=== IronPhantom for WooCommerce – Shield Against Spam, Bots, Card Testing & Chargebacks === Contributors: izioh1979 Tags: antifraud, card testing, woocommerce, fraud detection, chargeback Requires at least: 6.1 Tested up to: 7.1 Requires PHP: 7.4 Stable tag: 1.1.3 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html WC requires at least: 7.0 WC tested up to: 10.1 Don't lose money to checkout bots. Spot card testing and review suspicious WooCommerce orders before you ship. == Description == **Spot card testing, checkout bots, and suspicious orders on your WooCommerce store.** IronPhantom Fraud Defense helps you detect automated checkout abuse and see why an order was flagged, so you can review it before you ship. = Are You Seeing Signs of Card Testing on Your WooCommerce Store? = Fraudsters use stolen card details and automated scripts to check whether cards are still active. On a WooCommerce store, that activity can show up as: * Bursts of failed payments in your payment gateway * Repeated low-value checkout attempts in a short period * Similar checkout activity coming from multiple IP addresses If a fraudulent order goes through, you may only find out after shipping, when a chargeback arrives. IronPhantom helps you review the signals behind suspicious checkout activity while you can still decide what to do with the order. = How IronPhantom Detects Checkout Abuse = IronPhantom is a behavioral threat intelligence and fraud analysis platform. It combines several types of risk signals to help you spot suspicious activity: * **Card Testing & Checkout Analysis** — Flags unusual checkout activity and patterns consistent with card testing. * **Behavioral Bot Detection** — Looks for signs of browser automation and synthetic interactions through the optional Behavioral AI Sensor. * **IP & Proxy Intelligence** — Flags high-risk IP addresses and signals associated with VPNs, proxies, and Tor. * **Credential Risk Intelligence** — Checks whether an email address has appeared in known data breaches and combines that information with other risk signals. * **Browser & Session Analysis** — Looks for inconsistencies in browser and session signals that may indicate automated activity. = Review Suspicious Orders in WooCommerce = See the risk assessment and the reasons behind it directly in your WordPress admin. When an order is flagged, you can review the signals, verify the order with the customer, or hold fulfillment while you investigate. You decide how to handle each flagged order. = How the WooCommerce Integration Works = **WooCommerce is required.** The connector collects risk signals and displays the results in WordPress. IronPhantom's independent backend handles signal correlation and fraud analysis. == Installation == 1. Install and activate IronPhantom Fraud Defense from the WordPress Plugins menu. 2. Review and accept the Privacy Policy and Terms of Use. 3. Complete the setup wizard to generate the store's API key and connect to MGFirewallAI. 4. Open the IronPhantom dashboard from the WordPress administration sidebar. 5. Configure optional features as needed. WooCommerce must be installed and active. == Frequently Asked Questions == = How can I spot card testing in WooCommerce? = Repeated low-value payment attempts or a sudden spike in declined payments can be signs of card testing. IronPhantom combines checkout, network, and, when enabled, behavioral signals to flag suspicious activity. You can see why an order was flagged in your WordPress admin and decide whether to verify it or hold fulfillment. = Does IronPhantom automatically block checkout or make decisions about orders? = No. In its current configuration, IronPhantom does not automatically block checkout, interrupt payments, cancel orders, issue refunds, or stop shipments. It provides risk indicators and decision-support information. Merchants remain responsible for deciding whether to approve, review, verify, hold, cancel, refund, or fulfill an order. Risk assessments do not guarantee that an order is fraudulent or safe. = What does the Behavioral AI Sensor do? = The optional Behavioral AI Sensor analyzes interaction patterns such as mouse movements, scrolling behavior, click timing, session duration, and technical browser signals. These indicators help identify patterns potentially associated with bots, automated checkout abuse, credential stuffing, and suspicious sessions. The sensor is disabled by default and must be manually enabled by the merchant after reviewing the relevant privacy information. It is not intended to record payment card numbers, CVV codes, plaintext passwords, or private form contents. = What data does IronPhantom process, and are external services involved? = After the merchant accepts the required privacy information and activates the service, IronPhantom connects to the MGFirewallAI backend for fraud risk analysis. Depending on the configuration, processed data may include order references, email addresses or pseudonymized identifiers, IP addresses, order amounts, timestamps, browser information, session metadata, and optional behavioral signals. IronPhantom does not collect or store full payment card numbers, CVV codes, plaintext passwords, or banking credentials. The service uses MGFirewallAI (https://redflagai.tech) to analyze fraud signals and return risk information to WooCommerce. Depending on the enabled features, risk analysis may involve external intelligence providers including: * FraudLabs Pro (https://www.fraudlabspro.com) for fraud risk intelligence. * ProxyCheck (https://proxycheck.io) for IP, VPN, and proxy intelligence. * Have I Been Pwned (https://haveibeenpwned.com) for credential exposure intelligence. For details about data processing, service conditions, and applicable privacy practices, see the IronPhantom Privacy Policy and Terms of Use linked below. = How does identity verification through Didit work? = Where available, IronPhantom supports identity verification through Didit (https://didit.me) for high-risk transactions or high-value orders. Verification is performed externally by Didit when the merchant initiates the verification workflow. IronPhantom receives only the limited verification result or status required to support the merchant's decision. IronPhantom does not store identity document images, biometric data, facial recognition data, or government identification files. The Verify User feature is available during the 5-day Pro trial and with an active Pro subscription, subject to the current service configuration. = Is IronPhantom free, and where can I find additional information? = IronPhantom is currently available for testing and evaluation without payment where access is provided. A 5-day Pro trial may be available to evaluate selected advanced features. Feature availability depends on the current service configuration. For additional details about privacy, data processing, external services, and service conditions, please refer to: * Privacy Policy: https://redflagai.tech/privacy-policy * Terms of Use: https://redflagai.tech/terms-of-use.html == Changelog == = 1.1.3 = * Added Bot Analysis enhancements for behavioral monitoring. * Improved PRO bot mitigation status reporting. * Improved Verify User functionality and range selection. * Refined dashboard layout and responsive presentation. * General stability and interface improvements.