How to block fraudulent orders in WooCommerce

Start with the order record and your payment gateway dashboard. Check the email address, phone number, billing and shipping details, IP address, payment result, order value, and whether several failed attempts happened close together. A high-risk order should be held for review rather than fulfilled automatically.

Do not treat one signal as proof of fraud. Shared IP addresses, mismatched billing details, travel, VPN use, and a first order can all belong to legitimate customers. Confirm the chargeback, gateway warning, or repeated abuse before adding a permanent block.

Check WooCommerce → Settings for a fraud-prevention section. On eligible WordPress.com stores running on WP Cloud, WooCommerce includes fraud prevention that can record checkout attempts and automatically block attempts it flags. Review the recorded attempts before enabling automatic blocking, then monitor the results for false positives.

Also review your payment gateway's fraud, card-testing, 3-D Secure, verification, and dispute settings. WooCommerce's built-in or hosted controls are not available in the same way on every hosting platform, and fraud prevention does not replace the controls supplied by your payment provider.

For a confirmed repeat offender, add the smallest useful rule: usually the exact email address, followed by a phone number or address when the evidence supports it. Use an IP block cautiously because an IP can belong to a household, office, school, mobile carrier, or VPN and may block unrelated shoppers. Exact-value rules also will not catch a fraudster who changes email addresses or connects from another network.

If your store has no built-in blacklist controls, the honest manual route is operational rather than automatic: place suspicious orders on hold, cancel confirmed fraud, record the identifiers in your fraud log, and add them to the payment gateway's block or risk rules. This works for occasional abuse, but it becomes slow and inconsistent when attackers rotate their details.

Repeated failed payments in a short period may indicate card testing rather than ordinary abandoned carts. Add checkout CAPTCHA or an equivalent bot check, and use order or payment-attempt limits where your gateway or fraud extension supports them. Set thresholds from your normal order volume instead of choosing an aggressive number that blocks genuine customers.

Test every checkout path you actually use, including classic checkout, block checkout, express payment buttons, saved payment methods, and any custom or headless flow. A heavily customised checkout may not be covered by the same fraud controls as the standard WooCommerce checkout.

Place a low-value test order with a permitted account and confirm that normal customers can still reach payment. Then check that a blocked test identifier is stopped before the payment is captured. Keep a support route visible because a false positive needs a way back into the store.

Review blocked attempts and chargebacks regularly. Delete stale rules, add allow rules only for genuinely trusted customers, and never assume that blocking one IP permanently removes the problem. WooCommerce rules generally apply to future attempts, not orders that already exist.

If you need one place to block customers by email, phone, name, address, or IP, with logs and temporary rules, consider Aelia Blacklister for WooCommerce. It is a better fit than maintaining a spreadsheet and manually checking every order when fraud is recurring or targeted.

Install it through Plugins → Add New → Upload Plugin, activate it, then configure its blacklist settings. Start with confirmed identifiers, keep IP rules narrow, and review its blocked-attempt logs after launch. Test the checkout and your legitimate customer journey before relying on the rules during a busy sales period.