Store operations

Payments and fraud prevention for online stores

Gateways, crypto, payout holds and scoring risky orders before you ship.

6 guides5 in-depth57 min of reading

Money moves through a store in two directions, and both carry risk. Incoming payments can be fraudulent: a stolen card clears authorization today and comes back as a chargeback weeks later, costing the goods, the shipping, the refund and a dispute fee. The trust behind your payouts can be withdrawn: a processor that sees a sudden sales spike, slow delivery or rising disputes may hold your funds until your risk history catches up. Most of the damage in this area comes from treating a signal as proof, such as shipping because the gateway said "approved", or marking an order paid because a callback arrived.

The guides here work at the point where those decisions are made. Scoring fraudulent WooCommerce orders builds a webhook service that reads the AVS and CVC results and risk level your processor already returns, compares the buyer's IP location with the billing and shipping addresses, counts repeat orders per email and IP, and puts risky orders on hold with every reason attached. It then compares those rules with FraudLabs Pro's score. Accepting crypto with CoinGate treats callbacks as hints: each order gets its own HMAC token, the order is read back from the API before anything ships, and under- and overpayments follow written rules instead of an automatic cancel. Why Stripe and PayPal freeze fast-growing stores covers the processor's side: what triggers reserves and holds, and how to keep disputes well under 1%.

Two guides deal with money leaving the business. Building an affiliate program on Stripe subscriptions carries the referral through Checkout metadata to every invoice, books commissions on invoice.paid and reverses them on refunds. Virtual cards for business explains where one card per vendor helps with spend control and fraud containment, and why each card must belong to the business that owns the account it pays for. Where a guide includes code, it says what the code was tested against, and pricing comes from the vendor's own pages with the date it was checked.

Start here

Payments & fraud16 min read

Scoring fraudulent WooCommerce orders: manual rules vs FraudLabs Pro

A fraudulent order costs the goods, the shipping, the refund and a dispute fee when the real cardholder files a chargeback, and too many chargebacks put your payment account at risk. Score every paid order before it ships: read the AVS and CVC checks and risk level your payment processor already returns, compare the buyer's IP location with the billing and shipping address, and count repeat orders from one email or IP. Our tested Node.js webhook service does this with no dependencies, puts risky orders on hold with a note listing every reason, and can add FraudLabs Pro's score, which brings proxy detection, email and phone checks and a shared blacklist that hand-written rules can't match. FraudLabs Pro's free plan covers 500 orders a month; Stripe Radar only sees Stripe payments.

Payments & fraud4 min read

Why Stripe and PayPal freeze fast-growing stores (and how to prevent payout holds)

Processors hold funds when your risk suddenly outgrows your history: a sales spike, long delivery times, rising refunds or disputes, or a business description that doesn't match what you sell. Prevent holds by warning the processor before spikes, shipping fast with tracking, publishing clear policies, and keeping disputes well under 1%.

Payments & fraud15 min read

Accepting crypto in WooCommerce: verifying CoinGate callbacks and handling over- and underpayments

Treat a payment gateway's callback as a hint, not as proof of payment. CoinGate's callbacks carry no signature header, so verify them in two steps: give each order its own secret token (an HMAC of the order ID, so nothing needs storing) and reject any callback without it, then read the order back from CoinGate's API and act only on what the API says. Ship only when the API reports the status paid; confirming means the transaction is still waiting for network confirmations. For wrong amounts, let CoinGate's underpaid cover absorb small shortfalls (1-2% covers most wallet fees), put bigger shortfalls on hold for a person instead of cancelling them, and note overpayments so support can point the customer to CoinGate's refund form. Settle in EUR or USDC if you don't want to hold price risk. Our tested WooCommerce gateway does all of this; CoinGate charges 1% per payment with no monthly fee, and NOWPayments is a good alternative with HMAC-signed callbacks.

All payments & fraud guides

Payments & fraud15 min read

Building an affiliate program on Stripe subscriptions: server-side tracking vs FirstPromoter

The hard part of an affiliate program on Stripe is linking the click, which happens on your site, to the payments, which happen in Stripe days or months later. Store the referral code in a first-party cookie, then pass it to Stripe Checkout in three places: client_reference_id, the session metadata and subscription_data.metadata. Stripe copies the subscription metadata onto every invoice, so a webhook endpoint can attribute each customer even when events arrive out of order, then book commissions on invoice.paid and reverse them on charge.refunded. Our tested in-house version does that in about 150 lines of Python with SQLite. What it leaves out is most of the work: affiliate sign-up, a portal, payouts, tax forms and fraud review. FirstPromoter does all of that by connecting to your Stripe account, from $49 a month; build in-house only if your commission rules don't fit a tool.

Payments & fraud4 min read

Virtual cards for business: spend control, fraud containment, and why payment details link accounts

Virtual cards are a strong security tool: one card per vendor or ad account, with its own limit, can be frozen without touching anything else. But platforms also use payment details to connect accounts, so a card must belong to the business that owns the account it pays for. Use virtual cards for control and containment, never to make one operator's accounts look unrelated.

Payments & fraud3 min read

Banking for several LLCs: separating EINs, accounts, cards and domains per business

True multi-store isolation separates four layers per store: an independent LLC/DBA with its own EIN; a dedicated corporate bank account and virtual card; a domain registered on a separate Namecheap or Cloudflare account with WHOIS privacy; and an isolated AdsPower profile paired with a static residential ISP IP matching the registered state.