ফ্রড গার্ড

Fraud Guard looks at every new order and marks it Fraud when a rule fires, so that a risky order is held instead of being set up. It checks orders, not payments. It is a free plugin that ships with the script, needs no outside account (one rule can use a free IP lookup service), and is meant for any shop that sells things that cost money to set up: hosting, domains, licences. It adds to the fraud rules of the core; those are described in Settings and what you can do with a held order is in Orders.

Switching it on

1. Open Setup → Fraud Protection (or Setup → Addon Modules) and press Activate on Fraud Guard.
2. Press Configure. The settings are in the group Rules.
3. Save. From now on every new order is checked.

Once it is on, its menu entry Fraud Guard appears under the Addons menu of the admin top bar; it opens the same settings page.

Settings

How it decides

For each new order the plugin collects every reason that applies and, if there is at least one, sets the order to Fraud with the module name fraud-guard and the reasons, one per line, as the fraud output, for example:

The e-mail domain (mailinator.com) is a disposable e-mail service.
The IP 203.0.113.9 placed 6 orders in the last hour (limit 5).

The reasons show in Order Details under the fraud check result. A held order is not accepted and nothing is set up; it appears under Orders → Fraud Orders.

The check is skipped for:

• orders you place yourself as an administrator (Orders → Add New Order);
• clients who already have an active service, as long as the core setting Skip Fraud Check for Existing Clients is on (it is on by default).

What it needs from outside

• Nothing, for the country, disposable e-mail, order-flood and new-client rules.
• For the IP country rule, your server must be allowed to make a plain HTTP request to ip-api.com. The free service has its own rate limits. If the lookup fails, the rule simply does not fire. If your site is behind a proxy, make sure the IP address recorded with the order is the visitor.s real one, or the rule compares the wrong country.

Typical workflow

1. You switch it on and set Banned countries to the places you cannot serve.
2. A visitor registers with a throwaway address and orders. The order is held as Fraud with the reason shown.
3. You open Orders → Fraud Orders, read the reasons and decide. A genuine client: open the order and move it forward (accept it, or set it to Pending) as described in Orders. A real fraud attempt: cancel it.
4. After a few weeks, tune the rules: raise Most orders per IP if an office with one shared IP is being flagged, or add domains to the disposable list.

Testing

1. Make a test client whose e-mail ends in @mailinator.com (it is in the starter list).
2. Order any product from that client in the store. The order should land under Orders → Fraud Orders with the reason about the disposable e-mail service.
3. Try the other rules the same way: put your own country code in Banned countries and order; or set Most orders per IP in one hour to 1 and place two orders.
4. Remember to restore your settings and move the test orders out of Fraud (or cancel them).

Troubleshooting

• Nothing is flagged: Fraud Guard is not active, the client already has an active service (the skip setting), or the order was placed by an administrator.
• Too many genuine clients are held: turn off the IP country rule, raise the order flood limit, or switch off the disposable rule while you review the list.
• The country rule does nothing: the client's country field is empty, or the country is not written as a two-letter code in the list.
• The IP country rule does nothing: private addresses are skipped, and a blocked or failed lookup means no flag.
• Fraud Guard keeps no log of its own; its decisions are the fraud result shown on each order. See Orders.