Table of Contents
Quick answer: Fake orders come from bots placing junk orders and from fraudsters using stolen cards. Cut both by enabling AVS and CVV checks at your payment gateway, turning on 3D Secure, restricting selling and shipping to countries you serve, controlling Cash on Delivery, blacklisting high-risk IPs and emails, and holding suspicious orders for manual review. Add a fraud-scoring plugin to automate the decisions when volume grows.
Key Takeaways
- Fake orders come in three forms: automated bot/spam orders, fraudulent orders placed with stolen card data, and fake Cash on Delivery orders that never get collected. All three waste time, burn gateway fees, and can raise your chargeback rate.
- Spot them by the signals: a large first order from a new customer, mismatched billing and shipping, multiple declined attempts in a short window, bursts of small orders from one source, and gibberish or disposable emails.
- Start at your payment gateway, since it’s the cheapest first line of defence: enable AVS and CVV checks, turn on 3D Secure (which also shifts chargeback liability to the issuer), and switch on built-in tools like Stripe Radar or PayPal’s fraud filters.
- Restrict selling and shipping to the countries you actually serve under WooCommerce > Settings > General, which removes a large share of overseas fraud in one move.
- Fake COD orders need a conditional payments plugin, since WooCommerce can’t show or hide COD by condition on its own; use it to cap COD value, restrict it to verified customers, or hide it for high-risk regions.
- Once volume outgrows manual checks, the WooCommerce Anti-Fraud plugin scores each order on signals like email age, billing/shipping distance, VPN use, and order velocity, then flags, holds, or blocks the risky ones automatically.
A fake order is one placed with no genuine intent to buy honestly. It comes in three shapes: automated bot or spam orders, fraudulent orders placed with stolen card data, and fake Cash on Delivery orders that never get collected. All three waste your time, burn gateway fees, and can raise your chargeback rate enough to threaten your merchant account.
This post focuses on fraud and fake orders. For automated spam signups and bot junk specifically, see the companion guide on how to stop spam orders in WooCommerce. Here we deal with stolen-card fraud, card testing, and fake COD.
Know what you are fighting
The defence changes with the attack:
- Fraudulent card orders: real payment attempts using stolen card data. Beaten with AVS and CVV checks, 3D Secure, fraud scoring, and blacklisting.
- Card testing (carding): an attacker runs many small transactions to find which stolen card numbers still work. The signature is a spike of small or failed orders within seconds.
- Fake COD orders: a fake name and address with no intent to pay on delivery. Costs you the shipping both ways.
How to spot a fake or fraudulent order
Before blocking anything, learn the signals:
- A large first order from a brand-new customer.
- Billing and shipping addresses or countries that do not match.
- Multiple declined transactions in a short window.
- A burst of small orders from one IP or card (the card-testing pattern).
- Gibberish names or disposable email addresses.
Steps to prevent fake orders
Work through these from the cheapest gateway settings to the tools that scale, layering as many as fit your store.
1. Enable AVS and CVV checks at the gateway
Your payment gateway is the first line of defence. In Stripe, PayPal, or Authorize.Net, enable the Address Verification System (AVS) to reject mismatched billing addresses, and CVV/CVC matching to reject the wrong card security code. These run at the processor and stop most card-testing attacks before an order completes.
2. Turn on 3D Secure
3D Secure (and SCA) adds an issuer-side verification step, often a one-time password, before payment clears. It also shifts chargeback liability to the card issuer for verified transactions, which protects you when a stolen card slips through.
3. Use built-in gateway fraud tools
Modern gateways ship fraud engines. Stripe Radar scores each payment with machine learning and can block or hold risky ones, and PayPal offers configurable fraud filters. Switch them on and tune the thresholds to your risk tolerance.
4. Restrict the countries you sell and ship to
If you only serve a few countries, limit checkout to them. Go to WooCommerce > Settings > General and set Selling location(s) and Shipping location(s) to specific countries. Customers outside the list cannot complete checkout, which removes a large share of overseas fraud in one move.
5. Control Cash on Delivery
Fake COD orders are a major vector in COD-heavy markets, where a buyer orders with no intent to pay on delivery and you eat the round-trip shipping. WooCommerce cannot show or hide COD by condition on its own, so this is where a plugin earns its place.
With a conditional payments plugin for WooCommerce, you can cap the COD order value, restrict COD to verified or repeat customers, require phone or address confirmation, or hide COD entirely for high-risk regions. Limiting COD to logged-in customers alone removes a large share of throwaway orders.
6. Block high-risk IPs, emails, and regions
Fraud rings hammer checkout from the same sources, so cutting them off stops repeat damage. You can block an IP address in WooCommerce by hand, but a dedicated blacklist plugin scales it: block by IP, IP range, email, email domain, phone number, or country from one screen, and stop flagged customers before the order goes through. That is far less work than chasing each bad actor after the fact. For card testing specifically, see how to prevent carding attacks.
7. Hold suspicious orders for manual review
Set your store to hold high-risk orders instead of auto-completing them. Keep new, high-value, or country-mismatched orders in On hold or Pending so you confirm them before fulfilment. This stops a fraudulent order from shipping while you verify it. A quick check usually settles it: a call to the phone number, a reverse lookup of the email, or confirming the billing address with the card issuer.
8. Add a fraud-scoring plugin
Manual checks do not scale past a handful of orders a day. A WooCommerce anti-fraud plugin scores each order automatically on signals like email age, the distance between billing and shipping, proxy or VPN use, and order velocity, then flags, holds, cancels, or blocks the risky ones by rules you set. It turns the layered defence above into something that runs on its own, catching a fraudulent order the moment it comes in rather than after you have shipped. This is the layer that keeps fraud manageable as order volume rises.
WooCommerce Fraud Prevention
Equip your store with our feature-rich fraud prevention plugin to reduce risk and safeguard your profits.
14-day, no-questions-asked money-back guarantee.
What to do after a fraudulent order slips through
If one gets past you, act fast. Cancel or refund before you ship to avoid a chargeback, since a chargeback costs more than a refund. Then add the customer’s email, IP, and phone to your blacklist so the same actor cannot repeat, and log the pattern so you can tune the rules above.
Best practices
A few principles tie the steps together:
- Layer defences. No single tactic catches everything; AVS, 3D Secure, country limits, and scoring together do.
- Tune thresholds to your real order patterns so you block fraud without rejecting good customers.
- Review held orders daily so legitimate buyers are not stuck.
- Keep WooCommerce, your gateway, and security plugins updated.
Conclusion
Avoiding fake orders on WooCommerce is about layers, not one switch. Turn on gateway-level AVS, CVV, and 3D Secure, restrict the countries you serve, control COD, blacklist bad actors, and hold suspicious orders for review. Once volume outgrows manual checks, the WooCommerce Anti-Fraud plugin scores and auto-handles risky orders so the layered defence runs itself, without adding friction for real buyers.
WooCommerce Fraud Prevention
Equip your store with our feature-rich fraud prevention plugin to reduce risk and safeguard your profits.
14-day, no-questions-asked money-back guarantee.
Frequently asked questions
Why am I getting fake orders on my store?
Usually bots testing stolen cards on your checkout, or fraudsters placing orders with stolen card data or fake COD details. Both target stores with weak verification.
Does WooCommerce have built-in fraud prevention?
WooCommerce has native country restrictions and account settings, and gateways add AVS, CVV, and 3D Secure. For risk scoring and automated blocking, you add an anti-fraud plugin.
How do I avoid fake COD orders?
Cap COD order value, restrict COD to verified or repeat customers, confirm phone and address before dispatch, and disable COD for high-risk regions.
What are the signs of a fraudulent order?
Mismatched billing and shipping, a large order from a new customer, multiple declined attempts, and bursts of small orders from one source.
What should I do after shipping a fraudulent order?
Try to recall or cancel the shipment, refund before a chargeback is filed, and blacklist the customer’s email, IP, and card fingerprint.
