Stop fraudulent orders in WHMCS with fraud protection settings

Hosting providers attract fraud: stolen cards used to buy servers for spam, phishing sites on new accounts, and bots testing card numbers at checkout. WHMCS includes fraud screening modules and order settings that catch most of it before an account is ever provisioned.

Before you start

• An account with a fraud service: MaxMind minFraud or FraudLabs Pro (both have free or low-cost tiers).
• Payment gateways with their own fraud tools enabled (for example Stripe Radar).

Enable a fraud module

1. Go to Configuration → System Settings → Fraud Protection.
2. Choose MaxMind or FraudLabs Pro and tick Enable.
3. Enter the account ID and licence or API key.
4. Set the Risk Score threshold above which orders are marked as fraud – start around 20–30 on MaxMind's 0–100 scale and adjust.
5. Optional checks: reject free email domains, anonymous proxies, or countries where the IP and billing country differ.
6. Click Save Changes.

Each new order is scored. High-risk orders get the status Fraud and are not provisioned; the client sees a message asking them to contact you.

Require manual approval for risky products

For VPS and dedicated servers – the products criminals want most – set the product's Module Settings to Automatically setup the product when you manually accept a pending order. You then review each order in Orders → Pending Orders before it goes live. Shared hosting can stay automatic.

Review orders

1. Open Orders → List Orders and click an order.
2. Check the Fraud Check results: score, IP country, proxy detection, email checks.
3. Compare name, address, IP and email. Disposable emails or mismatched countries are warning signs.
4. Click Accept Order, Cancel Order or Set as Fraud. Setting as fraud can also close the client account.

Stop card testing

• Enable CAPTCHA on checkout and registration under General Settings → Security.
• Turn on Order Days Grace and limit unpaid orders per client in General Settings → Ordering.
• Enable Stripe Radar rules to block many failed attempts from one IP.
• Block abusive IPs under Configuration → System Settings → Banned IPs and disposable domains under Banned Emails.

Ask for verification

For borderline orders, open a ticket asking for ID or a small verification. Recent WHMCS versions include Validation.com identity verification as an optional service. Keep requests polite – most borderline orders are genuine customers.

Troubleshooting

• Too many genuine customers flagged: raise the risk threshold or disable strict checks such as free email rejection.
• Fraud check not running: wrong API key or no credit left at the provider; check Utilities → Logs → Module Log.
• Fraud got through: suspend the service immediately, refund if required by the gateway, and add the details to banned lists.

Next steps

• WHMCS security checklist.
• Stripe setup and Radar.
• Product provisioning settings.