It's highly likely it's a scammer testing stolen credit card details and using your site to find ones which work.
We highly recommend that you immediately refund all of these fraudulent orders.
There is some more info at Shopify’s community forum and apparently it’s a common fraud from scammers who are testing stolen credit card details on smaller retailers - when a payment works, they then go and make larger purchases elsewhere.
It can happen on any product - but commonly these scammers choose low value ones to test as they probably hope the cardholder who's CC is stolen doesn’t realise what’s happening.
If it’s happening with a shipping protection product - this is likely because it has a product page which scammers can find via google and then checkout. It’s annoyingly not something that can be fixed by any cart apps - as carts won’t show anything if they’re empty - so if scammers are able to checkout with just shipping protection or a ‘free returns’ then they are most likely finding the product page of this item via Google.
Refunding is definitely the way to go on orders that have already happened.
To prevent it from happening, a Shopify community forum poster recommended creating a Shopify Flow that does not capture payments for Medium/High risk orders so that you do ‘manual payment capture’ on these.
It could technically also be setup for low value items - but this kind of fraud could happen on any product so this may not be completely fool proof.
So you could also setup a shopify flow to not capture payment on orders that only contain shipping protection or 'free return's products.
Here’s Shopify’s guide on setting up fraud prevention flows:
Apparently shopify blocks risky IP addresses, but some can slip through the cracks. It's unfortunately not something Unicorn can do anything about.
Here’s more discussion on this from the shopify community forum: https://community.shopify.com/c/shopify-discussions/how-can-i-prevent-high-risk-fraudulent-orders-from-processing/m-p/2500094