VIP Bypass
VIP Customer Bypass is the setting that prevents your established, trusted customers from being caught by Card-Testing Defense velocity rules. It’s on by default. This page explains exactly which customers the bypass protects, when it applies, and when (rarely) you might want to turn it off.
Despite the name, the bypass is not limited to customers literally in the VIP segment. It protects any proven repeat customer who isn’t already showing risk — so the protection is broader than the label suggests.
Who the Bypass Protects #
At checkout time, TrustLens looks up the customer by their billing email (this works for both logged-in users and guests whose email matches an existing customer record). A customer is bypassed only when all of the following are true:
- The bypass setting is on (the default).
- They have at least the minimum-orders threshold of completed orders — the same Full-confidence Order Threshold used for scoring (Settings → General, default 3). A single completed order is deliberately not enough, so a fraud actor can’t earn permanent immunity by completing one order.
- Their segment is not Risk or Critical. A chargeback-prone or high-risk repeat customer never bypasses card-testing defense, regardless of order count.
Customers who aren’t found, who fall below the order threshold, or who sit in the Risk/Critical segments are subject to velocity rules as normal. A submission with no billing email can’t be matched to a customer, so it’s never bypassed.
Allowlisted customers are always in the VIP segment, so they qualify as soon as they also have at least the minimum number of completed orders. An allowlisted customer with fewer orders than the threshold is not bypassed.
What Bypass Does #
When a bypassed customer submits checkout:
- The velocity thresholds are not checked for their fingerprint
- A lockout already held on their fingerprint is not enforced
- No new lockout or strike is created
- Their checkout continues to the remaining gate rules and the payment gateway
The bypass covers the velocity rule only. It does not skip:
- Panic Freeze — checked before the bypass, so a freeze stops everyone
- The blocked-customer check — a blocked customer is still stopped when Enable Blocking is on
- The Browser Challenge — it has its own exemption for established customers (same rule: minimum orders and not Risk/Critical), except in “Every checkout” mode
The customer’s submissions and any declines are still recorded, so they appear in the 24-hour figures.
Why Bypass Exists #
The bypass solves a specific class of false positive: legitimate repeat customers producing high checkout velocity for innocent reasons. Common scenarios:
- A regular placing several orders in quick succession (gift-giving, bulk restocking)
- A corporate card that requires multiple validation attempts
- A customer trying several cards until one works
- A customer returning after a typo’d email or expired session and retrying checkout
Without the bypass, any of these could trip the velocity threshold and produce a lockout error message on a customer who is, by definition, the kind of customer you want to keep.
When to Turn Bypass Off #
Bypass is a tradeoff between false-positive prevention and defense coverage. Turn it off if:
- You suspect a customer account has been compromised. An attacker who checks out with a qualifying customer’s billing email would bypass the velocity rule.
- You’ve allowlisted very broadly. Allowlisted customers sit in the VIP segment, so a large allowlist widens the bypass.
- You’re under active attack and uncertain about customer integrity. Temporarily disable bypass during the incident.
For most stores, the default of “on” is the right choice. The bypass is most valuable when you have many repeat customers and active velocity protection.
Bypass vs Allowlist #
These are different concepts that work together:
| Mechanism | Effect |
|---|---|
| Customer allowlist | Locks the customer’s score at 100 in the VIP segment and stops them being blocked at checkout |
| VIP Bypass (system-wide) | Skips the Card-Testing velocity rule for established customers (≥ minimum orders, not Risk/Critical) |
| Card-testing allowlists (Pro) | Skip every gate rule — including Panic Freeze — for listed fingerprints and IP ranges |
Allowlisting puts a customer into VIP; the bypass then skips them past the velocity rule once they have enough completed orders. Disabling bypass doesn’t affect their allowlist status — they’re still segment-VIP, just subject to velocity rules.
Configuration #
Settings: TrustLens → Card-Testing Defense, in the Detection Settings card.
| Setting | Default | Description |
|---|---|---|
| VIP customer bypass | On | Skip velocity checks for established customers (≥ minimum orders) who aren’t in the Risk or Critical segments |
Changes take effect immediately on the next checkout request.
Bypass and Panic Freeze #
VIP bypass does not apply during a Panic Freeze. The freeze is checked before the bypass, so while it’s active every shopper — including your best customers — sees “Checkout is temporarily paused.” Keep freezes short for that reason.
Traffic that must keep flowing during a freeze, such as a test device or an integration partner, belongs on the Pro fingerprint or IP allowlist, which bypasses the freeze.
How to Verify Bypass Is Working #
Quick sanity check:
- Use an established customer that qualifies for the bypass (3+ completed orders, not Risk/Critical)
- Have them attempt several checkouts in quick succession with a card that intentionally declines (e.g. a card with insufficient funds)
- Confirm they can keep trying past 3 declines in 60 seconds without seeing “Too many attempts”
- For comparison, repeat with a customer that doesn’t qualify — confirm the lockout triggers once 3 declines accumulate
Remember that users who can manage WooCommerce skip the gate entirely, so test while logged out or as a customer account.
Reading Bypass Activity #
TrustLens doesn’t record bypass decisions separately: there is no count of bypassed attempts and no list of customers who used the bypass. Bypassed customers’ submissions and declines still appear in the 24-hour figures on the Card-Testing Defense page and, on Pro, in the 24-hour intelligence card and its CSV export.
If you suspect the bypass is hiding a problem — a qualifying customer producing many declines — temporarily turn it off and watch whether that customer’s device appears in the Targeted now list.
Updated on October 18, 2026
