WooCommerce fraud has a specific profile. The threat isn’t usually a sophisticated attacker targeting your store directly — it’s automated scripts running card testing attacks, bots probing for coupon vulnerabilities, and customers disputing legitimate charges with their bank. Understanding the mechanics of each attack type is the starting point for defences that actually work.
Card testing attacks — the most common WooCommerce fraud vector
Card testing is the practice of running hundreds of small transactions (typically $0.01 to $1) through a checkout to verify which stolen card numbers are still active. The attacker isn’t trying to buy your products — they’re using your checkout as a free card validator before selling the verified numbers or using them elsewhere for high-value purchases.
Signs of a card testing attack in progress: a sudden spike in failed payment attempts, multiple small-amount orders from different email addresses within a short window, multiple orders from the same IP or IP range, and a surge in Stripe or PayPal declined-payment notifications.
The combination that stops most card testing:
- CAPTCHA on the checkout page — reCAPTCHA v3 or Cloudflare Turnstile (invisible, no “pick the traffic lights” friction) adds bot detection that breaks most automated testing scripts without adding meaningful checkout friction for real customers.
- Velocity rate limiting — limit payment attempts per IP address to 3–5 per hour. Wordfence’s rate limiting covers login attempts; WooCommerce Anti-Fraud extends this to the order submission layer.
- Stripe Radar rules — if you’re on Stripe, enable the built-in velocity rule that blocks cards declined more than a configurable number of times in a given period. Radar’s machine learning layer also flags patterns associated with card testing even when individual IPs are being rotated.
- Minimum order value — not always appropriate for every store, but a $5–$10 minimum eliminates the micro-transaction pattern entirely without affecting legitimate customers.
Chargeback fraud (friendly fraud) — and how to fight it
Chargeback fraud — sometimes called “friendly fraud” — is when a customer makes a legitimate purchase, receives the goods, and then disputes the charge with their bank, claiming the transaction was unauthorised or the order never arrived. The burden of proof falls on the merchant, and the dispute window is typically 60–120 days after the transaction.
The practical defence is documentation gathered at order time, not after the dispute arrives:
- Physical goods: shipping confirmation with carrier tracking, delivery confirmation (signature on high-value orders), the customer’s IP address at order time, and the billing address used.
- Digital goods: download logs with timestamps and IP addresses, access logs for the specific content delivered, and the email confirmation sent at purchase.
- All orders: the WooCommerce order record, payment gateway transaction ID, and any customer correspondence about the order.
Stripe’s Chargeback Protection (paid add-on) covers eligible transactions — Stripe fights the dispute on your behalf and covers the disputed amount if you lose. For stores with recurring chargeback problems, this is worth calculating against your average dispute rate and the per-chargeback fee ($15–$25). For the full breakdown of Stripe vs PayPal chargeback handling, see the WooCommerce payment gateway comparison.
The economic decision on individual chargebacks: for orders below roughly $100, the dispute fee often makes conceding the better choice even if you’d win. For high-value orders, fighting with complete documentation is worth the time — payment networks accept evidence packages and genuinely do find for merchants when the paper trail is solid.
Account takeover (ATO)
Account takeover attacks use credential lists from data breaches to try to log in to customer accounts at scale (credential stuffing). Once attackers have access, they change the shipping address on a saved order, use stored payment methods, or mine reward points. The attack is automated — thousands of credential pairs tried per hour against your login endpoint.
Defences:
- Login attempt rate limiting — WordPress allows unlimited login attempts by default, which makes credential stuffing trivial. Wordfence’s built-in rate limiting or Limit Login Attempts Reloaded blocks IPs after a configurable number of failed attempts. Set the threshold to 5–10 attempts before a temporary block.
- 2FA for customer accounts — WooCommerce doesn’t enable two-factor authentication for customers by default. WP 2FA covers customer accounts as well as admin accounts, and can be set to make 2FA optional (customers who enable it get the protection; those who don’t remain at credential stuffing risk). For admin accounts, 2FA should be mandatory — see the WooCommerce data protection guide for the full setup.
- Anomalous login detection — WP Activity Log flags login events, including logins from new IP addresses for existing accounts. For a customer who always logs in from London and suddenly logs in from a Vietnamese IP, this surfaces the anomaly before any order is placed.
Velocity checks and high-risk order review
Velocity checks flag orders that exceed a threshold — multiple orders from the same IP, the same email address used across multiple accounts, the same billing address with different card numbers, or the same card across multiple accounts. These patterns don’t always indicate fraud, but they indicate elevated risk that warrants manual review before fulfillment.
WooCommerce Anti-Fraud and FraudLabs Pro both assign a risk score to each order based on configurable rules. Orders above a threshold can be automatically placed on hold for review rather than processed immediately. For orders significantly above your average order value — a reasonable review threshold is 3–5× your AOV — manual review before shipping is worth the operational overhead.
3D Secure and Strong Customer Authentication
3D Secure (3DS) is an additional authentication step at checkout where the customer’s bank verifies the transaction — the “Verified by Visa” or “Mastercard Identity Check” step you occasionally see. For EU transactions, PSD2’s Strong Customer Authentication (SCA) regulation requires 3DS on most card payments as of 2021.
The key fraud-prevention benefit: when a 3DS-authenticated transaction is later disputed as unauthorised, liability shifts from you to the issuing bank — you’re not liable for the chargeback. Stripe enables 3DS automatically where it’s required (EU SCA) and can be configured to request it on all transactions globally. The checkout friction is minimal for most customers (most 3DS flows are now handled invisibly in the background), and the chargeback liability shift is significant for high-ticket stores where dispute costs are material.
Coupon and refund abuse
Coupon abuse patterns: creating multiple accounts to use a single-use code repeatedly, sharing exclusive codes publicly, and timing purchases with refund requests to extract a discount without retaining the product.
Practical mitigations:
- Usage limits per email at the coupon level — WooCommerce’s built-in “Usage limit per user” applies per account. WooCommerce Coupon Restrictions (free plugin) adds per-email and per-IP limits that are harder to circumvent by creating new accounts.
- Minimum order value on discount coupons — prevents micro-transactions that exploit a discount to get near-free products.
- Delayed fulfillment for accounts with refund history — if a customer account has two or more refunds in the past 30 days, hold the next order for manual review before shipping.
Fraud detection plugins worth using
WooCommerce Anti-Fraud ($79/year, official WooCommerce extension) assigns a risk score to every order based on configurable rules: IP geolocation mismatch versus billing address country, email domain reputation, card testing velocity, and order amount thresholds. High-risk orders are automatically held in WooCommerce’s review status before payment is captured. No external service dependency — everything runs server-side. Best starting point for most stores.
FraudLabs Pro uses a global fraud intelligence network — patterns shared across merchants — which gives it better detection for known fraud actors than a rules-only plugin. The free tier covers up to 500 queries per month, which is worth testing before committing to a paid fraud service. Paid plans start at $29.95/month for higher query volume.
Signifyd is guarantee-based: Signifyd approves or declines orders and covers the chargeback cost if an approved order turns out to be fraudulent. More expensive than the plugin options (pricing by transaction volume), and appropriate for stores where chargebacks are already a measurable current cost rather than a hypothetical risk. The economics work when chargeback rates are high enough that the guarantee fee is less than the dispute cost.
For the security layer that sits underneath fraud detection — WAF, malware scanning, and the plugin vulnerabilities that create fraud vectors in the first place — the WordPress security plugins guide covers Wordfence, Sucuri, and MalCare in detail.
When a fraudulent order slips through
If a fraudulent order has already been fulfilled:
- Report to your payment gateway immediately — Stripe and PayPal have dedicated fraud reporting flows. Reporting helps their systems flag the card and prevents the same credentials from being used against other merchants.
- Gather evidence before the dispute deadline — collect order details, IP address at checkout, email, shipping address, and any tracking or delivery confirmation. Dispute windows are typically 7–21 days from when you’re notified; prepare the evidence package before responding.
- Block the pattern, not just the card — if card testing was involved, tighten your velocity rules. If it was account takeover, check whether other accounts with the same IP range or email domain are at risk.
For the GDPR and CCPA obligations that activate when a fraud incident involves a data breach — 72-hour breach notification, affected-customer disclosure requirements — the WooCommerce GDPR and CCPA compliance guide covers those obligations in detail.
If you want a professional review of your store’s current fraud exposure — velocity rules, payment gateway configuration, and whether your chargeback rate has crossed a threshold that warrants a dedicated fraud service — get in touch. Most WooCommerce fraud audits can be completed remotely without disrupting your live checkout.
