Most WooCommerce fraud doesn’t look like fraud. It looks like a customer. The shopper who returns nearly everything they buy. The “new” account that shares a shipping address with three others you already flagged. The checkout that’s quietly taking dozens of declined cards in a row. None of that tri
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.4 and PHP 7.4.
SourceWordPress plugins · Nov 14, 2026
01 / Source details
Aboutthistool.
Most WooCommerce fraud doesn’t look like fraud. It looks like a customer. The shopper who returns nearly everything they buy. The “new” account that shares a shipping address with three others you already flagged. The checkout that’s quietly taking dozens of declined cards in a row. None of that trips a payment gateway’s per-transaction check — because each individual charge looks fine. It’s the pattern across orders that gives it away, and that’s the part most stores never see until the chargeback ratio is already climbing.
TrustLens watches that pattern. Here’s a two-minute walkthrough of how it works:
WooCommerce fraud prevention built on customer behavior, not just card checks
TrustLens is a customer trust scoring and fraud detection plugin for WooCommerce . Instead of judging a single transaction, it scores every shopper 0–100 from how they’ve actually behaved on your store — order history, returns, coupon use, disputes — and sorts them into six segments: VIP, Trusted, Normal, Caution, Risk, Critical . Open any customer’s profile and you see exactly which signals moved their score. Nothing is a black box.
How trust scoring works
Every customer starts at a neutral base score of 50. From there, TrustLens’ eight detection modules each contribute signals — positive or negative — based on what that customer has actually done: a high return rate pulls it down, coupon abuse pulls it down, a filed dispute pulls it down further. Customers also earn a small, transparent age bonus as an account passes 90, 180, and 365 days since their first order. Every signal that touched the score — module, points, and a plain-English reason — is listed right on the customer’s profile. Nothing is a mystery number.
The final score is clamped to 0–100 and mapped into one of six segments:
VIP (90+) — your best customers
Trusted (70+) — solid history, low risk
Normal (50+) — the default for new or unremarkable accounts
Caution (30+) — some signals worth watching
Risk (10+) — meaningful abuse or dispute signals present
Critical (0+) — the strongest risk signals TrustLens tracks
These segment cutoffs are defaults; developers can change them with the trustlens/segment_thresholds filter. Module thresholds, such as the return-rate levels, are adjustable in Settings, because a 40% return rate might be alarming for one store and unremarkable for another. For the full mechanics, see the customer risk scoring guide and the segments explained guide.
Eight detection modules, working in the background
Return abuse. Tracks refund rate, refund value, and refund frequency over time rather than judging any single return in isolation. A customer who returns one order out of twelve looks very different from one who returns three out of four.
Order patterns. Watches velocity and behavior across a customer’s order history — a signal that’s invisible when you’re looking at orders one at a time in the WooCommerce admin, but obvious once it’s plotted against everyone else’s normal buying pattern.
Coupon abuse. Catches the two most common ways discount codes get exploited: a “new customer” welcome code used repeatedly from accounts that are really the same person, and coupon codes applied in patterns that don’t match organic use.
Category-aware risk. Return behavior means something different depending on what’s being returned — a high return rate on apparel is often just sizing, while the same rate on electronics or consumables is a different story. This module scores returns in the context of the product category rather than one blanket rule for the whole catalog.
Linked accounts. Builds fingerprints from shipping address, billing address, phone number, IP address, payment method, and device user agent, then flags when multiple customer “accounts” share enough signals to plausibly be the same person or fraud ring behind separate identities. This is how TrustLens catches someone opening five accounts to claim five first-order discounts.
Shipping anomalies. Flags address-hopping and reshipping patterns associated with stolen-card fraud — an order pattern that looks like it’s testing which shipping addresses a stolen card will get through on.
Chargeback tracking. Automatically ingests disputes from Stripe and WooPayments the moment they’re filed, keeps a running per-customer dispute count, and feeds that history into the trust score, so a customer with two prior disputes isn’t treated the same as a first-time buyer.
Card-testing defense. Real-time protection against bots that probe your checkout with a rapid burst of small, mostly-declined charges to find out which stolen card numbers are still live. A one-click Panic Freeze button lets you lock down checkout instantly if you spot an attack your automatic thresholds haven’t caught yet.
Card-testing attacks: what they are and why they cost more than the declines
A card-testing attack isn’t someone trying to buy from you — it’s a bot using your checkout to validate a batch of stolen card numbers before using them elsewhere, firing small charges that just want a “declined” or “approved” answer. Most fail, so the pile of declined orders looks harmless. The real cost shows up sideways: gateway fees on every attempt, a higher fraud score with your payment provider, and — if even a handful of those cards are live — chargebacks landing weeks later with your store’s name on them.
TrustLens watches decline velocity per device in real time, matching on both the browser fingerprint and a server-side fingerprint (IP and user agent) so a bot can’t dodge detection by rotating its browser signature. When a device crosses your threshold, it’s locked out of checkout automatically — before the attack reaches your gateway, runs up fees, or produces a chargeback down the line. VIP Customer Bypass is on by default, so real repeat customers are never caught in a velocity rule meant for bots. Full mechanics are in the card-testing defense docs .
The Command Center dashboard
One screen shows your store’s health score, trust-score trends, the six-segment distribution, your high-risk list, and a chargeback-ratio alert that appears the moment your ratio crosses a Visa, Mastercard, Amex, or Discover monitoring line.
Chargebacks: seeing the ratio before the card networks do
Visa, Mastercard, Amex, and Discover each run monitoring programs that watch your chargeback ratio — disputes as a percentage of transactions — and enroll merchants who cross a threshold into a program with extra fees, extra scrutiny, and in bad cases the threat of losing processing entirely. Most merchants only learn the exact numbers when their processor emails them: Visa’s VAMP marks a merchant Excessive at 1.5% in the US, Canada, Europe, Asia Pacific and Latin America (2.2% in CEMEA) and counts fraud reports as well as disputes, Mastercard’s ECP starts at 1.5%, and Amex and Discover’s excessive-dispute programs at 1.0%.
TrustLens captures the card brand on every Stripe and WooPayments order and tracks how many end up disputed. The free dashboard alerts you as soon as your monthly ratio crosses one of those lines; Pro’s Chargeback Monitor shows the ratio for each network against its line, and how far you are from the nearest one, before you get there. The point isn’t to replace your processor’s own monitoring; it’s to give you the same number they’re watching. Visa’s VAMP ratio also counts fraud reports that never reach WooCommerce, so treat the Visa figure as a floor. See the chargeback tracking guide for the full picture.
How TrustLens compares
Your payment gateway scores the transaction — the charge itself, at the moment it happens. It’s genuinely good at catching an obviously stolen card, but has no memory of what that customer did last month and no way to connect two “different” accounts placing suspiciously similar orders. TrustLens scores the customer, over time, using exactly the signals a per-transaction check can’t see.
A simple IP blocklist stops a known-bad address and nothing else — it doesn’t adapt when someone switches networks, doesn’t know a “new” account is really a repeat offender, and does nothing for friendly-fraud chargebacks or return abuse, since those orders come from real cards on real networks. See the IP blocking vs. behavioral fraud scoring comparison for where each approach holds up and where it doesn’t.
For specific alternatives, see FraudLabs Pro vs. TrustLens and TrustLens vs. WooCommerce’s built-in anti-fraud tools .
Meet the customers TrustLens catches
The serial returner — sends back a third or more of what they buy; no single return looks wrong, the pattern across a dozen orders does (Return Abuse + Category-Aware Risk).
The coupon farmer — a “new” account every few weeks for the same first-order discount, connected by Linked Accounts and flagged by Coupon Abuse.
The fraud ring — one billing address, payment method, or device spread across several names, surfaced automatically by Linked Accounts.
The card-testing bot — dozens of small, mostly-declined charges hunting for live stolen cards; Card-Testing Defense locks it out before it reaches your gateway.
Integrations and compatibility
TrustLens sits inside the store you already run. Stripe and WooPayments disputes are ingested automatically — no webhook setup required; other gateways (PayPal, Square, offline) use a manual chargeback form on the order screen. Both Classic and WooCommerce Blocks checkout are enforced, so a blocked customer is blocked either way. TrustLens declares full WooCommerce HPOS compatibility, supports GDPR data export and erasure via standard WordPress privacy tools, and includes a REST API for looking up customers, scores, and segments, and for triggering recalculations. Pro adds signed webhooks for pushing trust events to Slack, Zapier, or your own tools — see the webhooks and REST API integration guide .
Already have order history? Historical Sync builds trust profiles from your existing orders in small background batches, so you’re not starting from a blank slate. Details in the Historical
See it in action
Screenshots & previews.
Command Center Dashboard — Health score, KPI cards, trust-score trends, and the six-segment distribution at a glanceCard-Testing Defense — Real-time decline-velocity monitoring, attacker fingerprints, one-click Panic Freeze, and the recent-attack feedCustomer List — Searchable, sortable list with segment badges, trust scores, return rates, and bulk actionsCustomer Detail — Full profile with the trust-score gauge, signal impact, return-rate trend, and linked accountsOrder Integration — Customer trust score, segment, and dispute status shown right on the WooCommerce order edit screenSettings — Detection modules and scoring thresholds, with checkout-blocking and notification controls
02 / Source details
Gettingstarted.
01Install TrustLens directly from the WordPress plugin repository, or upload the trustlens folder to /wp-content/plugins/
02Activate the plugin through the Plugins menu — TrustLens checks for WooCommerce automatically
03Open TrustLens → Dashboard to see the Command Center
04Click Run Historical Sync to build trust profiles from your existing WooCommerce orders — the sync runs in small batches from your browser, so keep the page open until it finishes; it does not affect site performance
05Visit TrustLens → Settings to adjust scoring thresholds, checkout blocking, and notification preferences
What works out of the box:
06All 8 detection modules are enabled by default
07Card-Testing Defense ships enabled with sensible thresholds — no configuration required to start blocking stolen-card attacks
08VIP Customer Bypass is on, so repeat buyers are never disrupted by velocity rules
09Chargeback tracking is active for Stripe and WooPayments — disputes ingest automatically
10TrustLens does not auto-block any customer in Free until you explicitly choose to
If you use Stripe or WooPayments, no extra setup is required for chargeback and card-brand capture. Other gateways can be tracked through the manual chargeback entry form on the order edit page.
03 / Source details
Frequently asked questions.
How is TrustLens different from my payment gateway’s fraud tools?
Your payment gateway (Stripe Radar and similar) scores a single transaction at the moment of charge — card, IP, AVS, device — and is blind to what happens before and after on your store. TrustLens scores the customer’s behavior over time : refund and return patterns, coupon abuse, multi-account links, dispute history, category-specific returns, and card-testing activity at checkout. Those are signals your gateway never sees.
They’re complementary, not competing. Your gateway blocks obvious stolen-card charges; TrustLens surfaces friendly-fraud chargebacks, serial returners, coupon abusers, fraud rings, and card-testing bots that slip past a per-transaction view — and it keeps you in control (the free version never auto-blocks; you decide). Everything runs inside your own store, so no customer data leaves your site.
Does TrustLens work with guest checkout?
Yes. Customers are identified by a hash of their email address, so guest and registered customers are tracked equally. If a guest later registers, their history carries over.
Will TrustLens automatically block customers?
By default, no. The free version is manual: it surfaces customer risk data, and you decide when to block or allowlist someone. Pro can optionally automate specific actions, including alerts, order holds, verification requirements, and customer blocking if you configure automation rules or chargeback auto-blocking.
How does linked accounts detection work?
TrustLens creates fingerprints from shipping addresses, billing addresses, phone numbers, IP addresses, payment methods, and device user agents. When multiple customer accounts share fingerprints, they are flagged as linked. This helps detect multi-account abuse like repeated first-order discounts.
Can TrustLens help reduce return abuse and refund abuse in WooCommerce?
Yes. TrustLens tracks refund rate, refund value, refund frequency, category-specific return behavior, and related customer patterns over time. This helps you spot serial returners and high-risk refund behavior earlier instead of reviewing refunds one order at a time.
Can TrustLens help with chargebacks and disputes?
Yes — and the core chargeback tracking is in the free version. TrustLens automatically ingests disputes from Stripe and WooPayments, accepts manual entry for other gateways (PayPal, Square, offline), keeps per-customer dispute counters, and feeds dispute history into trust scores. The free dashboard also alerts you when your chargeback ratio crosses a Visa, Mastercard, Amex, or Discover monitoring line.
Pro adds a dedicated Advanced Chargeback Monitor with per-brand breakdown (Visa VAMP, Mastercard ECP, Amex, Discover), 12-month trend, trailing-30-day window, daily ratio email alerts, a one-click Dispute Evidence Report for processor responses, and auto-block after N lost disputes.
How does the Chargeback Ratio Monitor work?
TrustLens captures the card brand on every Stripe and WooPayments paid order and tracks how many of those orders end up as disputes. Your monthly chargeback ratio is checked against the Visa VAMP, Mastercard ECP, Amex, and Discover monitoring lines, and the free dashboard alerts you once a line is crossed. Pro shows the ratio for each brand against its line and how close you are to the nearest one — so you can see enrollment coming before it happens — plus the 12-month trend chart, the trailing-30-day window, and daily email alerts. Visa’s VAMP ratio also counts fraud reports that never reach WooCommerce, so treat the Visa figure as a floor.
What is Card-Testing Defense?
Card-Testing Defense (free) is real-time protection against stolen-card attack bots that probe your checkout with thousands of declined payment attempts. TrustLens watches per-device declines and checkout submissions over a 60-second window and declines over a 1-hour window, matching on both the browser fingerprint and a server-side fingerprint (IP and user agent) so bots can’t slip through by rotating their browser fingerprint. When a device crosses a threshold it’s locked out of checkout — 90 seconds the first time, then 15 minutes, 1 hour and 24 hours for repeat offenders — blocking the attack before it reaches your payment gateway and runs up gateway fees, fraud fees, and downstream chargebacks.
VIP Customer Bypass is enabled by default, so established customers — those who meet your minimum-order threshold (default 3 completed orders) and aren’t already in a Risk or Critical segment — are never blocked by velocity rules. A one-click Panic Freeze button halts all checkouts for 15 minutes during an active attack your thresholds haven’t caught.
Pro adds auto-escalation, a geographic-diversity safeguard so flash-sale traffic isn’t mistaken for an attack, fingerprint and IP CIDR allowlists, attack analytics with CSV export, and Slack alerts.
Can I automate actions based on customer risk?
Yes, with Pro. Automation Rules let you build trigger-based rules that fire when customer risk changes, orders are placed, refunds are processed, disputes are filed, linked accounts are detected, card-testing attacks happen, or shipping anomalies are spotted. Each rule supports 30+ condition fields and actions like block customer, hold order, send email, fire webhook, allowlist customer, cancel order, or tag customer.
Pro automation also includes a save-time validator that blocks rules that can never fire, an inline inspector that shows exactly why each rule fired or didn’t, and async HMAC-SHA256-signed webhooks with automatic retry.
What happens when I block a customer?
Blocked customers see a customizable message when they try to add items to their cart or proceed to checkout. The block applies to both logged-in users and guest checkouts matching the blocked email. All blocked checkout attempts are logged.
Can I undo a block?
Yes. You can unblock a customer at any time from their profile page or the customer list. You can also add customers to the allowlist, which locks their score at 100 and prevents any negative signals from affecting them.
What happens right after I install TrustLens?
New WooCommerce orders are analyzed automatically after activation. If you already have historical orders, you can run Historical Sync from the dashboard to build trust profiles from your existing store data without slowing down the frontend.
Does this slow down my store?
No. Score calculations run asynchronously via Action Scheduler (the same system WooCommerce uses). Checkout blocking uses a lightweight email-hash lookup. The historical sync processes orders in small batches.
Does TrustLens send customer data to an external service?
No customer personal data ever leaves your site. TrustLens works inside your WordPress and WooCommerce installation. The only default external call is the optional Pro report-verification feature, which (while enabled) sends a non-personal, one-way fingerprint of a dispute report to the TrustLens verification service so issuers can confirm it is genuine — never customer data, and it can be disabled. All other external delivery (webhooks, email notifications) happens only if you configure it.
Is TrustLens compatible with WooCommerce HPOS?
Yes. TrustLens declares full compatibility with High-Performance Order Storage and works with both legacy and HPOS-enabled stores.
Does TrustLens store personal data?
TrustLens stores customer email addresses and behavioral data (order counts, refund counts, trust scores) in custom database tables. Matching identifiers used for linked-account detection are pseudonymized using keyed HMAC-SHA256 hashes, preventing the raw values from being exposed or reused across sites. The plugin integrates with WordPress privacy tools — customers can request data export or erasure through the standard WordPress privacy workflow.
Can I access TrustLens data from external systems?
Yes. TrustLens includes a REST API with 8 endpoints for looking up customers, retrieving scores, filtering by segment, and triggering recalculations. API access requires either the manage_woocommerce capability or a valid API key configured in settings.
Can I get alerts and reports by email?
Yes. The free version includes core email notifications such as blocked checkout alerts, a welcome summary, and a weekly summary. Pro adds advanced alerts, daily digests, monthly revenue protection reports, and scheduled email reports.
What is the minimum data needed for accurate scoring?
By default, most detection modules wait until a customer has 3 completed orders before scoring them. You can adjust this in Settings > General (Full-confidence Order Threshold). Return-risk signals (weighted for the small sample), linked-account matches and the account-age bonus apply earlier, so a new customer’s score — and segment — can move before they reach the threshold.
Does the free version include all detection modules?
Yes. All 8 detection modules ship in the free version — returns, orders, coupons, categories, linked accounts, shipping address anomalies, chargebacks, and card-testing defense. There are no trial limits, no disabled scoring, and no locked modules.
Pro adds automation rules, webhooks, scheduled reports, payment-method risk controls, the advanced per-brand Chargeback Monitor with daily alerts, Card-Testing Defense Pro (auto-escalation + analytics + Slack alerts), and 10 advanced notification types.
What happens if I rotate my WordPress secret keys?
Important: TrustLens uses your WordPress auth secret key (via wp_salt('auth') ) as the HMAC keying material for hashing customer emails and linked-account fingerprints. This is a deliberate security choice — it makes stored hashes non-reversible and non-portable across sites.
The trade-off is that regenerating your WordPress secret keys (whether through a security plugin’s “regenerate keys” tool or by editing wp-config.php directly) will permanently invalidate every customer hash and fingerprint already stored in your TrustLens tables. After rotation, the plugin won’t be able to m
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
