Help Desk Fraud Prevention: Why Your Risk Signal Has to Live in the Ticket

A CX leader’s take on why your risk signal has to live in the help desk ticket, and the seven Gorgias workflows that put it there, by Breanna Moreno, CX Architect at Wyllo

What a help desk to risk intelligence integration is, what it has to do to be worth having, and the seven workflows it makes possible inside Gorgias.

Here’s a ticket I see play out on almost every onboarding call. A refund request lands in the queue. The order was approved at checkout, the tracking says delivered, and the customer says the box was empty. The agent has ninety seconds, a policy document, and a gut feeling. Somewhere else in the stack, a risk score exists that would settle the question in one look. The agent can’t see it.

Every day, help desk agents decide what to do with every return, claim, appeasement, and account change, and they make decisions with almost none of the context their fraud tool has.

Help desk fraud prevention is the practice of putting a customer’s risk and trust context on the ticket, inside the help desk interface, where the decision is actually made, and letting the help desk’s own rules act on it.

The reason it matters more now than it did three years ago is where abuse has moved. As checkout protection has matured, bad actors have moved downstream, to returns, claims, promotions, and the appeasement authority support teams are given to keep customers happy. According to the Happy Returns and Wyllo return fraud report, one in five fraudulent returns now comes from an organized network, and 80.6% of repeat offenders place another fraudulent order within a month. Every one of those orders eventually becomes a conversation with an agent. Retailers know it: in the NRF and Happy Returns 2024 consumer returns study, 93% of retailers said retail fraud and other exploitative behavior is a significant issue for their business.

So let’s walk through it: what a help desk fraud integration actually does, what to look for, and the seven workflows we’re building with merchants in Gorgias.

How Bad Actors Use Your Help Desk

Support teams are built to say yes. That is the right design for the overwhelming majority of customers who contact a brand with a real problem, and it is exactly what a small minority exploit. Three patterns come up again and again.

Three Ways Bad Actors Manipulate Help Desk Agents

Policy arcing. An emotional appeal, a family emergency, a travel deadline, a birthday that cannot wait, used to bypass a hold or a policy and trigger human kindness. The script works because the agent has no way to know this is the fourth “emergency” from the same customer this quarter.

The jig. Slightly altered names, email addresses, and shipping addresses so each account looks unique to automated systems. An apartment number added, a street abbreviated differently, a plus address on the email. Identity checks pass every time, because each identity is technically clean. Only behavior across the accounts shows they belong to one person.

Refunding as a service. Professional operators hired by ordinary customers to extract a refund using scripts, rehearsed escalation, and generated evidence, while the customer keeps the product. These playbooks are sold by Fraud-as-a-Service operators, and they quote the brand’s own policy language right back to the agent.

The common thread is that none of these are visible on the ticket. The order passed. The identity is real. The tone is polite. What gives the pattern away is intent, read across the customer’s full history, and the help desk is the one system that usually cannot see it.

How Does a Fraud and Help Desk Integration Work?

A risk intelligence to help desk integration does three things.

1. Present Risk Signals in the Help Desk

Wyllo’s risk signals appear on the Gorgias ticket, so agents can read them and take more informed actions. That means Gorgias now presents:

• Wyllo risk tags from the Shopify customer and order profile
• Ticket data to add deeper context for the agent

The agent now has a risk signal classification (bad actor, return abuser, trusted customer) and the behavior behind it, not just a number.

2. Let the Help Desk’s Rules Act on the Signal

The help desk’s own rules engine acts on the data signals. In Gorgias, a rule can trigger off a customer tag, total spend, or order count, and can apply a tag, set a priority, route the ticket into a dedicated view, assign an agent or team, send a reply, or limit what the Gorgias AI Agent is allowed to resolve on its own. You write the rules. We supply the context.

3. Automate What the Best Fraud Teams Do Manually

The agent decides with context instead of guesswork. The silent review that good fraud teams do by hand, checking for linked accounts, mismatched details, and prior claims, happens before the agent says hello.

Here’s what that looks like in practice: your agents make the call with confidence, good customers get through faster, and bad actors stop getting paid. That’s not just a fraud win. It’s more revenue and more repeat customers.

One small setting makes a huge difference, and it’s the first thing I bring up on every Gorgias onboarding: a virtual ticket for every order. That means a rule can act on an order the moment it is placed, before the customer ever writes in. A proactive sizing email to a customer who returns everything, sent at order creation, is a help desk workflow, not a marketing one, and it only works because of that virtual ticket.

Why Connect Fraud Signals to Your Help Desk?

This isn’t only about catching more fraud. It’s about making the help desk the place where the right call is quick and easy. When done properly, three outcomes follow:

Stop appeasing bad actors. The appeasement authority an agent has, a credit, a replacement, a waived fee, is the most lightly instrumented money in the company. Putting the customer’s history next to the request is the difference between goodwill and a subsidy.

Stop punishing good customers with strict, blanket policies designed to catch a few bad actors. A customer with a clean three year history should not wait ten days for a refund because someone else sent an empty box. The cost is measurable: every dollar of direct fraud loss now costs more than five dollars all in.¹ The same signal that holds a flagged refund is the signal that fast lanes a trusted one.

Stop making agents toggle between multiple solutions. Every minute spent switching from the help desk to the storefront admin to the fraud tool to Slack is a minute of handle time and a chance to get it wrong. Context on the ticket collapses that loop.

Here’s how I think about it: identity tells you who someone is. Intent tells you what they’re about to do. The help desk is where intent shows up first, and the integration is how the answer gets there in time.

Requirements for a Help Desk Fraud Integration

Not every fraud integration actually helps your team. Here’s what to look for, so your agents get information they can use instead of one more label they’ll learn to ignore. Agents need:

1. A fraud signal that covers the post purchase journey, not just at checkout. Returns, claims, appeasement pressure, and address changes happen days or weeks after the order. A score computed at checkout and never updated tells the agent nothing about what the customer has done since.

2. A fraud signal that updates as behavior changes. A trusted customer can become a serial returner. A new account can be linked to a known abuser after three orders. The classification on the ticket has to reflect the current state of the relationship.

3. Tags the help desk can act on without a custom build. If the integration requires an engineering project to connect, or a developer to maintain, it will not survive the first platform update. The signal should land as tags and ticket data the merchant’s existing rules can read.

“What is your ability to write (fraud-based) recommendations into Shopify or Gorgias? If you just see zeros all over the screen, it won’t mean anything.”

Chief Financial Officer, DTC apparel brand

4. The merchant’s own rules, not a vendor’s black box. The brand knows its policies, its margins, and its customers. The integration should supply context and let the Rules engine the team already uses make the call.

5. It should spot your best customers too, not just the risky ones. An integration that only knows how to say no makes the help desk slower, not smarter. Your agents should be able to see on the ticket who your loyal, trusted customers are, so they can say yes faster and give them the experience they’ve earned.

6. Explainable reasons an agent can read. A ticket that just says ‘Flagged’ doesn’t tell your agent anything. A ticket that says ‘Three accounts using the same device, refunds on more than half their orders, and returns every few weeks’ does. Now the agent knows why, what to do next, and how to explain the decision if the customer pushes back.

7. Visibility into manipulated evidence. Generated images of damage, doctored police reports, and scripted conversations are the current frontier of claim abuse. A complete help desk integration should be able to flag them. Treat this as a criterion to ask about, because few vendors can show it today.

Checkout-only fraud tools aren’t bad tools. They answer one question, and they answer it well. But they weren’t built for anything past checkout, so they miss the first, second, and fifth criteria. And most of the abuse I see on onboarding calls happens after checkout, which leaves the help desk with more questions than answers.

Seven Gorgias Workflows Built on Wyllo Risk Signals

What follows are the seven reference workflows designed for the Gorgias Rules engine, keyed off Wyllo signals. All seven are available to merchants, and three of them (risk based triage, serial returner handling, and the trusted customer fast lane) are the ones most teams start with, so they get the most attention.

Workflow 1: Risk Based Triage and Routing

Trigger: The customer’s risk score or the “Wyllo – Bad Actor” signal crosses the threshold the merchant sets.

What Gorgias does: Tags the ticket Risk Review, moves it to a dedicated view, raises its priority, and suppresses self-service options so the customer cannot resolve their own refund.

Who cares: The Head of CX and the Support Lead, because this is the workflow that stops the queue from being gamed.

What this workflow does automatically:

• The easy buttons go away. Self-service refund and exchange options are switched off for this ticket, so the customer can’t approve their own refund.
• The ticket moves out of the general queue. It’s tagged “Risk Review,” given a higher priority and sent to a dedicated Risk Review view, where trained agents handle it.
• The agent gets instructions before replying. An internal note is added to the ticket explaining what the flag means and the exact steps to follow. The customer never sees it.

What this fraud workflow solves: Right now, a risky refund request sits in the same queue as everyone else’s and is handled by whoever picks it up first. With this workflow, flagged tickets reach the right people before any money moves, and the rest of your queue keeps moving as usual.

How the colors guide the agent:

The playbook line for a red ticket is: “Our security protocols are automated to protect our shoppers; for security reasons, we do not have access to the specific details of the flag.” It’s the most useful sentence in the whole playbook, because it ends the argument before it starts.

Workflow 4: Serial Returner and Return Abuse Handling

Trigger: The “Wyllo – Return Abuser” or “Wyllo – High Return Rate” tag on the customer profile, based on post purchase behavior across orders, accounts, and devices.

First, an important distinction: a serial returner isn’t a fraudster. These are real customers. They buy three sizes and keep one, or they return far more often than everyone else. That costs you margin on shipping and processing, but they aren’t trying to steal from you. So the goal isn’t to shut them out. It’s to change the habit without losing the customer.

What Gorgias does: Applies the policy instead of negotiating it, in stages a merchant can adopt one at a time.

• Crawl: When a tagged customer places an order or asks for a return, an agent reaches out personally with sizing help or a store credit offer before a return label goes out.
• Walk: Sizing help goes out automatically. When a tagged customer places an order, Shopify Flow puts it on a short hold and opens a “Sizing check” ticket in Gorgias. A rule then sends one friendly email offering personal fit help before anything ships, and the email never mentions the tag. When the customer requests a return, they get two options: store credit with no fee and a small bonus, or a cash refund with a restocking fee. Your agents still review each case.
• Run: The whole thing runs on its own, both before shipping and when a return is submitted. If the customer doesn’t choose an option within 48 hours, it defaults to store credit, and the resolution email goes out without an agent touching it. And when a customer’s return habits improve, free returns turn back on automatically, with a thank-you note.

Who cares: The Head of CX and whoever owns margin (ops or finance). This is a profitability problem, not a security problem.

What the fraud workflow solves: Customers can have clean, legitimate accounts and still be costly serial returners. Bracketing (buying several sizes to keep one) means at least half the order is coming back before it even ships. The pattern only shows up across a customer’s whole history, and that’s exactly what the help desk can’t see without the signal.

“The problem right now is that we don’t have an automation where we notify the customer of what’s going on. We have to manually do it.”

Customer Experience Manager, activewear brand, before they optimized the proactive sizing outreach

Workflow 2: Trusted Customer Fast Lane

Trigger: The customer belongs to a merchant configured VIP segment in Wyllo, not just a low risk score.

What Gorgias does: Unlocks one click macros and lets the Gorgias AI Agent auto resolve the ticket. If a risk flag also fires on a VIP, the risk flag wins and the rule sends the ticket to specialist escalation instead, so the fast lane never becomes a side door.

Who cares: The Head of CX, the Founder, and the COO, because this is the workflow that turns the fraud conversation into a revenue conversation.

What the fraud workflow solves: When one strict policy applies to everyone, every refund or exception goes through the same review, and you end up with good customers being treated like suspects. Blanket policy sends every exception through the same approval, and the customer with the highest lifetime value waits behind the one with the fourth empty box claim. The gate matters as much as the lane: any account flagged for fraud or return abuse should also be removed from VIP, win back, surprise and delight, and review request flows, so the brand is not rewarding the customers who cost it the most.

Workflow 3: VIP Handling by True Customer Lifetime Value

The same VIP segment, built on true customer lifetime value (revenue after returns, claims, and chargebacks, not gross spend), routed to senior agents. The point is that “best customer” should mean profitable, not loud, and the segment should be the merchant’s to define.

Workflow 5: Delivered Not Received (DNR) Triage

A low risk signal on a delivered not received (DNR) claim triggers a fast replacement macro. A high risk signal routes to manual review, with a request for a short unedited video or a signed statement of non receipt before anything is issued. Say yes fast to the honest claim and look twice at the other one.

Workflow 6: Chargeback and Dispute Prep

The customer’s dispute history is posted as an internal note on the ticket, with an evidence macro that assembles proof of delivery and transaction verification while the conversation is live. The agent handles the complaint knowing what happened last time, and the dispute file builds itself.

Workflow 7: Account Takeover Hold

A polite address or payment change request is how an account takeover cashes out. When the account carries a risk flag, the rule holds the change for identity verification through the contact details already on file, never through the channel the request came in on.

What Changes for CX, Risk and Leadership Teams

The value shows up differently depending on who is reading.

For CX teams, fewer escalations and a script instead of an argument. The agent opens the conversation knowing which tier they are in, and the tier tells them what to say. Handle time on flagged tickets drops, and so does the number of agents who quietly give up and approve the refund to make the ticket go away.

For fraud and risk teams, the help desk stops being the hole in the fence. The same behavioral signal that protects checkout now protects the refund, the claim, and the account change, without a second tool or a second team.

For the founder, CFO, COO, and exec team, refund loss and appeasement cost come off the P&L without another headcount, and the best customers get an experience the brand can finally afford to give them.

Seeing Wyllo Customer Intelligence on a real ticket is what moves the conversation internally. After we walked through it together, the Head of CX at a bedding brand said:

“This was really good to see, real time examples of how it will make sense.”

Head of CX, bedding brand

This does more than any feature list ever could.

To see whether the integration is working, track these five numbers:

• Appeasements avoided: credits, replacements and waived fees your team didn’t hand to flagged customers.
• Handle time on flagged tickets: how long agents spend on risky tickets, which should drop once they have a script and context.
• Refund rate on tagged customers: how much flagged customers are getting back in refunds, which should go down over time.
• Repeat purchases from VIPs: whether your best customers keep coming back once they’re getting the fast lane.
• Saved revenue vs. prevented loss: compare these once a month. “Saved revenue” means orders that were held for review and then approved after the customer verified. “Prevented loss” means fraud and abuse you stopped.

How Does Wyllo Work with Gorgias?

Wyllo is the risk intelligence platform for commerce, and the Gorgias integration is how that intelligence reaches the ticket. A merchant connects Gorgias from Integrations in the Wyllo Portal in a few minutes, with no engineering project. Wyllo writes the risk score and the signals behind it as tags on the Shopify profile, Gorgias reads them, and the merchant’s own Rules engine runs the workflows above.

• Wyllo CX Support puts risk scores, trust context, and next best actions inside the help desk where agents already work.
• Wyllo Return Fraud and Abuse Prevention supplies the return abuser and high return rate signals behind the serial returner workflow.
• Wyllo Payment Fraud Protection supplies the order level risk score behind triage and routing.
• Wyllo Claim and Policy Abuse Prevention covers the appeasement, claim, and account takeover patterns the help desk sees first.

The triage and fast lane workflows run on either Wyllo Payment Fraud Protection or Wyllo Return Fraud and Abuse Prevention. The serial returner workflow needs the post purchase signal, so it runs on Wyllo Return Fraud and Abuse Prevention. Precision over paranoia: friction only where it is earned.

Playbooks and Templates

The workflows above are documented in the Wyllo Merchant Playbooks (PDF), which are organized by trigger point (order creation, return submission, claim submission, return decision) and by merchant readiness (crawl, walk, run). The sections most relevant to the help desk are the Gorgias sizing help rule setup, the three tier SOP for handling flags, the non accusatory communication matrix (what to say instead of “we know you sent an empty box”), the suppression logic for removing flagged accounts from loyalty and survey loops, and the standing rules on address changes and verbal override requests.

The rollout most teams land on is deliberately staged. Turn the signals on and watch for a few weeks, then enable the first rule, then expand.

“I’ll start to get customer service aware of this information in these tools, and I’ll get my head around what we’re going to do with them, how we’re going to handle it.”

Technology lead, wellness brand, on starting with visibility before automation

Frequently Asked Questions

What is help desk fraud prevention?

Help desk fraud prevention is the practice of putting a customer’s risk and trust context on the support ticket, inside the help desk where the decision is made, and letting the help desk’s own rules act on it. With Wyllo and Gorgias, the agent sees the risk signal and the behavior behind it before replying, and Gorgias rules route, hold or fast lane the ticket.

How does Wyllo connect to Gorgias?

A merchant connects Gorgias from Integrations in the Wyllo Portal in a few minutes, with no engineering project. Wyllo writes the risk score and the signals behind it to the Shopify customer and order profile, Gorgias reads them, and the merchant’s own Gorgias rules run the workflows.

Does my checkout fraud tool already do this?

Usually not. A checkout fraud tool makes one decision at one moment and does not see returns, claims, or support conversations. Unless it writes an updated signal into the help desk and lets the help desk’s rules act on it, the agent is still deciding blind.

What is a virtual ticket in Gorgias?

A virtual ticket is a ticket Gorgias creates for every Shopify order when the setting is on, even when the customer has not contacted support. A rule can act on that ticket, which is what allows proactive outreach such as a sizing email to a customer who returns everything, sent at order creation.

Do I need a returns platform for the serial returner workflow?

No. The workflow runs on the Wyllo tag on the Shopify customer profile and the Gorgias rule that reads it. A returns platform can read the same tag to adjust the refund path, but the help desk workflow stands on its own.

Can the Gorgias AI Agent resolve flagged tickets?

That is the merchant’s call, and the rules make it explicit. The recommended pattern lets the Gorgias AI Agent auto resolve tickets from trusted customers and routes flagged tickets to a human view.

What happens when a VIP triggers a risk flag?

The risk flag wins: the fast lane rule steps aside and sends the customer to a specialist for escalation. Trust is earned on behavior, so a VIP whose behavior changes is treated on the new evidence, not the old label.

How long does setup take?

Connecting Gorgias from the Wyllo Portal takes minutes. Building the three starter rules in Gorgias (Settings, Ticket management, Rules) is a short afternoon for a support lead, using the exact tag values on the Shopify profile. Wyllo can even set the workflows up for the merchant to ensure the best implementation, tailored to your business needs.

Bringing It Together

Your help desk was never meant to be a fraud tool, and it shouldn’t turn into one. It’s built to say yes quickly to customers who deserve it. That only works when your agents can tell who those customers are.

Remember the empty-box ticket from the top? With Wyllo on the ticket, the agent sees the customer’s history before typing a word. The ticket has already been routed to the right place, and the agent knows exactly what to say. Ninety seconds is plenty.

That’s the shift. Risk and customer experience stop working against each other. The same signal that holds a risky refund also moves a loyal customer to the front of the line. Your agents benefit most, because the hardest conversations in the queue finally come with the context to handle them well.

If your team is deciding refunds, claims, and exceptions without a view of risk, start with Wyllo CX Support and the Gorgias integration. Lead with intelligence. Grow with confidence.

1. LexisNexis True Cost of Fraud Study 2026: more than half of US retailers and ecommerce companies saw customer churn increase because of their own anti-fraud measures, and every dollar of direct fraud loss now costs more than five dollars all in.