Block Fraud Customers by Email in WooCommerce

Block a fraud customer’s email in WooCommerce by rejecting it during validation. At checkout, use the woocommerce_after_checkout_validation hook to read the billing email and add an error if it matches a blocked address or domain. At registration, use woocommerce_registration_errors. Match case-insensitively, and for disposable email providers block the whole domain. This stops the order at the form, so pair it with broader fraud checks, or use a blacklist plugin for no-code, cross-checkout coverage.

A suspicious email is one of the clearest fraud signals you get. Disposable addresses from temp-mail providers, addresses tied to past chargebacks, and gibberish inboxes show up again and again on fake and fraudulent orders. Blocking them at the door stops a repeat offender before they reach payment.

This guide is scoped to one job: blocking customers by their email address or email domain. It is one layer of defence. For the full anti-fraud playbook covering IP, address, velocity, and gateway checks, see the guide on how to avoid fake orders on WooCommerce.

---

When should you block an email?

Block on a clear signal, not a hunch, so you do not turn away real buyers. Good reasons:

• A known bad address tied to a previous chargeback or failed delivery.
• A disposable or temp-mail domain, like mailinator and similar throwaway providers.
• An obvious junk pattern, such as a gibberish local part on a free domain.
• A repeat offender you have already refunded or cancelled.

Method 1: Block specific email addresses with code

The cleanest way to stop a known address is to validate it when the order or account is created. The snippets below go in your child theme’s functions.php or a code snippets plugin.

Block at checkout

The woocommerce_after_checkout_validation hook runs as the order is placed. Read the billing email, and add an error to stop checkout when it matches your blocklist.

add_action( ‘woocommerce_after_checkout_validation’, ‘ds_block_blacklisted_emails’, 9999, 2 );

function ds_block_blacklisted_emails( $data, $errors ) {

    $blacklist = array( ‘scammer@example.com’, ‘fraud@lorem.io’ );

    $email     = strtolower( $data[‘billing_email’] );

    if ( in_array( $email, $blacklist, true ) ) {

        $errors->add( ‘blacklist’, __( ‘Sorry, we are unable to process your order.’, ‘textdomain’ ) );

    }

}

The strtolower() call matters. Without it, a fraudster bypasses the block by changing the capitalisation of their email, so always normalise the address before comparing.

Block at registration

If you allow account creation, stop the blocked email there too, before an account exists. Use the woocommerce_registration_errors filter.

add_filter( ‘woocommerce_registration_errors’, ‘ds_block_registration_emails’, 10, 3 );

function ds_block_registration_emails( $errors, $username, $email ) {

    $blacklist = array( ‘scammer@example.com’, ‘fraud@lorem.io’ );

    if ( in_array( strtolower( $email ), $blacklist, true ) ) {

        $errors->add( ‘blocked_email’, __( ‘Registration with this email is not allowed.’, ‘textdomain’ ) );

    }

    return $errors;

}

---

Method 2: Block entire email domains

Blocking one address at a time does not stop disposable email services, where a fraudster generates a fresh address on every visit. For those, block the whole domain.

Extract and match the domain

Pull the domain from the email, lowercase it, and check it against a blocklist of throwaway providers.

add_action( ‘woocommerce_after_checkout_validation’, ‘ds_block_email_domains’, 9999, 2 );

function ds_block_email_domains( $data, $errors ) {

    $blocked_domains = array( ‘mailinator.com’, ‘guerrillamail.com’, ‘tempmail.com’ );

    $email  = strtolower( $data[‘billing_email’] );

    $domain = substr( strrchr( $email, ‘@’ ), 1 );

    if ( in_array( $domain, $blocked_domains, true ) ) {

        $errors->add( ‘blacklist’, __( ‘Please use a permanent email address to place your order.’, ‘textdomain’ ) );

    }

}

Keep the list current

There are hundreds of disposable email domains, and new ones appear constantly, so a short hand-written list goes stale fast. Public, community-maintained lists of disposable domains exist on GitHub and are a better starting point than typing your own. Because disposable emails are also a top signal for bot signups, the same blocking pays off against spam. For that side of the problem, see how to stop spam orders in WooCommerce.

---

Gotchas and limits of the code approach

Email blocking is useful, but be honest about what it does and does not do:

• It blocks at the form, not the person. A determined fraudster can use a different email, so treat this as one layer, not a complete fix.
• Case sensitivity bites. Always lowercase the email before comparing, or the block is trivial to bypass.
• Partial matches need different logic. To block anything containing a string, use stripos() or a regex rather than an exact in_array() check.
• The block checkout differs. These snippets target the classic checkout. The newer block-based checkout validates through the Store API, so the classic validation hooks may not fire there. A plugin that supports both is the safer route if you run the block checkout.

---

The no-code way: a blacklist plugin

Code is fine for a short, fixed list. Once you are maintaining domains by hand, importing lists, and covering both checkout types, a plugin is the better tool.

The WooCommerce Fraud Prevention plugin blocks by email address and by domain, at both registration and checkout, from the admin. You can bulk-import addresses and domains, pull in a maintained disposable-domain list, set a custom block message, and keep a whitelist so trusted customers are never caught. It also covers the other customer blacklist signals, like IP and phone, so email blocking becomes one rule among many rather than a snippet you babysit.

Best practices

Keep these in mind so blocking helps more than it hurts:

• Block on clear signals, and keep a whitelist so real customers are never trapped.
• Normalise emails with strtolower() everywhere you compare.
• Block disposable domains, not just single addresses, since fraudsters rotate addresses.
• Write a calm, non-revealing block message so you do not coach fraudsters on what triggered it.
• Treat email blocking as one layer alongside the broader checks in the fake orders guide.

---

Conclusion

Blocking suspicious emails in WooCommerce is a fast, high-value layer of fraud defence. Reject known addresses and disposable domains during validation with woocommerce_after_checkout_validation at checkout and woocommerce_registration_errors at registration, always matching case-insensitively. When the lists grow or you need both checkout types covered without code, the WooCommerce Fraud Prevention plugin manages email and domain blocking, whitelists, and disposable-domain lists from one screen.

Frequently asked questions