with Brazil: a large ecommerce market, fast mobile growth, and a higher-than-average rate of disputed transactions. Card-not-present fraud is particularly prevalent, with stolen US-issued cards frequently tested against Mexican merchants — and vice versa for cross-border attacks.
For most Shopify merchants outside Latin America, Mexican orders deserve heightened review: verified phone numbers, address validation, and limits on first-time-customer COD or high-value orders are standard mitigations.
Tier 2: Elevated-Risk Countries (Chargeback Rates 0.5%–1%)
Russia — ~0.82% chargeback rate
Russia has long been associated with sophisticated card fraud operations, even before geopolitical disruptions further complicated cross-border payments. Many Western merchants now block Russian traffic by default, both for fraud reasons and to comply with sanctions and payment processor restrictions.
France — ~0.65% chargeback rate
France is a more nuanced case. Its elevated chargeback rate is driven less by malicious fraud and more by aggressive consumer protection rules and a strong friendly-fraud culture. French shoppers dispute charges at higher rates than peers in similar economies, often using disputes as a return mechanism.
The implication for merchants: France isn’t a country to block — it’s a country to prepare for. Strong order documentation, delivery confirmation, clear return policies, and 3D Secure enforcement reduce friendly-fraud success rates significantly.
Germany — ~0.54% chargeback rate
Germany has unique payment dynamics. SEPA Direct Debit and bank transfer are common, and chargebacks (or their equivalent) operate differently than in card-dominant markets. German consumers are also notably willing to dispute. As with France, the strategy is documentation and authentication, not blocking.
Tier 3: Standard-Risk Markets (Chargeback Rates Under 0.5%)
The US, UK, Canada, Australia, the Nordics, the Netherlands, Japan, and most of East Asia all sit comfortably under 0.5%. These are your safe markets — meaning fraud absolutely still occurs there, but the rate is manageable with normal fraud-prevention hygiene.
The notable wrinkle: the US has the highest average chargeback value globally — roughly $110 per dispute — followed by Brazil ($94), Australia ($91), and the UK ($82). So while US chargeback frequency is moderate, each dispute costs more, and US-issued chargebacks make up nearly half of global ecommerce chargeback volume by absolute count due to the sheer size of the market.
Tier 4: Low-Risk Markets
Japan and China consistently sit at the bottom of chargeback rankings — well under 0.2% in most studies. Japan’s strict consumer payment culture and China’s heavily mobile-wallet-based ecosystem (Alipay, WeChat Pay) reduce traditional card-based dispute volume dramatically.
What the 2026 Data Tells Us About Where Fraud Is Headed
The directional trends matter as much as the snapshot:
- Global card-not-present fraud is projected to hit $28.1 billion in 2026 — a 40% increase from 2023. This isn’t slowing.
- US chargeback losses are estimated to reach $12.87 billion in 2026. Even “safer” markets are getting more expensive in absolute terms because volume is growing.
- Annual global chargebacks could hit 337 million in 2026. Per-merchant exposure is going up, even if your conversion rate is flat.
- Latin America loses up to 20% of ecommerce revenue to fraud. That’s an order of magnitude higher than mature markets.
The takeaway for Shopify merchants: doing nothing is becoming more expensive every year. Geographic intelligence is one of the few high-leverage tools available.
Beyond the Map: Why Country Codes Lie
Before getting tactical, an important nuance: the country an order appears to come from isn’t always where it actually originates. Sophisticated fraud operations route traffic through residential proxies, VPNs, and TOR exits in mid-tier countries to mask the true origin.
A “German” order placed via VPN can really be a Russian or Brazilian fraudster. A “US” order from a residential proxy in Texas can be coming from anywhere on Earth.
This means a country-blocking strategy isn’t enough on its own. The complete picture requires:
- Geographic blocking of confirmed high-risk countries.
- VPN, proxy, and TOR detection to expose origin laundering.
- Datacenter IP blocking to stop bot-driven card testing at scale.
- Behavioral signals (typing patterns, time-of-day, session behavior) that don’t depend on IP at all.
Tools like Kedra Shield combine all four into one layered defense — so the country-level filter is the first cut, and the deeper signals catch what slips through.
Building a Smart Geographic Blocking Strategy
The goal isn’t to slam the door on entire continents. It’s to apply graduated friction based on risk — blocking outright where the fraud-to-revenue ratio is brutal, applying friction where it’s elevated, and leaving low-risk markets entirely undisturbed.
Step 1: Audit Your Own Chargeback Geography
Before applying any blocking, look at your data:
- Pull every chargeback from the last 12 months.
- Tag each by billing country, shipping country, and IP country.
- Calculate the chargeback-to-orders ratio for each country.
- Identify the top 3–5 countries where your ratio is more than 3x your global average.
If your global chargeback rate is 0.4% and Brazil sits at 4%, that’s a 10x risk multiplier. That’s actionable. Don’t trust generic global averages over your store’s actual data — your industry, AOV, and customer base shift the numbers.
Step 2: Define Three Tiers of Action
Not every risky country deserves an outright block. Use a graduated model:
Tier A — Block outright. Countries where your fraud-to-revenue ratio is so high that blocking is a net financial win, or where you don’t ship/sell at all. For most stores: Brazil, Russia, Mexico, and any country with sanctions or payment processor restrictions.
Tier B — Restrict to manual review. Allow checkout, but flag every order for review. No automatic fulfillment. Ideal for elevated-risk countries where you don’t want to lose all revenue but every order needs eyes on it before it ships.
Tier C — Allow with friction. Force 3D Secure on every order. Require phone verification. Disable COD. Limit order values for first-time customers. These customers can buy, but the risky ones either authenticate or self-select out.
Tier D — Allow normally. Your safe markets. No friction beyond your standard fraud hygiene.
Step 3: Implement at the Right Layer
There’s a common merchant mistake: applying blocking only at the checkout level, after a fraudster has already loaded your store, scraped product data, attempted card testing, and consumed bandwidth. By the time a checkout-level block fires, half the damage is done.
Effective geographic blocking happens at the storefront entry point — before the visitor sees a product page, much less reaches checkout. This is what Kedra Shield is built for. A blocked country never loads your product catalog, never generates analytics noise, never tests cards, and never burns server resources. They see a polite restriction message, and that’s it.
Step 4: Layer in IP and Network Intelligence
Country code isn’t enough. Your blocking strategy should also cover:
- Datacenter IPs — almost no legitimate human shopper browses from AWS or DigitalOcean. Block by default.
- TOR exit nodes — almost every TOR connection to a Shopify store is reconnaissance, scraping, or fraud. Block by default unless you sell privacy-related products.
- Known proxy and VPN networks — apply friction (3D Secure, manual review) rather than outright blocks; some legitimate customers use VPNs.
- High-abuse ASN ranges — entire IP blocks operated by sketchy hosts can be filtered as a bundle.
Kedra Shield ships with maintained lists of these networks, updated continuously, so you don’t have to research and copy/paste IP ranges manually.
Step 5: Whitelist Your Trusted Markets
If you only sell to a defined set of countries — say, the US, Canada, UK, EU, and Australia — invert the model. Whitelist those countries and block everything else by default.
This is the most aggressive but most effective strategy for merchants with a clear target market. It collapses your fraud surface by 80%+ overnight, because most attack traffic simply originates outside your target markets.
Step 6: Monitor and Tune Continuously
A geographic blocking strategy is not “set and forget.” Fraudsters adapt. Routes shift. Your business expands into new markets.
- Review your blocked-traffic dashboard monthly.
- Track false positives — legitimate customers who got caught by your filters and emailed support.
- Adjust tier assignments as data accumulates.
- Reassess Tier A countries annually — what was a hotspot three years ago may have improved (and vice versa).
The Risks of Over-Blocking (And How to Avoid Them)
A worry every merchant has the first time they implement country blocking: “What if I block legitimate customers?”
It’s a fair concern, and the honest answer is: yes, you will lose some legitimate revenue from any blocked country. The question is whether you lose more revenue from fraud and chargebacks if you don’t.
For most Tier A countries, the math is unambiguous. A merchant taking $1,000/month from Brazil while losing $1,500/month to Brazilian chargebacks is bleeding money — and that’s before counting chargeback fees, processor scrutiny, manual review labor, and brand reputation cost.
That said, three principles minimize over-blocking damage:
- Show a clear restriction message. Don’t display a generic error. Tell the visitor “We don’t currently ship to your region — please contact us if you’d like to be notified when we expand.” Some of those contacts become future revenue.
- Provide a contact path. Legitimate customers in restricted regions sometimes have valid reasons to need access (expat shoppers, gifts to family abroad). A simple support form converts a fraction of would-be lost sales.
- Use friction over blocks where reasonable. A Tier B “manual review” rule loses zero legitimate orders — it just slows them down. For mid-risk markets, that’s almost always the right move.
Industry-Specific Geographic Strategy Notes
Different store types face different geographic risk profiles. A few patterns to factor in:
High-AOV Stores (Electronics, Jewelry, Luxury)
You are the prime target for card testing and high-value fraud. A single successful $2,000 fraudulent order plus chargeback can wipe out a month of margins. Be aggressive with Tier A blocks and require 3D Secure globally. Whitelist where possible.
Subscription Boxes and Recurring Billing
Card testing fraud against subscription products is particularly damaging because the chargeback often hits after multiple months of free product have shipped. Geographic filtering at signup, plus phone verification for high-risk regions, is essential.
Digital Goods and Software
Geographic risk is even more concentrated because there’s no physical fulfillment delay to catch fraud. Blocked countries should be treated more strictly here, and 3D Secure should be enforced globally regardless of country.
Beauty, Fashion, and Lower-AOV Consumer Goods
Volume fraud is the bigger threat than individual high-value disputes. Geographic blocking helps reduce baseline noise, but behavioral and bot-detection layers matter as much as country lists.
B2B and Wholesale
Fraudulent B2B orders are rarer but more damaging when they happen. A whitelist approach (only allow countries where you have verified business relationships) is often appropriate.
How Kedra Shield Implements Geographic Fraud Defense
A practical look at what an integrated geographic security app does for a Shopify merchant:
Country and City-Level Blocking
Kedra Shield supports both broad country-level blocking and granular city-level rules — useful when fraud concentrates in specific metros within an otherwise safe country. You can also whitelist by country if you sell only to defined markets.
VPN, Proxy, and TOR Detection
The same shopper who bypasses a country block via VPN gets caught by network-type detection. Kedra Shield maintains continuously updated lists of VPN providers, anonymizing proxies, and TOR exit nodes — so origin laundering doesn’t work.
Datacenter and Bot Network Blocking
Card testing bots typically run on cloud infrastructure (AWS, GCP, Azure, Hetzner, OVH, DigitalOcean). Kedra Shield blocks traffic from these ASN ranges by default — your storefront and checkout aren’t even visible to most bot operations.
Fast, Lightweight Enforcement
Geographic and network-level blocking happens at the storefront entry point, with minimal performance impact. Your Core Web Vitals stay healthy, your conversion-critical first impressions stay fast, and the fraud traffic that would have slowed your site simply never reaches it.
Configurable, Not All-or-Nothing
Different rules for different country tiers. Different actions (block, redirect, friction) per rule. Whitelisting and exceptions for known good IPs. Real merchants need control, and the configuration UI is built for non-developers.
Transparent Blocked-Traffic Reporting
The dashboard shows what’s being blocked and why — by country, network type, and time. You can validate the strategy is working, see how the threat landscape shifts, and tune your tier assignments based on real data.
A 30-Minute Geographic Defense Audit You Can Run Today
If you want to act on this guide before closing the tab, here’s a focused checklist:
- Pull your chargebacks for the last 12 months and rank by billing country.
- Identify your top 3–5 high-ratio countries (more than 3x your average rate).
- Decide each country’s tier (A: block, B: review, C: friction, D: allow).
- Install Kedra Shield and configure country rules.
- Enable VPN, proxy, TOR, and datacenter blocking with default settings.
- Set up 3D Secure enforcement for Tier C countries.
- Decide whether your business is whitelist-eligible (only ship to defined markets).
- Schedule a 30-day review — check the blocked-traffic dashboard, false-positive rate, and chargeback delta.
Most merchants who run this audit see noticeable chargeback reduction within the first billing cycle, often paired with a reduction in support tickets and bot traffic that wasn’t even on their radar.
The Bottom Line: Treat Geography as a Lever, Not a Wall
Country-level fraud data isn’t a story about which places are good or bad — it’s a tool for resource allocation. Every legitimate dollar of revenue you accept from a high-risk country comes wrapped in higher-than-average chargeback exposure, payment processor risk, and operational overhead. That trade-off is sometimes worth it. Often it isn’t.
Smart merchants:
- Look at their own chargeback data, not just industry averages.
- Apply graduated rules (block, review, friction, allow) based on country tier.
- Block at the storefront entry point, not just at checkout.
- Layer geographic filtering with VPN, proxy, TOR, and datacenter blocking.
- Whitelist when their target market allows it.
- Treat the strategy as living — review and tune monthly.
Done well, geographic fraud defense pays for itself many times over: lower chargeback rates, healthier processor relationships, faster store performance, cleaner analytics, and more time spent serving real customers instead of disputing fraudulent ones.
Kedra Shield was built specifically for this kind of layered, country-aware Shopify defense. It plugs into your store in minutes, ships with sane default rules for the global threat landscape, and gives you the granularity to tune it to your exact business — without slowing your store down.
The fraud map isn’t going to redraw itself. But you can decide, today, which parts of it actually get to reach your store.
Ready to map your store’s fraud exposure and start blocking the right countries? Install Kedra Shield from the Shopify App Store and turn geographic intelligence into real chargeback prevention.
Kedra Team
Expert insights on Shopify development and e-commerce growth strategies.