Fraud Detection

Fraud detection

Checkout Security analyzes each checkout attempt across multiple signals and produces a risk score from 0 to 100. Based on configurable thresholds, the plugin applies a graduated response, from allowing the request to blocking it entirely.

Risk scoring

The risk score is a composite of multiple risk factors. Each factor contributes a weighted amount to the total score, so a checkout can accumulate risk from several independent signals.

A score of 0 means that Checkout Security detected no risk signals. A score of 100 represents the maximum risk level. The final score determines which progressive response action the plugin takes.

Progressive response actions

The default thresholds map risk scores to graduated actions:

The ccp_progressive_mode option is enabled by default. It enables these graduated responses instead of applying the same action to every suspicious checkout.

Risk factors

Checkout Security evaluates the following signals when calculating a risk score:

• Referrer and request validation: Checks whether the request originated from a trusted domain.
• Email validation: Checks the email format and identifies disposable email domains.
• Phone validation: Checks whether the phone number is valid.
• Geographic and country-risk checks: Flags orders from high-risk countries and mismatches between the customer location and IP country.
• VPN, proxy, and Tor detection: Identifies traffic from anonymizing networks.
• Behavioral analysis: Evaluates suspicious checkout timing, JavaScript availability through ccp_enable_js_detection, screen resolution through ccp_enable_resolution_detection, unusual-time detection through ccp_enable_business_hours_detection, and unusually fast checkout patterns.
• Rate-limiting violations: Detects repeated rapid requests from the same IP address.
• Threat intelligence IP reputation: Uses external IP reputation data from configured threat providers.

Configuration

Configure the main fraud-detection behavior with these options:

Next steps