Avoiding fraud: Keeping Stripe payments for new customers uncaptured until their orders are accepted

[RS 🏴]

Hi folks,

In the past day we've received a flood of new domain registration attempts from a 'new client', a few of which made it through, meaning we've had to eat the Stripe fee and the domain cancellation fee. In order to mitigate this we're playing whack-a-mole with the IPs they're using and we've disabled auto-registration for all of our domain extensions. This stops us from having to pay the domain cancellation fees but as far as I can see when a client checks out the payment is captured there and then, meaning we're getting the Stripe fees regardless.

I'm not seeing a setting where we can have the payment be authorised only until we're ready to accept the order. Does anyone know how we might achieve this?

Much appreciated 🙂

Cheers,
RS

[WHMCS JoshQ]

Hi @RS 🏴,

The best way to set something like this up would be configure one of our built-in Fraud Modules:
https://docs.whmcs.com/Fraud_Protection

When a customer places an order and this order is detected as being fraudulent, the customer will be displayed a message like this one after completing the checkout process but before they are sent to the payment gateway to complete payment. Additionally, no email will be dispatched to the customer.

On the basis that this can be achieved by using our Fraud Modules, we wouldn't also add this functionality to Gateway Modules. Once you have verified the legitimacy of the order, you can release it.

Hope this makes sense. 🙂

Any further questions, feel free to ask!

[RS 🏴]

Hi @WHMCS JoshQ,

In this instance the issue is with the orders which weren't caught as fraudulent (for whatever reason), so being able to examine each order as they come in, prior to payment capture would be really advantageous.

Cheers,
RS

[WHMCS JoshQ]

Hi @RS 🏴,

My recommendation would be to harden your Fraud Module settings, in that case. Instructions for doing so can be found within the specific module's documentation:

• MaxMind
• FraudLabs Pro

It would be possible to delay payment capture (or more realistically, invoice generation) until after the Order Status gets set to Active through the creation of some action hooks, as is elluded to in this thread:

However, please note that this is not how WHMCS  is designed to operate, and this would be heavily modifying WHMCS' order flow. It wouldn't be an easy implementation. That said, some lovely people in the Dev Corner might be able to get you setup,.

[Mark NL]

We are also seeing a flood of new domain registration attempts.  We have also temporary suspended all automatic orders.