Skip to content

Knowledgebase

Handle a WHMCS order held for fraud review

whmcs, resellers

Fraud screening helps prioritise order review, but an automated score is not a complete decision about a customer. Use a documented review process that checks the actual order and payment while protecting customer information.

01 Configure a supported screening service

  1. Confirm that fraud protection is available for your WHMCS deployment and that you have an appropriate account with the chosen screening provider.
  2. Open System Settings and Fraud Protection. Activate the supported provider and enter its required credentials and rules.
  3. Choose thresholds and actions according to the business's risk policy. Test the integration in a controlled environment before allowing its decisions to affect public orders.
  4. Review product setup timing. Products provisioned immediately on order can create resources before payment review has finished.

Current WHMCS documentation identifies FraudLabs Pro and MaxMind integrations. Retired Validation.com functionality should not be presented as an available verification route.

02 Review a flagged order

Open the order, read the screening result and compare it with the requested service, customer history and payment status. Use proportionate follow-up through the authenticated client account when clarification is needed. Avoid collecting unnecessary identity documents or asking for complete payment-card details through a ticket.

Check whether services or domains were already provisioned before changing the order status. Manual fraud or cancellation actions can terminate active services, and invoice handling differs from simply receiving an automated fraud result. Inspect the resulting invoice ledger rather than assuming every fraud label cancels the invoice.

How should I handle an order incorrectly flagged for fraud?

When the authorised review concludes that the order is legitimate, use the documented return-to-pending process and verify its invoice and service states. Allow payment or provisioning through the intended normal workflow. Do not bypass a provider authentication requirement merely because an order has been approved internally.

Record the reason for approval or rejection, the reviewer and any action taken. Periodically review false positives and missed cases so that thresholds reflect actual operational experience without treating location alone as proof of fraud.

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support