Anti-Fraud for WooCommerce

Anti-Fraud for WooCommerce helps you identify suspicious orders, reduce card testing activity, and decide how your store responds to potential fraud.

Combine configurable WooCommerce fraud rules, checkout protection, customer controls, and optional risk intelligence in a workflow that fits your business.

• Help reduce card testing and repeated payment attempts
• Identify suspicious orders using configurable fraud rules
• Stop selected high-risk checkouts before payment
• Review, hold, or cancel orders according to your risk settings
• Create targeted exceptions for trusted customers and restrictions for known threats

Whether you are dealing with card attacks, suspicious checkout activity, or orders that need a closer look, choose the protection and review process that suits your customers, products, and payment methods.

Protect your store from card testing attacks

Card testing uses repeated checkout attempts to test payment credentials. It can leave your store handling failed payments and suspicious orders while you try to keep checkout available for genuine customers.

Anti-Fraud combines order and payment attempt controls with fraud rules and Checkout CAPTCHA to help you respond to this activity.

• Set limits on repeated order attempts
• Limit failed payment attempts against the same order
• Add Cloudflare Turnstile or Google reCAPTCHA v2 Checkbox to checkout
• Use Advanced counting to include additional payment and checkout signals
• Combine attempt limits with your payment gateway’s fraud protection

Identify repeated attacks when checkout details change

Attackers may change email addresses, IP addresses, or other checkout details between attempts. When Advanced counting is enabled, Anti-Fraud can combine customer identifiers with failed payment activity, checkout sessions, and related cart patterns.

This provides additional ways to identify persistent attack behavior beyond a single IP address or email address. In Advanced counting, overall store volume is not used as a standalone reason to block a customer.

Why use Anti-Fraud for WooCommerce?

Use multiple protection layers, not just one risk signal

A suspicious order and an automated card attack do not necessarily look the same. Anti-Fraud brings together controls for both, with configurable WooCommerce rules at the center of the workflow.

Use built-in scoring, checkout attempt limits, allow and block lists, and automated order actions. Add Checkout CAPTCHA, PayPal protection, MaxMind, identity verification, or AI-assisted review where they fit your store.

Compare individual checks with layered protection

Different fraud controls solve different problems. This comparison shows what each control contributes on its own and how Anti-Fraud lets you combine it with additional protection.

Individual products and services may combine these controls differently. Anti-Fraud gives you the flexibility to build a layered workflow inside WooCommerce without requiring MaxMind for its built-in fraud scoring.

Built-in controls for suspicious orders

Different stores have different risk tolerances. Choose the rules that matter to your business, adjust their weights, and decide how much risk warrants a closer review.

• Set risk thresholds and individual rule weights
• Use allow lists for trusted customers and order sources
• Use block lists for known high-risk customer details
• Choose manual review, automatic order actions, or pre-payment blocking

You can leave order statuses unchanged while your team reviews risk information, place suspicious orders on hold, or apply more restrictive actions when appropriate.

Configure protection around your store

Protection presets provide a starting point. Settings are organized around essential protection, card testing, order review and alerts, trusted and blocked customers, extra protection tools, and advanced controls.

Use settings search to find the controls you need. Then adjust your configuration using real order results rather than enabling every restriction at once.

Performance depends on your hosting, order volume, enabled checks, and connected services. Choose the controls relevant to your store and test your normal checkout and payment flows after making changes.

Best practices for effective fraud protection

Use several relevant fraud indicators together, review higher-risk orders before fulfillment, and combine Anti-Fraud with your payment gateway’s security controls.

Start conservatively. Review which rules contribute to genuine and suspicious orders, then tune those rules rather than making broad changes that could affect every customer.

Is Anti-Fraud for WooCommerce right for your store?

Anti-Fraud helps with

• Identifying suspicious WooCommerce orders
• Reducing card testing and repeated checkout abuse
• Creating configurable fraud rules and customer exceptions
• Automating order review, alerts, holds, and cancellations

Understand the limits

No fraud prevention system can identify every fraudulent transaction. Anti-Fraud does not replace your payment gateway’s security controls, manage chargeback disputes for you, or replace general WordPress security.

For website access and WordPress security controls, see Security for WooCommerce. Anti-Fraud focuses on checkout activity, fraud risk, and suspicious orders.

Why merchants trust OPMC

OPMC has been developing WooCommerce extensions since 2014 and supports merchants around the world.

We maintain our extensions and provide support from the team that builds the software. Contact support when you need help understanding your configuration or investigating a reproducible issue.

Analytics dashboard

See recent fraud activity and order risk in one place, so your team can focus on the transactions that need attention.

• Compare the mix of low, medium, and high-risk orders
• Review recent order volume and higher-risk activity
• See high-risk orders placed on hold or canceled
• Review revenue alongside the value of higher-risk orders
• Monitor blocked email activity and applicable PayPal verification activity
• Check whether fraud assessments are waiting or processing normally

Handle suspicious orders automatically

Reduce repetitive review work without treating every suspicious order the same way. Decide what should happen when an order reaches your chosen risk level.

• Place suspicious orders on hold for manual review
• Cancel orders that reach a higher risk threshold
• Send administrator alerts at a selected risk score
• Stop applicable high-risk checkouts before payment
• Automatically add high-risk email addresses and IP addresses to the block list when enabled

Manual review remains useful for orders that need additional context. You can increase automation as you become familiar with your store’s fraud patterns.

Score orders using signals that matter to your business

Anti-Fraud combines enabled order and customer checks into an overall risk score. Assign each rule a weight according to how useful that signal is for your store.

• First-time buyers: Add risk when the customer or email address has no previous completed orders.
• Unusually large orders: Flag orders that exceed a chosen amount or are unusually large compared with your order history.
• Billing and shipping differences: Identify mismatched billing and delivery information.
• Phone and country inconsistencies: Compare phone country information with the billing country.
• IP and geolocation checks: Compare available location signals with billing information.
• Proxy and VPN signals: Add relevant network risk information through supported checks and integrations.
• Repeated IP activity: Identify multiple orders using different delivery details from the same IP address.
• International orders: Apply the rules you choose for international orders and selected countries.
• Suspicious email domains: Flag selected domains or add optional automated domain checks.

Increase the weight of useful signals, reduce the influence of weaker ones, or disable rules that do not apply to your customers. Some checks need a connected external service.

Stop high-risk checkouts before payment

Enable the pre-payment fraud check to assess applicable checkouts before the payment transaction proceeds. When the calculated risk reaches your configured high-risk threshold, Anti-Fraud can stop checkout and display your chosen message.

• Assess risk before payment on supported checkout paths
• Choose the high-risk threshold used to stop checkout
• Customize the message shown when checkout is blocked
• Help reduce clearly high-risk attempts reaching your payment provider

Understand why an order was flagged

A risk score is more useful when you can see what contributed to it. Review Anti-Fraud information directly on the WooCommerce order screen.

• See the overall risk score and risk level
• Review the rules that contributed to the score
• Understand why individual rules matched
• Inspect relevant customer, order, IP, phone, and location information used by supported checks
• Use available actions to add suspicious details to the block list

Scan risk across your order list

Spot low, medium, and high-risk orders while reviewing daily transactions, without opening every order individually.

Keep trusted customers moving

Create targeted exceptions for customers and order sources you already trust. Allow-list entries can exclude supported identifiers from applicable fraud checks or automated actions.

Use information such as email addresses, IP addresses, phone numbers, user roles, payment methods, names, locations, and selected REST API keys.

Keep exceptions narrow. Allowing an entire payment method, role, or location can bypass useful checks for more customers than intended.

Block known high-risk customer details

Use information from previous suspicious activity to help prevent repeat abuse. The block list supports customer and checkout identifiers including:

• Email addresses and IP addresses
• Phone numbers
• Countries and customer names
• Address keywords
• Cities, states or regions, and postal codes

You can also enable automatic additions of email addresses and IP addresses associated with high-risk orders.

Add MaxMind minFraud for deeper risk intelligence

MaxMind is optional. Anti-Fraud includes built-in WooCommerce rules and risk scoring. Connect MaxMind minFraud when you want additional transaction intelligence.

Choose a supported service level and configure its risk threshold and rule weight. The result can contribute to your overall Anti-Fraud assessment alongside the other rules you enable.

Add advanced IP signals with supported MaxMind plans

Supported Insights or Factors services can provide additional information to help you review suspicious transactions.

• Anonymous VPN detection
• Public proxy detection
• Tor exit-node detection
• Hosting and datacenter IP detection
• Distance between IP location and the billing address

Available signals depend on the MaxMind service level connected to your store. A separate account and service charges may apply.

Add identity verification for selected high-risk orders

Some orders need an additional check rather than an immediate rejection. The optional Trust Swiftly integration lets you request identity verification when a customer reaches your chosen risk threshold.

• Choose a verification template from your Trust Swiftly account
• Set the risk level that triggers verification
• Configure when verification occurs
• Reserve additional checks for the orders that need them

Add AI-assisted context to order reviews

Anti-Fraud can optionally send supported order information to OpenAI and display an AI-generated risk note for administrators reviewing an order.

Connect your own API credentials and choose a supported model. Treat the result as additional context alongside your fraud rules and manual review, not as a guarantee or the sole reason to accept or reject an order.

API usage, provider terms, and data handling are separate from your extension subscription. Review them before enabling the integration.

Add extra protection to PayPal and checkout

Use dedicated PayPal controls alongside your broader fraud rules when supported PayPal payment flows are being targeted by repeated attempts.

• Set a rolling time window for PayPal payment attempts
• Configure limits within that window and an additional hourly limit
• Use applicable checkout protection alongside order and payment attempt controls
• Optionally require PayPal account email verification
• Hold downloads until required PayPal verification is completed

PayPal account verification and card testing protection serve different purposes. Account email verification applies to customers paying with a PayPal account, not guest card payments.

Add Checkout CAPTCHA

Choose Cloudflare Turnstile or Google reCAPTCHA v2 Checkbox for supported checkout protection. Use human verification alongside attempt limits and fraud rules rather than relying on CAPTCHA alone.

The available protection depends on your checkout and payment configuration. Test your chosen payment methods and avoid adding duplicate CAPTCHA challenges through multiple extensions.

Extend protection across checkout and external services

Alongside Checkout CAPTCHA, PayPal protection, MaxMind, Trust Swiftly, and optional AI-assisted review, additional integrations can support specific fraud checks:

• QuickEmailVerification: Add automated checks for suspicious or disposable email domains.
• BigDataCloud: Add IP-to-region information for supported billing and geolocation comparison rules.
• FraudLabs Pro: Add optional SMS verification for supported classic checkout workflows.

For setup guidance, supported configurations, and troubleshooting, visit the Anti-Fraud for WooCommerce documentation.