# WFraud

https://docs.wisecp.com/en/wfraud

Use WFraud to prevent website orders from locally blacklisted customers and apply country and proxy checks during checkout.

## Accessing the Screen

Open **Settings → Fraud Protection → All Modules** and click **Configure** on the WFraud card. Address: `{admin}/module/fraud?module=WFraud`.

## Screen Overview

- **Configuration**: Module status and three independent order-blocking checks.
- **Records**: WFraud refusals with customer, reason, IP address and date.
- **Blocked IP Addresses**: The system's shared IP block list, including its source, reason and creation time.

### Preparing the Checks

WFraud is built into WISECP and has no account, API key or risk-score field on this screen. Its customer blacklist check uses the current system's customer record. It does not query a shared customer blacklist across WISECP systems.

Country and proxy checks depend on your configured IP information service and available lookup allowance. Review **Settings → Security → Authentication → Country Rules → Proxy Block Scope** for the countries affected by proxy rejection. That scope alone does not enable WFraud's proxy check.

### Understanding the Order Scope

During website checkout, active fraud modules inspect the attempt before order creation. WFraud checks the local blacklist, country mismatch and proxy rules in that order, stopping at its first refusal. A customer receives the refusal reason; the attempt does not create an order.

Guests have no existing customer blacklist flag. Their available billing and IP information can still be checked. These rules do not rescore earlier orders, cancel paid services or provide automatic product setup. There is no server mapping, catalog import or scheduled blacklist synchronization.

## Configuration Fields

- **Status**: Select Enable to edit the rules and include WFraud in checkout. Check the saved status; disabling the module skips all three checks.
- **Order Blocking**: Off by default. Refuses purchases by customers marked as blacklisted in this system. It does not create blacklist entries.
- **Reject Country Mismatch**: Off by default. Blocks when the known IP country differs from the billing country. Missing country information does not count as a mismatch.
- **Block Proxy/VPN Use**: Off by default. Refuses a positive proxy/VPN result within the configured Proxy Block Scope.

## Tasks

### Saving the Checks

1. Open **Configuration → Status** and select **Enable**.
2. Choose **Order Blocking**, **Reject Country Mismatch** or **Block Proxy/VPN Use** as needed.
3. Click **Save Changes** below the form. Reopen the module and confirm the saved options.

Saving does not run a checkout test or prove that IP information is available. There is no connection-test button or sandbox selector. Verify behavior only within an agreed test scenario; IP lookups may consume the selected service's allowance.

### Reviewing Detection Records

1. Open **Records** and search by customer, IP address or reason.
2. Compare the record's date and reason with the reported checkout refusal.
3. Check the responsible rule and the customer's local blacklist state before deciding whether a correction is needed.

The **Clear Logs** action on this tab currently leaves detection records in place. A success message does not confirm deletion.

### Reviewing Blocked IP Addresses

Open **Blocked IP Addresses** and search the shared list. Each row shows the IP, source, reason and creation time. The right-facing chevron opens IP details; this lookup can contact the configured IP information service.

The **Clear Logs** button below this list opens a confirmation window. Confirming removes the shared IP blocks, including entries created outside WFraud. Review the complete list before considering that action. It does not clear customer blacklist flags or the separate detection records.

## Important Notes

> **Shared IP Protection**
> 
> IP-list cleanup can restore site access for blocked addresses. A WFraud checkout refusal does not automatically add an IP to this list. A detection record and a site-wide IP block are different controls.

> **Coverage Limits**
> 
> Unavailable location data cannot prove a country mismatch. WFraud has no Block When the Service Is Unreachable option. Client API and administrator-created orders do not share this website checkout check.

## Required Permissions

Requires **SETTINGS_FRAUD_PROTECTION**. Viewing the administrator linked as an IP-block source also requires **ADMIN_SHOW**.

## Related Articles

- [Fraud](https://docs.wisecp.com/en/fraud-modules)
- [FraudLabs Pro](https://docs.wisecp.com/en/fraudlabs-pro)
- [MaxMind](https://docs.wisecp.com/en/maxmind)
- [Authentication Security](https://docs.wisecp.com/en/authentication-security)