Review queue
Held orders waiting for a human decision — what approve and reject do, what the buyer sees, and how to keep the queue healthy.
The Review queue (Protection → Review queue) collects every order the Hold for review action stopped — across all your events, one inbox. Each entry is a real person waiting, so the queue is built for fast, informed decisions.
Reviewing an order
Each held order shows the buyer, the items, the amount — and the risk score with its named reasons: Frequent orders from this IP, Disposable email address, Large number of tickets. Click through to the full order detail when you need more context (their history, other orders from the same email).
Two buttons:
- Approve — the order continues exactly as if it had never been held: it becomes a pending reservation and the reservation email with payment instructions goes out, and the buyer is none the wiser.
- Reject — the order is cancelled and its seats released. The buyer receives a neutral email that discloses no reason — by design, so your risk rules can't be probed by trial and error. The wording is editable like every email (Emails → reference).
While an order waits
- Its seats stay held — approving late never means the seats are gone.
- No tickets and no payment instructions exist yet — a scalper can't pay their way past the hold.
- The buyer sees an honest "your order is being reviewed" message, both on-screen and by email.
Held orders hold real inventory, so review daily while an event is on sale — a stale queue is seats off the market and genuine buyers left waiting. If the queue is chronically full of orders you approve, that's the signal to soften the medium-risk action in Rules.
Where decisions are recorded
Approve and reject both land in the audit log and the order's timeline with your name — and the Protection Overview counts them, building the evidence for tuning the ladder.
Related
Rules and actions
What happens to a risky order — flag, require phone verification, hold for review, or block — configured as organization defaults with per-event overrides.
Allow and deny lists
Manual overrides on checkout — trust a buyer past every risk action, or refuse one outright, keyed on email, domain, phone, IP, or device.

