Fraud Warden · Case study
How Fraud Warden stopped 30,000+ fraud orders without blocking a single real customer
We analyzed 31,165 failed and on-hold orders at live WooCommerce stores. 30,108 were fraud — card-testing bots and organized rings using drop addresses. Here is what the attacks looked like, what Fraud Warden did, and where it fell short.
30,108
fraud orders out of 31,165 failed or on-hold orders reviewed
Fraud
Real customers (~630)
~$1.2M
in attempted fraud charges
1,459
bot checkouts stopped before an order was created
0
real customers declined or held by Fraud Warden
The problem
The old fraud plugin missed the fraud — and blocked real shoppers.
The stores were losing money to fraud while their previous fraud plugin turned away real customers. On the same data, it scored 86% of the fraud below its own hold line, so those orders still reached the bank — and it put a loyal customer with 79 past orders on hold.
86%
slipped under the hold line
Previous plugin’s hold line
Share of fraud orders the previous plugin scored below its own hold threshold.
Loyal customer, 79 past orders
Put on hold by the old plugin
On hold
The damage went beyond chargebacks
4,700+ units
Stock locked up
Fake orders on hold reserved stock, so popular products showed out of stock.
Thousands
Payment health at risk
Declined attempts hurt decline ratios with processors and card networks.
505
Subscriptions abused
Rings opened subscriptions that retried stolen cards on every renewal.
Lost sales
Real shoppers turned away
Every false positive is revenue that rarely comes back.
What we found
96.6% fraud — from a handful of repeat attackers.
Real customers were a small group of about 630, mostly expired cards and typos. Everything else came from four kinds of attack.
Scripted card testing
24,495
No browser, same low-priced cart, fresh email and IP on nearly every attempt. Peak: 6,017 orders in one day.
Organized fraud rings
3,059
Human-run rings with reused phones, drop addresses and fixed baskets, mostly late at night.
Drop-address ring
2,475
Nearly every order shipped to — and billed to — one address.
Single-address bot
79
Every attempt from one IPv6 address, with a new email and phone each time.
Fraud orders by attack type
Emails
Phones
Drop addresses
One phone number was used with 81 different emails.
The linkage graph tied the rings together
Reused phones and drop addresses joined thousands of “different” customers into a few rings. Some members hit more than one store with the same identities.
Emails
2,158
Phone numbers
1,206
Shipping addresses
799
IP addresses
1,811
The fingerprint
Fraud rings look nothing like real customers.
Four traits separated ring orders from real customers so clearly that they became signals in Fraud Warden’s scoring.
Trait
Ring orders
Real customers
Webmail address from one provider
90%
10%
Windows desktop browser
100%
28%
Billing and shipping address differ
85%
18%
Placed between 8 pm and 3 am store time
79%
17%
Share of orders with each trait: fraud rings vs real customers
What Fraud Warden did
Bots stopped at the door.
Real customers untouched.
Stopped before an order existed
1,459
bot checkouts stopped
198
challenged
294
lockouts
Bot orders that slipped between lockouts were declined by the bank — none shipped.
Ring attempts per week
~230
Before shield
<20
After shield
A drop of more than 90% after the card-testing shield went live.
What real customers saw
0
declined or held
10
saw a verification challenge after their own card was declined — all completed their purchase
6
flagged for a watch, with no impact on the customer
Where it fell short
77 ring orders got through. Here’s what we changed.
In its first weeks, a bot that skipped the browser could slip past per-IP and per-email limits by rotating its identity every time. Each email was used only once or twice, so the evidence sat in reused phones and addresses that weren’t yet weighted strongly enough.
77
ring orders missed in the first weeks
01
No-browser challenge
Checkouts with no browser fingerprint are now challenged.
02
Store-wide attack mode
Plus identity-churn limits per network.
03
Shared identity review
Phones or addresses shared by 10+ emails go to review.
04
Cluster decline signal
The decline rate across a linked cluster now counts.
05
No free pass for rings
A passed challenge no longer clears an identity linked to a ring.
How Fraud Warden works
Stop bots at the door. Score every order. Protect real customers.
Every decision comes with a plain-English reason. If any check fails or times out, the order goes through — checkout never breaks.
1
Stop attacks at the door
Card-testing shield with velocity limits, bot traps and cooldowns
Optional Turnstile or hCaptcha
Store under attack button — one click, auto-off
2
Score every order
Transparent model over 100+ signals
81 ready-made rules, previewed on your last 500 orders
Visual and plain-English rule builders
Allow/deny lists and a linkage graph
3
Protect real customers
Step-up verification, not decline
Hold and review — authorize, don’t capture
Self-verification link releases the order
4
Run the store
AI connector for ChatGPT and Claude
Cash-on-delivery module
Chargeback toolkit
Slack, Telegram and webhook alerts
Honest limits
What Fraud Warden cannot do
No fraud tool catches everything, and we would rather tell you up front.
It can’t see whether a card is stolen. Only the issuer knows. Fraud Warden judges the behavior around the order.
It can’t stop friendly fraud. A real customer who later disputes a charge looks good at checkout.
Human-run rings can pass a challenge. Verification stops bots, not people — linked-identity rules and review cover that gap.
Results depend on your data. Your fraud mix will differ, which is why every install starts in shadow mode.
Questions
About this case study
How many fraud orders did Fraud Warden analyze?
31,165 failed and on-hold orders from live WooCommerce stores were reviewed. 30,108 of them (96.6%) were fraud, with about $1.2 million in attempted charges.
Did Fraud Warden block any real customers?
No. No real customer was declined or held. Ten saw a verification challenge after their own card was declined, and all of them completed their purchase.
What kind of fraud hits WooCommerce stores most?
In this study, scripted card testing — 24,495 orders, with a peak of 6,017 in one day. Organized rings using reused phones and drop addresses made up most of the rest.
How does Fraud Warden stop card-testing bots?
Its card-testing shield applies velocity limits across IP, network, device, email, phone and card, plus bot traps, escalating cooldowns and an optional Turnstile or hCaptcha challenge — before the order is created.
Will my results be the same?
Probably not exactly — your fraud mix will differ. That’s why every install starts with 14 days of shadow mode, so you see what it would have stopped before it touches a checkout.
Try it on your store.
Risk-free.
Request early access, then run Fraud Warden in shadow mode for 14 days. See which orders it would have stopped and why — then turn on enforcement only when the report backs it up.