Ecommerce Fraud Prevention Software: A Buyer's Guide

Short answer: ecommerce fraud prevention software comes in four kinds: the screening built into your payment gateway (Stripe Radar, WooPayments fraud rules, PayPal's fraud tools), pay-per-order scoring services (MaxMind minFraud, FraudLabs Pro), enterprise vendors that guarantee approved orders against fraud chargebacks (Signifyd, Forter, Riskified and others, all quote only), and plugins that defend your own checkout. Small and mid-size stores usually get the most from their gateway's tools plus a checkout-side defence against card testing, and add a guarantee only when fraud losses are large enough to justify a percentage of every order.

Pick by store size first#

The rest of this guide explains each kind of fraud, each kind of tool and what it costs. For a plugin-by-plugin view of WooCommerce options, see WooCommerce anti-fraud plugins compared.

The kinds of ecommerce fraud you are buying against#

Different tools are good at different fraud. Name the one that hurts you before you shop.

Card testing#

Stripe defines card testing as when "someone tries to determine whether stolen card information is valid so that they can use it to make purchases", also called carding or enumeration. Scripts try many cards with small payments or card setups. Stripe lists the costs: disputes on the cards that succeed, higher decline rates that make "all of your transactions appear riskier", extra fees and strain on your servers. On WooCommerce, WooCommerce's developer blog reported on 18 December 2024 "card attacks specifically targeting the Store API alone, even without the use of the Checkout block." More in WooCommerce card testing.

Stolen cards (card-not-present fraud)#

A criminal pays with someone else's card and you ship the goods. Stripe notes that "even if a payment isn't declined, this doesn't mean that it was authorized." When the real cardholder disputes it, you lose the goods, the money and a dispute fee.

Account takeover#

Someone logs in to a real customer's account with stolen credentials, then uses saved cards, store credit or loyalty points, or changes the shipping address. It matters most for stores with accounts, subscriptions and stored payment methods. Vendors such as Sift ("Block unauthorized access in real time") and Signifyd ("Protect every account. From creation to login to modification.") sell this as a separate product.

Friendly fraud#

Stripe describes friendly fraud, or first-party misuse, as when "a legitimate cardholder makes a purchase, but then disputes it at a later date", by mistake or on purpose. Fraud screening cannot stop it, because the buyer is real. Evidence, clear descriptors and pre-dispute tools are the answer; see chargeback protection.

ACH and bank payment fraud#

Bank debits fail differently: a stolen or unverified account, a debit the account holder says they never authorized, a return days later. Since Nacha's fraud monitoring rule reached Phase 2 on 19 June 2026 (in practice 22 June), every business that originates ACH debits must run risk-based processes "reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses." See the Nacha fraud monitoring rule and ACH return codes.

Digital skimming#

A malicious script on your checkout page copies card details as the shopper types. Gateway fraud tools do not see it, because the payment itself looks normal. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 on payment page scripts became effective on 31 March 2025, according to the PCI Security Standards Council. See PCI DSS 6.4.3 and 11.6.1 for WooCommerce.

No single tool covers every row. That is the main point of this guide.

The four categories of tools#

1. Gateway built-ins#

These run where the payment happens and use the gateway's view of every card it sees.

Stripe Radar. On Stripe's Radar pricing page, checked 26 October 2026, Radar Lite gives "AI-based fraud prevention for card payments and card testing, plus fraud alerts included at no additional charge for businesses on standard payments pricing." Paid tiers for businesses start at $10 (Standard), $14 (Plus) and $20 (Pro) a month. Stripe's main pricing page also lists pay as you go from $0.05 per screened transaction. Plus adds risk scores from 0 to 99, custom rules with backtesting and manual reviews; Pro adds dynamic risk thresholds and abuse prevention signals. Stripe's main pricing page says Radar for Fraud Teams is priced separately.

WooPayments fraud protection. Basic blocks an order when the customer's bank cannot verify the card security code. Advanced lets you add rules: AVS mismatch, international IP address, IP and billing country mismatch, billing and shipping country mismatch, and order total and item count limits. Blocked orders are not charged and are set to Pending payment.

PayPal. WooCommerce's docs for PayPal Payments advanced card processing say Fraud Protection is included with Advanced Checkout at no extra cost. PayPal's US fees page lists Fraud Protection Advanced as an optional service at $0.07 per transaction.

The strength of gateway tools is data: they see far more cards than any one store. The limit is that they only see what reaches them. A bot hammering your WooCommerce checkout can create failed orders and load on your site before any request is a payment, and a gateway's tool does nothing for payments on another gateway.

2. Scoring services you call per order#

These take order details (IP address, email, billing and shipping address, sometimes card BIN) and return a risk score. You decide what to do with it.

As a worked example, 2,000 orders a month on minFraud Insights is 2,000 × $0.015 = $30 a month. Scoring services are good value for stores with a manual review step. They do not take on chargeback losses, and they send shopper data to the provider, so check their terms against your privacy policy.

3. Enterprise guarantee vendors#

These vendors decide approve or decline on each order and, for approved orders, carry the cost of fraud chargebacks under contract.

Guarantees make most sense for stores with large order values, meaningful fraud losses and the volume these vendors price for. Before signing, ask which dispute reasons the guarantee covers, how fast they decide, what decline rate to expect, and whether there is a WooCommerce integration you can install today or only an API.

4. Plugin-level tools#

These run inside your store, before the gateway. They are the only layer that sees every checkout request, including the ones that never become a payment. A good one counts failed payments per IP network, email, browser and card, covers every checkout endpoint (on WooCommerce that includes the Store API), shows a challenge only to risky shoppers, and explains its decisions. Many also add order risk rules and blocklists. The plugin comparison lists them one by one.

What to evaluate before you buy#

1. Which fraud it targets. Match the tool to the table above. A guarantee vendor will not stop a card-testing burst; a blocklist will not stop a fresh stolen card.
2. Coverage of every entry point. Classic checkout, block checkout and the Store API, pay for order links, add payment method forms, account login.
3. Explainability. When it blocks or holds an order, can you see why? You will need that to answer customers and tune rules.
4. False positives. Ask how a real customer gets unblocked. Do blocks expire? Is there an allowlist?
5. Data sharing. What shopper data leaves your server, to whom, and under which terms?
6. Pricing model. Flat monthly, per query, per transaction or a share of order value. Model it on last month's orders.
7. Gateway fit. Does it read your gateway's own risk results, or ignore them?
8. Other payment types. If you take ACH, does anything watch returns and account validation?
9. Trial and exit. Can you test on staging, and what happens to your data if you leave?

How to work out what to spend#

Add up last year's direct fraud costs: fraud chargebacks (amount plus fee), goods shipped on fraudulent orders, card-testing fees, and staff hours spent on reviews. Then price each option against your real order count. On Stripe's pricing page, every dispute costs $15.00 to receive, before you lose the goods. If your yearly losses are a few hundred dollars, gateway tools and a free rate limit may be all you need. If they are in the thousands and concentrated in a few large orders, a scoring service or a plugin with a review queue usually pays for itself. If they are large and spread across many orders, get guarantee quotes and compare the percentage with your losses.

How ChargeWarden fits a fraud prevention stack#

ChargeWarden is a plugin-level tool for WooCommerce. It is not a guarantee and does not repay chargebacks; if you need a vendor to carry fraud losses on approved orders, that is a guarantee vendor's job.

What it does:

• Card-testing defence on the classic checkout, the Store API checkout that the Checkout block uses, the pay for order page and the add payment method form. It counts attempts and failed payments per IP address, per /24 or /64 network, per email, per browser, per card BIN and last four where the gateway exposes them, and per session, with blocks that expire. See card-testing limits.
• Attack mode when failed payments spike, with an optional Cloudflare Turnstile or hCaptcha challenge. See attack mode and challenges.
• Order risk scores from 0 to 100 with a written reason for every point (country mismatches, disposable email, high first order, many cards tried, Tor and cloud hosting networks), and a review queue. See order risk scoring.
• Gateway risk data from WooPayments, PayPal Payments, Stripe Radar reviews and, optionally, Stripe's own risk level and score through your Stripe account. See gateway risk data.
• ACH return monitoring for BankBridge stores, against Nacha's 0.5%, 3% and 15% return levels, and a WEB debit account validation record. See ACH and Nacha monitoring.
• Payment page script inventory with change alerts, as a helper for PCI DSS 6.4.3 and 11.6.1. See payment page scripts.

Scores use your own order data and free public IP lists checked on your server; shopper data is not sent to a fraud service. That also means it does not have a cross-merchant view of every card, which is why it reads your gateway's risk results instead of replacing them. Pair it with Radar or WooPayments, not instead of them.

How ChargeWarden adds checkout-side fraud prevention#

Try it with simulated attacks on the live demo, and read requirements and features on the product page. On our pricing page on 26 October 2026, ChargeWarden is $129 a month for a single store, $199 for 5 stores and $349 for unlimited stores, billed monthly, with a 14-day store credit return. Pick a plan. If you are weighing a guarantee against prevention, read chargeback protection first.

This guide is general information, not legal or financial advice. Prices and features are from vendors' public pages on 26 October 2026 and change over time; confirm with each vendor. Stripe, PayPal, WooCommerce, Signifyd, Forter, Sift, Riskified, NoFraud, MaxMind, FraudLabs Pro and other names are trademarks of their owners. PluginLoom is not affiliated with or endorsed by any of them.