Fraud Warden screens every WooCommerce order against 100+ risk signals, holds the doubtful ones for review and lets real customers verify themselves — all without a single network call during checkout.
30,000+
fraud orders studied
100+
risk signals per order
150 ms
checkout screening budget
Case study
We studied 31,165 failed and on-hold orders at live WooCommerce stores. 30,108 of them were fraud — bots testing stolen cards and organized rings using drop addresses — worth about $1.2 million in attempted charges.
Fraud Warden stopped 1,459 bot checkouts before an order even existed, cut ring attempts from ~230 to under 20 a week — and declined or held zero real customers.
Read the full case study ↗fraud orders analyzed — 96.6% of failed or held orders
~$1.2M
attempted fraud charges
0
real customers declined or held
01
31,165 failed and on-hold orders from live stores — 30,108 were fraud.
02
Card testing (24,495), organized rings (3,059) and a drop-address ring (2,475) — peaking at 6,017 orders in a day.
03
1,459 bot checkouts stopped before an order existed. Ring attempts fell from ~230 to under 20 a week.
04
77 early misses led to five new protections, like a no-browser challenge and store-wide attack mode.
How it works
Nothing slow runs while your shopper waits. Every check has a time budget, and if anything fails, the order goes through.
Shopper pays
Card-testing shield checks the attempt before the gateway.
150 ms screening
Local signals only decide if the order starts on hold.
Full assessment
Runs in the background with gateway facts and 100+ signals.
Decision
Features
Every layer works on its own and fails open, so you can switch on only what your store needs — and nothing ever stands between a real customer and checkout.
81
ready-made rules
6
payment gateways
0
network calls at checkout
Velocity limits per IP, network, device, email, phone and card, bot traps, an escalating cooldown after failed payments, and an optional Turnstile or hCaptcha challenge — plus a one-click Store under attack button. Testers are stopped before your gateway charges a fee.
81 ready-made rules you preview on your last 500 orders, 9 templates, a visual rule builder, allow and deny lists, and a clear model over 100+ signals with a linkage graph of past orders. Every score explains itself in plain words.
Risky orders reserve the money without taking it. Approve to capture; decline and the customer is never charged — and you pay no fee.
Held customers get a signed, single-use link — click-through, card last four, or an SMS/email code. False positives fix themselves, often in minutes.
For at least 14 days it only records what it would have done, then settles each decision against how the order really ended. Switch the store to Act when the report convinces you. The card-testing shield and cash-on-delivery checks protect you from day one.
Describe a rule in a sentence, review the compiled version and a dry run over your recent orders, then decide. Use the AI you already pay for — Claude, ChatGPT, Gemini, Mistral, Grok, DeepSeek — or a model on your own server.
A separate score for parcels likely to be refused or returned, with a phone passcode at checkout, courier history from Pathao, RedX or Steadfast, and a call list for your team. These checks work from day one.
Evidence captured at checkout, a six-section PDF evidence package for every dispute, dispute CSV import, win-rate tracking and one-click Stripe evidence submission. Outcomes feed back into scoring.
Outcomes become labels automatically. Fitted weights only replace the defaults once they measurably beat them on orders they’ve never seen.
Connect ChatGPT or Claude to read your fraud orders and Fraud Warden’s verdicts — with no names, emails or addresses — spot what they share, and act: tune rules and alerts with an undo, or propose new rules that wait for your click.
Email, Slack, Telegram and webhook alerts (Discord works too), a weekly summary, and reports on what was caught, what it was worth, false positives and how often each reason was right.
Track who redeemed which coupon or gift card, so reuse across accounts, devices and cards shows up. Optional rules catch repeat first-order coupons and free-trial abuse with WooCommerce Subscriptions.
Email, phone, IP, device and card fingerprints are hashed with a site-specific salt.
Nothing is shared with other stores. The risk network is coming soon; when it opens it stays off unless you join, and you can already preview exactly what would be sent.
Configurable retention, plus personal data export and erasure through WordPress tools.
It can’t see stolen cards — it catches the behaviour around them.
It reduces chargebacks; it can’t block friendly fraud at checkout.
Human-run rings can pass a challenge — verification stops bots, not people. Linked-identity rules and review cover that gap.
Scores mean “worth a look”, not “fraud” — that’s why the default is hold-and-verify, not decline.
Take the tour
Twelve screens from the plugin, from the review queue to the risk network. Screenshots from a demo store.
01 / 12
Held orders sorted by risk and time left. Approve, decline, ask the customer to verify or add a note, with a plain-English reason behind every point of the score.
Pricing
Fraud Warden is in early access. Request a spot to try it before public launch.
Free
$0
For stores getting started with fraud screening.
[CONFIRM: features in the free version]
Most protection
Pro
$60
/year
For stores that want every layer switched on.
Everything in Free
[CONFIRM: Pro-only features]
Early access
Leave your details and we’ll email you when your spot is ready.
Questions
No. Every check during checkout is local and timeboxed, and every one fails open — if anything goes wrong, the order proceeds. There is no network call during checkout submission, ever.
On supported gateways the money is authorized, not captured. Approving captures it; declining voids it, so the customer is never charged. You’re warned before an authorization expires.
Allowed orders: no. A held customer gets a calm “verifying your order” email instead of the usual one, often with a link to clear the hold themselves. Declines use neutral wording.
Yes to both. It supports the classic and block checkout, guards the Store API, and has been HPOS-compatible from day one.
By default, nothing. The shared risk network isn’t live yet, and it will stay off unless you join. If you turn on AI features, they talk only to the AI service you choose, and the AI connector never sends names, emails, phones, addresses or IP addresses.
Request early access, let shadow mode show you what it would have caught, and switch on protection when the numbers convince you.
For WooCommerce stores
For every WordPress site
