Order Fraud Rules and Risk Scoring Module for WHMCS
Score every new WHMCS order with fraud rules you weight, then accept it, hold it for review or cancel it, with the reasons shown to your team.
What will the fraud rules module do?
Each order placed in the client area is checked against your rules as soon as checkout finishes. Every rule that matches adds the points you gave it, and the total decides what happens: below your first threshold the order goes through as normal, in the middle band it is held for a person to review, and above the top threshold it is canceled. Held orders wait in a review queue that lists every rule that matched, so whoever reviews it knows why it stopped and can accept or cancel it with one click.
This product is built to order: you get the license key at purchase and the download within 15 business days.
What does WHMCS already do, and what does this add?
WHMCS ships two fraud modules, FraudLabs Pro and MaxMind, and you switch on one of them. It sends each client-area order to that service, which returns a risk score; above your threshold WHMCS sets the order to Fraud, and staff can re-run the check or set it back to Pending. MaxMind can also reject free email services, billing and IP country mismatches, anonymous networks and high-risk countries. WHMCS itself adds a banned email domain list, captchas, and options that skip the check for existing customers or hold automatic provisioning for new ones. What it lacks is local rules you weight yourself, velocity limits, product risk, allow lists, a hold band between accept and fraud, and a queue that explains each decision. The module adds those and runs after the WHMCS fraud check, never in place of it.
What is included?
| Rule or tool | What it does |
|---|---|
| Disposable email | Checks the email domain against a disposable list you can add to |
| Country mismatch | Compares the billing country with the country of the order's IP address |
| Proxy or VPN | Looks up the order's IP address with an IP reputation service you choose, on your own API key |
| Order velocity | Counts orders from the same IP address or email within a period you set |
| High-risk products | Adds points for products you mark, such as dedicated servers |
| Allow and block lists | Emails, email domains, IP addresses and clients that always pass or always stop |
| Actions | Accept, hold for review or cancel, by score band |
Who is it for?
Hosts that sell VPS, dedicated servers, proxies or anything else that can be abused within minutes of going live, where one stolen card can bring a chargeback and an abuse complaint in the same week. It also suits shops that want to stop the obvious cases with rules they can read and change, without paying for a lookup on every order. If you need customers to prove who they are with ID documents, my KYC identity verification module handles that step.
What do you need, and what are the limits?
Requirements: WHMCS 8.13 or 9.x (I confirm your exact version at purchase) and PHP 8.1 or newer. The proxy and VPN rule needs an account with an IP reputation service of your choice; you enter your own API key and pay for its lookups. The IP country comes from Cloudflare's country header when your site runs behind Cloudflare, or from the same IP service.
Limits: rules look at order details, not identity, so a careful fraudster with a clean card on a home connection in the billing country will pass. Like the WHMCS fraud modules, it checks orders placed in the client area, not orders your staff enter. It never lowers a result: an order that WHMCS has set to Fraud stays Fraud. You decide whether held orders go to Fraud status or stay Pending with automatic provisioning paused.
It costs $129 once for a lifetime license with twelve months of updates and support, the license key at purchase and the download within 15 business days, and a seven-day refund window.
Key features
- Rules scored on every new client-area order after checkout
- Disposable email domain check with a list you can extend
- Billing country compared with IP country
- Proxy and VPN check through an IP service on your own API key
- Order velocity limits per IP address and per email
- Extra risk points for products you mark
- Accept, hold for review or cancel by score band
- Held orders set to Fraud or kept Pending with provisioning paused
- Review queue that shows every rule an order matched
- Allow and block lists for emails, domains, IP addresses and clients
Why customers buy this module
- →Obvious fraud stopped before a server is handed over
- →Staff see why an order was held, not just a bare score
- →Trusted customers on your allow list are never held
- →Works with or without a paid fraud service
Frequently asked questions
Does it replace MaxMind or FraudLabs Pro?
No. WHMCS lets you switch on one of those two services, and the module runs its own rules after that check, not in its place. If the WHMCS check marks an order as Fraud, it stays Fraud. If you use neither service, the module still scores orders with its local rules and the IP service you connect.
What happens to the invoice of a held order?
That depends on how you set the hold. If held orders go to Fraud status, WHMCS cancels the invoice, and setting the order back to Pending makes it payable again. If they stay Pending, the client can pay as normal, and the module stops the service from being provisioned until a member of staff accepts the order.
When will I get it, and what if you can't deliver?
You get the license key at purchase and the download within 15 business days of purchase. If I do not deliver it in that time, you get a full refund. Otherwise the store's seven-day refund window applies.
Technical specifications
- WHMCS
- 8.13 and 9.x (confirmed at purchase)
- PHP
- 8.1+
- Works with
- The WHMCS FraudLabs Pro or MaxMind module, or neither
- IP lookups
- IP reputation service of your choice, on your own API key
- Availability
- Built to order, delivered in 15 business days
- License
- Lifetime, 1 year of updates and support included
- Delivery
- Instant download and license key
- Refund window
- 7 days
Related modules
KYC Identity Verification Module for WHMCS
I built this KYC module to stop fraudulent signups before anything is provisioned. Customers upload ID and address proof, you review them in a queue or by API, and documents stay encrypted on your own server.
Security Hardening and Recovery Module for WHMCS
I built this module to harden a WHMCS install. It spots and blocks exploit attempts, enforces 2FA, scans for malware, sandboxes third-party addons and themes, and takes secure backups you can restore in one click.
German Legal Compliance Addon for WHMCS
I built this addon for a hosting company selling to consumers in Germany. It logs which version of your terms, privacy policy and cancellation policy each customer agreed to, gives customers an online withdrawal form, and adds receipt time and contract end to every cancellation confirmation.