How to prevent fraudulent transactions in WooCommerce

Start by checking WooCommerce > Orders and your payment gateway dashboard. Separate genuine payment disputes from card testing, fake orders and ordinary failed payments. Look for repeated attempts, many cards used from one session, mismatched billing details, unusually high-value orders or a large number of orders from newly created accounts.

Do not fulfil an order merely because WooCommerce created it. Check the payment status in the gateway as well. During an attack, deleting failed orders immediately can remove information you need for investigation and may not remove records held by the payment provider.

Open your gateway’s fraud or payment settings and enable the checks it supports. These commonly include CVC or CVV verification, address verification, postcode matching and 3-D Secure authentication. Set suspicious mismatches to require review or be declined, but check your gateway’s documentation because names and behaviour differ between providers.

If you use WooPayments, its fraud protection settings can block orders based on CVC and address-verification results, with an advanced mode for additional rules. Other gateways may provide their own risk dashboard rather than WooCommerce settings.

Add CAPTCHA or an equivalent challenge to checkout, account creation and other public forms if bots are creating fake orders. Also use rate limiting or order-attempt limits where your gateway, hosting provider or fraud extension provides them. These controls are particularly useful against card testing, where automated scripts try many stolen card details in quick succession.

Do not rely on IP blocking alone. Attackers can rotate IP addresses, so combine behavioural limits with payment checks and CAPTCHA. After enabling protection, place a legitimate test order and confirm that the challenge does not prevent normal customers from paying.

Put high-risk orders on hold until somebody checks the order, payment result and customer details. Review the billing and delivery relationship, order value, email address, phone number, previous order history and gateway risk indicators. Contact the customer using details already on the order rather than asking them to send card numbers or security codes.

Keep a written rule for when to cancel, refund or request further verification. A useful starting point is to review first orders, unusually expensive orders, expedited international deliveries and orders with several fraud warnings. Never ship while the payment is pending, failed or merely authorised if your gateway requires a later capture.

Current WooCommerce versions can include automatic fraud protection for supported checkout flows and payment gateways. It may ask a customer to verify their identity or block suspicious payment activity without requiring a separate configuration screen. Check your WooCommerce documentation and payment setup to confirm what your store supports.

This built-in protection is not a complete fraud policy: it does not replace gateway settings, order review or controls for every payment method. Keep WooCommerce, WordPress and payment extensions updated, and review your gateway logs when suspicious activity continues.

If you need risk scores, alerts, allowlists, blocklists, pre-payment checks or automatic order-status changes, use a dedicated fraud extension. Configure it conservatively first: send medium-risk orders for review and cancel only orders above a higher threshold. Review real orders before making automatic cancellation aggressive, because legitimate customers can trigger rules through shared addresses, mobile networks or unusual travel patterns.

Fast way: install and configure WooCommerce Anti-Fraud. It is designed to score transactions in real time, monitor gateway activity, alert you to suspicious orders and cancel orders that meet your chosen risk threshold. Enable its checks, run test orders through each important payment method, then adjust the rules after reviewing the results.