DEV3 AI Order Fraud & Risk Scoring for WooCommerce

WooCommerce plugin: every order gets a 0–100 risk score where each point has a plain-language reason. Risky orders are held after payment for a person to review, and the Google Gemini API adds an optional second opinion that never changes an order by itself. Free download: sign in and click Download ZIP. Add your own Google AI Studio (Gemini) API key to switch on the AI features; the documentation says which features work without one.

How it works

We built DEV3 AI Order Fraud & Risk Scoring as a WooCommerce plugin in PHP with a React admin. The scoring is rule-based and works with no API key; the AI is a reviewer's assistant on top.

Key design decisions

• Every point has a sentence. 16 built-in signals (IP and email velocity, failed payment attempts, billing/shipping mismatch, IP country, IP-to-billing distance, disposable email, high-risk countries and products, bulk quantity, high value against the store's average order, first order, problem history, trusted customer, gateway risk) each return points and a plain sentence such as "4 failed or declined payment attempts from this email or IP in the last 24 hours". The total is clamped to 0–100.
• Score at checkout, act when paid. The order is scored as soon as it is created, but holds and cancels are applied only on woocommerce_payment_complete or the first move to Processing or Completed. A pending order is never touched, so the gateway can always finish.
• Escalate only, once, and humans win. A later signal such as a Stripe Radar outcome can raise the action on a paid order but never lower it. Once a reviewer has approved, cancelled or marked an order as fraud, automation leaves it alone.
• Cancel is off by default. Cancel-level orders are held instead, and if auto-hold is switched off they are only queued. Orders created by staff or imports are scored but never held automatically.
• Gateway outcomes surfaced. Stripe Radar risk level, risk score, outcome type and CVC/address checks are read from the WooCommerce Stripe Gateway response; WooPayments fraud outcomes from order meta; any other gateway through a filter.
• AI as advice, minimised. The second opinion receives countries, totals, product categories, signal counts and the email domain, never the name, street, phone or full email. It returns a verdict, confidence, reasons, checks before shipping and a suggested action; Use suggestion only pre-selects a decision the reviewer still confirms. A tuning advisor proposes new points and thresholds from aggregated review outcomes, shown as a draft.

Architecture

Scores, list entries and events live in three custom tables; orders are read and written only through WooCommerce CRUD, so the plugin is HPOS-compatible and was tested on both order storages. Velocity counts come from the plugin's own score and event tables, with emails stored as keyed HMAC hashes and IP addresses removed after a retention period (default 180 days). Allow and block lists support email, email domain, IP or CIDR range, phone and customer, with CSV import and export. An optional checkout guard stops block-listed customers and per-IP order floods in both the classic and the block checkout. A risk column on the orders list, a "Fraud risk" box on the order screen, email alerts and a neutral thank-you notice for held orders complete the WooCommerce side. A background back-scan scores past orders without changing their status. The API client, settings, jobs and usage logging come from a shared core used across DEV3's plugins.

What's in the download

• The installable plugin zip: upload it through Plugins → Add New → Upload Plugin.
• Full HTML documentation (installation, settings, hooks, FAQ).

Requirements

• WordPress 6.0 or newer and PHP 7.4 or newer
• WooCommerce 8.0 or newer, active (HPOS and legacy order storage, classic and block checkout are all supported)
• Optional: a Google Gemini API key for DEV3 AI second opinions and rule tuning. Without one, scoring, holds, the review queue, lists, alerts and the checkout guard all work on rules
• Optional: the WooCommerce Stripe Gateway or WooPayments, whose fraud results are read automatically

Learn more

• How we built it: the AI Order Fraud & Risk Scoring case study
• Engineering write-up on the DEV3 blog
• Also free in the DEV3 AI WooCommerce Plugins Bundle with every other WooCommerce plugin.