Skip to content

Managing the Blocklist

WooFraudGuard Updated 14 June 2026

The blocklist lets you permanently flag specific emails, IP addresses, phone numbers, billing addresses, card BINs, or device fingerprints. Any order that matches a blocklist entry receives the maximum Blocklist Match contribution (weight 1.0 by default), which is almost always enough to push it above the Cancel threshold.

Blocklist entry types

Type Example value Notes
email fraudster@example.com Exact match against the billing email (case-insensitive).
ip 192.0.2.1 IPv4 or IPv6 address recorded at checkout.
phone +447911123456 Billing phone; normalised before comparison.
address 123 Fake Street Fuzzy-matched against the billing address line.
bin 411111 First 6 digits of the card number (BIN/IIN).
device_hash a3f8… Device fingerprint hash. Copy from the Score detail modal (premium).

Adding an entry manually

  1. Go to WooFraudGuard → Blocklist.
  2. Click Add entry.
  3. Choose the type, enter the value, and optionally add a reason note for your own records.
  4. You can set an expiry date if the block should lift after a specific time (leave blank for permanent).
  5. Click Save.

Automatic blocklisting (premium)

When the Chargeback feedback loop is enabled, WooFraudGuard automatically adds blocklist entries for every identifiable atom from a chargeback order — email, IP, device fingerprint, and card BIN. The entries are created with source = chargeback_auto so you can distinguish them from manual entries.

Searching and removing entries

  • Use the Type dropdown and Search value field to filter down to a specific entry.
  • Click the delete icon on any row to remove the entry immediately.
  • Expired entries remain visible but do not match new orders — you can delete them to keep the list tidy.

Tips

  • After a confirmed chargeback, manually add the billing email and IP before the chargeback feedback loop is enabled — you get immediate protection without waiting for the next webhook event.
  • BIN blocks are broad — they affect everyone who holds a card from that issuing bank. Use them sparingly and with a short expiry.
  • Device fingerprint blocks are precise and low-risk to add. They target the browser/device profile, not the identity, so a fraudster switching emails is still caught.
Was this page helpful?