A plain explanation of what a manual hold is, what triggers one, how long it should take, and what it costs when holds pile up.
Somewhere in most ecommerce operations there is a queue nobody puts on a dashboard. Orders sit in it. Payment is authorized, the shopper has a confirmation email, and the warehouse has been told to wait. These are manual holds, and they are one of the least examined sources of friction between a shopper deciding to buy and the box arriving at their door.
A manual hold is a pause placed on an order after payment authorization but before fulfillment, so a person can look at it before it ships. The order is not approved and it is not declined. It is waiting on human judgment. Most holds are placed because a fraud system, a platform rule, or a team member saw something that did not quite add up and decided the safer move was to stop the order rather than let it go.
Holds are not a flaw. A hold is what a well-designed system does when it has enough signal to be uneasy but not enough to read intent clearly, and the alternative is guessing. The problem is volume and duration. According to the Merchant Risk Council’s 2025 Global Payments and Fraud Report, merchants still screen roughly 23% of orders manually, and they end up declining about 20% of what they screen by hand. That is a lot of orders waiting on a human, and a meaningful share of them belong to real customers.
What is a manual hold?
A manual hold is an order state, not a payment state. The order exists in your platform, the funds are authorized on the card, and fulfillment is deliberately blocked until someone releases it or rejects it.
Three things get conflated constantly, and separating them makes the rest of this much clearer:
- A manual hold pauses an order for human review. Nothing has been decided. The shopper usually sees a “processing” status and has no idea a review is happening.
- An automatic decline rejects the order without a human ever touching it. The shopper sees a generic error at checkout and, in most cases, leaves. This is where false declines come from.
- An authorization hold is a payments concept, not a fraud one. It is the pending amount reserved on the shopper’s card when they check out. It exists on nearly every order, held or not, and it expires on the issuer’s schedule regardless of what your fraud team decides.
The distinction matters operationally because each one fails differently. A decline costs you the order immediately and visibly. A manual hold costs you time, and time is where good orders quietly turn into cancellations.
Why Orders Get Held for Review
Holds cluster around a handful of patterns. None of these are proof of fraud on their own, which is exactly why they produce a hold instead of a decline. Each one is a signal about circumstance rather than intent, and circumstance is a poor proxy.
Data that does not line up. Billing and shipping addresses in different states or countries. An AVS mismatch. A name on the card that does not match the name on the account. Most of these have completely ordinary explanations, including gifts, office deliveries, recent moves, and married names.
Thin history. A first order from a brand new account, no device history, an email address created last week. There is nothing wrong with a new customer, but there is also nothing to compare them against.
Value and velocity. An order several times larger than your average. Four orders in six minutes. Three different cards on one account in a day. Real behavior looks like this during a launch or a holiday; so does card testing.
Fulfillment signals. Overnight shipping on a high value first order. A shipping address that resolves to a freight forwarder or a known reshipper. These are genuinely predictive, and also describe a lot of legitimate international shoppers.
Rules the merchant wrote. A great many holds trace back to a threshold someone set during a bad fraud week two or three years ago and never revisited. Order value caps, country blocks, and velocity limits accumulate, and nobody owns pruning them.
An inconclusive verification result. When automated verification cannot confirm the shopper is the cardholder, and cannot confirm they are not, the order goes to a person. This is the honest version of a hold and the one most worth optimizing rather than eliminating.
Notice what every trigger above has in common. Each describes what an order looks like, not what the shopper meant to do. A gift and a reshipping scheme can produce identical order data. Distinguishing them requires evidence of intent, and a hold is the admission that the system does not have it yet.
What Happens While an Order Sits on Hold
There are two experiences running in parallel, and most teams only monitor one of them.
On the merchant side, the order drops out of the normal fulfillment flow. Depending on your platform it might sit in a review queue, get tagged, or transition to an “On Hold” status. In Shopify, an order under review is held with a payment status of Authorized and only moves to Paid once it is cleared for shipping. In WooCommerce, orders under review transition to On Hold. Either way, someone has to pick the order up, look at it, and decide. That is labor, and it competes with everything else the ops or CX team is doing that day.
On the shopper side, there is silence. They see “processing.” They do not know a review exists, why it was triggered, or when it ends. So they refresh the tracking page, and then they email support, and now the hold has generated a ticket on top of the review. If the hold outlives their patience, they cancel and buy the same thing somewhere that shipped it yesterday.
That impatience is not hypothetical. Baymard Institute’s research, drawn from 50 studies on cart abandonment, found that 20% of shoppers abandon a checkout because delivery was too slow. Delivery speed was already close to a deciding factor before a hold added days to it.
How long should a manual hold last?
Industry practice varies enormously, from minutes at commerce brands with dedicated analyst teams to the better part of a week where review is somebody’s fourth priority. The useful benchmark is not the average. It is whether your hold resolves inside the fulfillment promise you made at checkout.
For context on what a documented service level looks like: Wyllo’s Help Center states that its fraud analyst team typically updates orders in Review within 24 business hours, most often within a four business hour window. Reviews that depend on a shopper replying can take up to 48 business hours, which is why the recommended setting allows 48 hours before an order times out.
Two configuration details are worth knowing if you run holds through any automated system. First, the maximum verification window is usually something you set, not something imposed on you. Second, when that window expires, the order does not stay in limbo. It resolves, and it usually resolves as a rejection.
The Three Ways a Hold Ends
Every hold has exactly three exits, and the third is the one that deserves scrutiny.
- Released and fulfilled. The reviewer validated the order, either from the data already available or by confirming with the cardholder directly. The order ships. In practice, when a shopper responds to a verification request, the order is usually approved.
- Rejected on evidence. The review found what it was looking for. This is the hold doing its job, and it is the outcome the whole mechanism exists to produce.
- Timed out. The verification window closed without a conclusion, and the order auto-failed. This is the exit to watch, because a good customer who never saw the verification email and an actual fraudster who ignored it on purpose produce the identical outcome. Every timed-out hold is either a fraud loss you avoided or a customer you lost, and by definition you do not know which.
If you only track one new number after reading this, track the share of your holds that end in exit three. It is the clearest measure of whether your verification is reaching real people.
What Manual Holds Actually Cost
The cost of a hold is spread across three budgets, which is part of why it rarely gets owned by anyone.
Labor. Every held order is a human touch. LexisNexis Risk Solutions’ 2025 True Cost of Fraud study found that 41% of North American merchants still depend on manual processes to prevent fraud, and that US merchants now face $4.61 in total cost for every $1 of fraud. Only a fraction of that multiplier is the fraud itself; the rest is operations, fees, and replacement.
Conversion and retention. The same study found 64% of respondents said fraud hurts customer conversion rates and 63% said it increases churn. Holds are a direct mechanism for both. A shopper who waited four days for an order that then got cancelled does not distinguish between “we were protecting you” and “you were treated as a suspect.”
Opportunity. Roughly 20% of manually screened orders get declined, per the MRC data above. Given how many holds are triggered by gift purchases, moves, and new customers, some meaningful portion of that 20% is revenue that was never at risk. The reviewer ran out of time or signal, and defaulted to no.
None of this argues for holding fewer orders by loosening standards. It argues for holding fewer orders because fewer of them are ambiguous in the first place.
How to Reduce Manual Holds Without Raising Risk
Six changes do most of the work, roughly in order of effort.
Make hold rate a first class metric. Most teams track approval rate and chargeback rate. Add hold rate, average hold duration, and timeout share to the same report. A number nobody reports is a number nobody improves.
Audit the rules that generate holds. Pull your last quarter of held orders and group them by trigger. You will typically find two or three rules producing a disproportionate share of holds and a poor hit rate. Those are the ones to retune first.
Verify instead of guess. The fastest hold to clear is one resolved by reaching the actual cardholder rather than by staring harder at the same order data. Confirming identity directly turns a judgment call into a fact.
Make verification outreach recognizable. A verification email that arrives from an unfamiliar domain looks exactly like phishing, and shoppers are right to ignore it. Sending from your own domain, with your logo, your name, and your language, is the difference between a reply and a timeout. Wyllo’s Help Center documents customizing verification emails to send from your own domain with your branding, including DKIM authentication and multi-language templates.
Set the timeout window generously. A short window converts unreached customers into failures. If the cost of a false rejection exceeds the cost of a day of held inventory, and for most brands it does, give the verification time to land.
Give CX visibility into the hold. When a shopper emails asking where their order is, the agent should be able to see that a review is open and what it is waiting on. Otherwise the agent guesses, and the guess becomes the brand’s answer.
How Wyllo Helps
Wyllo, the risk intelligence platform for commerce, is built around the premise that most held orders are not actually ambiguous. They only look ambiguous to a system reasoning from a narrow slice of a single transaction. That is what Intent-Aware Decisioning is for: connecting signals across the customer journey, including account behavior, device history, returns, claims, support contacts, and clustered patterns across seemingly unrelated shoppers, so intent becomes legible before an order needs a human. When the system can tell a gift from a reshipper on evidence, far fewer orders reach the queue at all.
- Wyllo Payment Fraud Protection decides the overwhelming majority of orders instantly. Per Wyllo’s Help Center, typically fewer than 0.5% of orders receive a Review decision at all, and those go to a team of fraud analysts rather than back to your ops queue. Verification outreach to the shopper is largely automated and sent only to contact details confirmed to belong to the cardholder.
- Wyllo CX Support puts risk signals and next best actions inside the tools your agents already work in, so a “where is my order” ticket about a held order gets an informed answer instead of an apology.
- Wyllo Chargeback Management handles the disputes that arrive anyway. One honest caveat worth knowing: manually passing an order that is in Review removes Chargeback Protection from that order, so letting the review finish is usually the better economics.
Precision over paranoia. The goal is not a faster review queue. It is a shorter one.
Frequently Asked Questions
What is a manual hold on an order?
A manual hold is a pause placed on an order after payment authorization but before fulfillment, so a person can review it before it ships. The order has not been approved or declined. It is waiting on human judgment, usually because automated screening found signals that were concerning but not conclusive.
How long does a manual hold take?
It depends entirely on who is reviewing and whether they need to contact the shopper. Reviews resolved from existing order data can close in minutes. Reviews that require confirming identity with the cardholder depend on the shopper replying. As a documented example, Wyllo’s Help Center states that orders in Review are typically updated within 24 business hours and most often inside a four business hour window, with up to 48 business hours when a shopper response is needed.
Is a manual hold the same as an authorization hold?
No, and confusing the two causes real support headaches. An authorization hold is the pending amount reserved on the shopper’s card at checkout, and it happens on essentially every order. A manual hold is a fulfillment decision on the merchant’s side. A shopper can have an authorization hold with no review happening, and an order can be under review while the authorization behaves completely normally.
Why did my order get held for review?
Most often because something in the order was unusual rather than wrong. Shipping to an address that differs from billing, ordering from a new account, placing an unusually large first order, choosing expedited shipping, or shipping internationally can all trigger a review. A hold is not an accusation. It usually means the merchant would rather confirm than guess, and responding to any verification request is the fastest way to release it.
Can a merchant release a manual hold early?
Usually yes. Most platforms and fraud tools let an administrator approve an order still in review. It is worth checking what that override costs, though. With Wyllo, for instance, manually passing an order in Review removes Chargeback Protection from that order, so the faster path also moves the risk onto the merchant.
Do manual holds hurt conversion?
They hurt fulfillment and retention more than checkout conversion, because the shopper has already paid by the time the hold exists. The damage shows up as cancellations, support tickets, and customers who do not come back. Baymard Institute found 20% of shoppers abandon checkout when delivery is too slow, which is a reasonable proxy for how much delivery timing matters to the same audience after they buy.
What is a healthy hold rate?
There is no single published benchmark, and hold rates vary too much by category, price point, and international mix for a cross-industry number to mean much. The more useful framing is directional: your hold rate should be low enough that reviews get real attention, your average hold duration should fit inside the delivery promise you made, and your timeout share should be small. If holds are resolving by expiry rather than by decision, the number is too high regardless of what it is.
Bringing It Together
Manual holds are the most reasonable bad outcome in fraud operations. They exist because the alternative, declining anything unfamiliar, is worse, and every team that has tried to eliminate holds by simply approving more has learned that lesson expensively.
The improvement available is not a better queue. It is fewer orders arriving in it. That comes from reading intent across the whole customer journey instead of scoring one transaction in isolation, from verifying identity directly rather than inferring it, and from treating the time an order spends in review as a customer experience metric rather than a fraud metric. The commerce brands with the smallest hold queues are rarely the ones taking the most risk. They are the ones who resolved the ambiguity earlier, where it was still cheap.
Curious how much of your current hold volume is genuinely ambiguous? Start with Wyllo Payment Fraud Protection for the AI plus human analyst model, or explore the broader Wyllo platform for connected intelligence across the full customer journey.
