Store operations

Payments and fraud prevention for online stores

Gateways, crypto, payout holds and scoring risky orders before you ship.

6 guides6 in-depth79 min of reading

Money moves through a store in two directions, and both carry risk. Incoming payments can be fraudulent: a stolen card clears authorization today and comes back as a chargeback weeks later, costing the goods, the shipping, the refund and a dispute fee. The trust behind your payouts can be withdrawn: a processor that sees a sudden sales spike, slow delivery or rising disputes may hold your funds until your risk history catches up. Most of the damage in this area comes from treating a signal as proof, such as shipping because the gateway said "approved", or marking an order paid because a callback arrived.

The guides here work at the point where those decisions are made. Scoring fraudulent WooCommerce orders builds a webhook service that reads the AVS and CVC results and risk level your processor already returns, compares the buyer's IP location with the billing and shipping addresses, counts repeat orders per email and IP, and puts risky orders on hold with every reason attached. It then compares those rules with FraudLabs Pro's score. Accepting crypto with CoinGate treats callbacks as hints: each order gets its own HMAC token, the order is read back from the API before anything ships, and under- and overpayments follow written rules instead of an automatic cancel. Why Stripe and PayPal freeze fast-growing stores covers the processor's side: what triggers reserves and holds, and how to keep disputes well under 1%.

Two guides deal with money leaving the business. Building an affiliate program on Stripe subscriptions carries the referral through Checkout metadata to every invoice, books commissions on invoice.paid and reverses them on refunds. Virtual cards for business explains where one card per vendor helps with spend control and fraud containment, and why each card must belong to the business that owns the account it pays for. Where a guide includes code, it says what the code was tested against, and pricing comes from the vendor's own pages with the date it was checked.

Start here

Payments & fraud16 min read

Scoring fraudulent WooCommerce orders: manual rules vs FraudLabs Pro

A fraudulent order costs the goods, the shipping, the refund and a dispute fee when the real cardholder files a chargeback, and too many chargebacks put your payment account at risk. Score every paid order before it ships: read the AVS and CVC checks and risk level your payment processor already returns, compare the buyer's IP location with the billing and shipping address, and count repeat orders from one email or IP. Our tested Node.js webhook service does this with no dependencies, puts risky orders on hold with a note listing every reason, and can add FraudLabs Pro's score, which brings proxy detection, email and phone checks and a shared blacklist that hand-written rules can't match. FraudLabs Pro's free plan covers 500 orders a month; Stripe Radar only sees Stripe payments.

Payments & fraud13 min read

Why Stripe and PayPal hold payouts from fast-growing stores, and the numbers that decide it

A processor holds or reserves funds when its exposure to your future disputes grows faster than your track record: a sudden volume spike, slow delivery, rising disputes or early fraud warnings, or a business that no longer matches its account profile. The numbers behind it are public. Stripe treats dispute activity above 0.75% as excessive, Visa's VAMP program counts disputes plus fraud reports against same-month Visa payments (non-compliant at 0.5%, excessive at 1.5% with 1,500+ reports), and Mastercard counts this month's chargebacks against last month's payments (1.5% with 100+). Track those ratios weekly from the API, warn the processor before spikes, upload tracking fast, refund early fraud warnings, and keep enough cash to run for 30 days without payouts.

Payments & fraud15 min read

Accepting crypto in WooCommerce: verifying CoinGate callbacks and handling over- and underpayments

Treat a payment gateway's callback as a hint, not as proof of payment. CoinGate's callbacks carry no signature header, so verify them in two steps: give each order its own secret token (an HMAC of the order ID, so nothing needs storing) and reject any callback without it, then read the order back from CoinGate's API and act only on what the API says. Ship only when the API reports the status paid; confirming means the transaction is still waiting for network confirmations. For wrong amounts, let CoinGate's underpaid cover absorb small shortfalls (1-2% covers most wallet fees), put bigger shortfalls on hold for a person instead of cancelling them, and note overpayments so support can point the customer to CoinGate's refund form. Settle in EUR or USDC if you don't want to hold price risk. Our tested WooCommerce gateway does all of this; CoinGate charges 1% per payment with no monthly fee, and NOWPayments is a good alternative with HMAC-signed callbacks.

Common questions

Why is Stripe holding my payouts or keeping a reserve?

Stripe adds a reserve or slows payouts when its risk checks see a sudden jump in volume, rising refunds or disputes, or a business model with long delivery windows such as pre-orders. The terms are set per account and shown in the Dashboard. The levers you control are a lower dispute rate, accurate delivery times on the site, and fast answers to Stripe's information requests; reserves are reviewed and released over time.

Why Stripe and PayPal hold payouts from fast-growing stores, and the numbers that decide it

What chargeback rate is too high?

Most processors start treating an account as high risk once disputes approach about 1% of transactions in a month, and Visa and Mastercard run monitoring programs with fines above their own thresholds. Track the rate monthly by count of transactions, not by value, and fix the cause behind each dispute reason code rather than only fighting individual cases.

How do I spot fraudulent orders in WooCommerce before shipping?

Score each order on signals that rarely appear together in honest orders: billing and shipping countries that differ, an IP far from the billing address, several failed card attempts, a brand-new email and express shipping on high-value items. Simple rules catch the obvious cases, and a service such as FraudLabs Pro adds IP, email and device reputation. Send high scores to manual review instead of cancelling automatically.

Scoring fraudulent WooCommerce orders: manual rules vs FraudLabs Pro

How should a store handle crypto payments that arrive short?

Change the order status only on a verified gateway callback, never on the customer's return redirect. Gateways such as CoinGate report underpaid invoices as their own status, so decide a policy in advance: accept tiny shortfalls, ask for a top-up, or refund. Make the callback handler idempotent, because providers retry the same notification.

Accepting crypto in WooCommerce: verifying CoinGate callbacks and handling over- and underpayments

All payments & fraud guides

Payments & fraud15 min read

Building an affiliate program on Stripe subscriptions: server-side tracking vs FirstPromoter

The hard part of an affiliate program on Stripe is linking the click, which happens on your site, to the payments, which happen in Stripe days or months later. Store the referral code in a first-party cookie, then pass it to Stripe Checkout in three places: client_reference_id, the session metadata and subscription_data.metadata. Stripe copies the subscription metadata onto every invoice, so a webhook endpoint can attribute each customer even when events arrive out of order, then book commissions on invoice.paid and reverse them on charge.refunded. Our tested in-house version does that in about 150 lines of Python with SQLite. What it leaves out is most of the work: affiliate sign-up, a portal, payouts, tax forms and fraud review. FirstPromoter does all of that by connecting to your Stripe account, from $49 a month; build in-house only if your commission rules don't fit a tool.

Payments & fraud10 min read

Banking for several LLCs: separate accounts, payouts, domains and paperwork per business

If you run several businesses as separate LLCs, each one needs its own EIN, its own bank account, its own payment-processor payouts into that account, domains registered to it, and its own books. Money moves between them only through written agreements (a management fee, a loan, a license), recorded on both sides. Commingling, such as one bank account for two LLCs or a processor paying out to the parent, weakens the liability protection that was the reason for separate LLCs and makes taxes and a future sale harder. Keep an entity register and check it monthly; the tested script here flags shared accounts, payouts landing in another entity, domains registered to the wrong owner, missing agreements and upcoming filing deadlines.

Payments & fraud10 min read

Virtual cards for business: one card per vendor, spend limits, and why payment details link accounts

Give every vendor, ad account and subscription its own virtual card with a monthly limit just above expected spend, lock it to that merchant where your bank allows it, and name it after the vendor and the business that owns the account. A leaked or abused card then costs one budget line and can be frozen without touching anything else. Platforms also use payment details, issuer program, billing name and payout account to connect accounts, so every card must belong to the legal entity that owns the account it pays for. Audit monthly: off-vendor charges, cards near or without limits, idle cards and unknown cards, which the tested script in this guide checks from a CSV export.