Description
Product Description
The Fraud Guard For WHMCS module provides an additional layer of checkout protection by analyzing customer and browser signals before an order is created.
During checkout, the module evaluates email-domain validity, browser timezone differences, and device fingerprints linked with other customer accounts. Each triggered factor contributes to a risk score that determines whether the checkout is allowed or stopped for review.
Fraud results are stored inside WHMCS with a detailed explanation of every triggered rule, helping administrators investigate suspicious activity, identify devices shared across multiple accounts, and make better-informed decisions without depending on an external fraud-scoring API.
How Fraud Detection Works
- Browser Fingerprint Is Captured: The module creates a persistent device identifier from browser and screen information and records the associated session, IP address, user agent, and timezone offset.
- Checkout Data Is Analyzed: The risk engine checks the customer’s email domain, browser timezone, and available fingerprint history.
- Risk Factors Add Points: Suspicious signals contribute weighted points to the order’s total risk score.
- A Decision Is Calculated: Low-risk checkout attempts are allowed, scores above the configurable threshold require review, and scores of 80 or higher are treated as fraud.
- Risky Checkout Is Stopped: Review and fraud decisions return a checkout validation message before the order can be completed.
- Report Data Is Stored: The complete score, decision, triggered reasons, and technical details are recorded for administrative investigation.
Risk Scoring System
- Weighted Risk Factors: Assign different score values according to the severity of each detected signal.
- Configurable Review Threshold: Choose the minimum score that should stop checkout for manual review.
- Automatic High-Risk Classification: Treat scores of 80 or above as fraud.
- Three Decision Levels: Classify activity as Allow, Hold, or Fraud.
- Pre-Order Validation: Run the risk analysis before WHMCS creates the order.
- Detailed Reasons: Store every factor that contributed to the final score.
Device Fingerprint Intelligence
Fraud Guard creates a browser-based fingerprint to help identify the same device when it appears across different sessions or customer accounts.
- Persistent Device Identifier: Store the generated fingerprint locally in the visitor’s browser for reuse.
- Linked Account Detection: Find other WHMCS client accounts associated with the same fingerprint.
- Weighted Account Matches: Add risk points for each additional linked account, up to a defined maximum.
- IP History: Review the IP addresses recorded for a fingerprint.
- User Agent History: Inspect browser and operating-system information associated with the device.
- First and Last Seen: View the activity range for each device fingerprint.
- Linked Orders: Review risk-scored orders connected with the selected fingerprint.
- Daily Record Control: Avoid repeatedly storing the same fingerprint more than once per day.
Email Intelligence
- Email Format Validation: Identify invalidly formatted customer email addresses.
- MX Record Check: Verify that the email domain has mail-exchange records.
- Missing Domain Detection: Add risk points when the submitted email domain cannot receive mail.
- Email Result Cache: Store previous email checks to reduce repeated DNS lookups.
- Fresh or Cached Source: Show whether intelligence was newly checked or loaded from stored results.
- Admin Cache View: Review checked addresses, MX status, and check dates from the module dashboard.
Timezone Analysis
- Capture the visitor’s browser timezone offset during client-area activity.
- Compare the browser offset with the WHMCS server timezone.
- Flag differences of three hours or more as a risk factor.
- Display browser offset, server offset, and the calculated difference in the fraud report.
Detailed Fraud Reports
Every analysis produces a transparent report so administrators can understand how the score was calculated instead of relying on an unexplained pass-or-fail result.
- Visual Risk Score: Display the calculated score with low-, medium-, or high-risk styling.
- Triggered Risk Factors: List the exact reasons that contributed to the result.
- Email Breakdown: Show the checked address, MX status, and data source.
- Timezone Breakdown: Show detected offsets, difference in minutes, and mismatch status.
- Linked Account Details: Display the number and client IDs of accounts using the same device fingerprint.
- Direct Admin Links: Open the associated WHMCS order or client profile from the report.
- Technical Data: Expand the stored JSON report for deeper troubleshooting or auditing.
Administrator Features
- Fraud Logs: View recent checks with order, client, risk score, date, and report links.
- Fingerprint Records: Browse recent devices together with client, IP, user agent, and date information.
- Device Detail Pages: Investigate linked clients, orders, IP addresses, user agents, and activity dates.
- Email Cache: Review email validation results and MX status.
- Automatic Check Toggle: Enable or disable fraud validation from the addon configuration.
- Risk Threshold Setting: Control the score at which checkout should be stopped for review.
- Local Risk Processing: Calculate scores using module logic and your WHMCS database rather than an external scoring service.
Business Benefits
- Stop Suspicious Orders Earlier: Validate risk before an order is created or provisioned.
- Detect Repeat Devices: Identify customers attempting to use one browser fingerprint across multiple accounts.
- Reduce Invalid Signups: Flag email domains that do not have valid mail-exchange records.
- Support Manual Investigation: Give administrators a clear explanation and technical history for each score.
- Control Risk Tolerance: Adjust the review threshold to suit your business requirements.
- Keep Data In-House: Store fingerprints, checks, and reports within the WHMCS database.
Ideal For
- Web hosting and reseller hosting providers
- VPS and dedicated server businesses
- SaaS and subscription-based platforms
- Software and digital service providers
- Businesses affected by repeated accounts or signup abuse
- Any WHMCS installation requiring additional checkout risk validation
Why Choose Fraud Guard For WHMCS?
Fraud Guard adds transparent, configurable risk validation to the WHMCS checkout process. Instead of providing only a generic fraud result, it records the signals that contributed to each score and gives administrators tools to investigate repeated devices and questionable customer information.
With pre-order validation, device-link analysis, email-domain checks, timezone comparison, and detailed local reports, the module helps businesses identify suspicious activity before accepting potentially costly orders.
