WooCommerce Fraud Ring Detection: How One Bad Customer Becomes Five
Store Security · TrustLens
The Account That Wasn’t One Person
WooCommerce fraud rings don’t look dramatic at first. They look like a new customer grabbing a welcome discount. This post walks through how a single bad account becomes five, what behavioral signals connect them, and how TrustLens’s linked-account detection uses six fingerprint types to surface the pattern before it becomes expensive.
The most persistent WooCommerce fraud isn’t a stolen card. Stolen cards get caught by payment processors. The fraud that quietly drains stores over months is behavioral — a pattern of repeated, coordinated exploitation by accounts that look like different people but aren’t.
You have a 10% welcome discount for first orders. A customer uses it. Three weeks later, a different email address uses it again. Then another. By the time you notice that four separate “customers” have shipped to the same address and use the same phone number, the discount has been claimed eight times and you’ve shipped eight orders at a margin that only made sense once.
This is a fraud ring — or a precursor to one. It doesn’t require a sophisticated operation. It can be a single person with several email addresses and a willingness to spend twenty minutes setting up accounts. Detecting it requires not looking at customers one at a time, but looking for what they share.
Linked-account abuse is one source of expense; disputes are another, and the accounts in a ring often go on to file chargebacks once the discounted goods are in hand. If your broader concern is the dispute number itself, our guide to the best WooCommerce chargeback prevention plugins covers how behavioral history, ratio monitoring, and dispute evidence work together to reduce them.
How a Fraud Ring Actually Grows in WooCommerce
Understanding the lifecycle matters because it tells you where detection can realistically help.
The starting point is almost always an incentive. A welcome discount, a first-order coupon, a referral reward — anything that gives a new account more value than a returning one. WooCommerce doesn’t have a native way to tie those to a person rather than an email address. An account is just an email. And email addresses are free.
Account one: no red flags
The first account behaves like a legitimate customer. It places an order, uses the welcome discount, and ships to a real address. Nothing unusual. Trust scoring tools often won’t flag this customer at all — they have one order and no behavioral history. This is correct behavior, not a gap. You genuinely don’t know yet.
Account two: the shared signal appears
A second account places an order weeks later. Different email, different name. But the shipping address is the same. Or the phone number is the same. Or the payment method shares a Stripe card fingerprint. At this point, any single shared signal could be coincidence — a household with multiple accounts, a spouse ordering independently. One match doesn’t confirm a pattern. But it does get recorded.
Account three: the pattern becomes statistical
The third account sharing two or more signals with the first is no longer coincidental. A shared shipping address and shared phone number across three accounts has an extremely low probability of being three genuinely independent customers. The behavioral fingerprint is now pointing at one underlying actor — or at most, a small coordinated group.
Account four and five: the cumulative cost becomes visible
By the fourth and fifth accounts, the discount has been claimed multiple times, the shipping destination is the same, and several signal types overlap. The question stops being “is this suspicious?” and becomes “how much has this cost, and what do I do about it?”
Manual detection at this stage is nearly impossible without dedicated tooling. Looking at the WooCommerce customer list, each account appears as a separate row with a different name and email. There is no native view that groups customers by shared shipping address or shared payment fingerprint. You have to already know who to look for before you can find the connection.
The detection window that actually matters
Fraud rings are expensive not because any single order is devastating, but because the pattern repeats across weeks or months before anyone notices. Early detection — at account two or three — changes the math. A flag at account five doesn’t prevent accounts one through four. The goal is shortening the time between first anomaly and first awareness.
What a Ring Costs Beyond the Discounts
The duplicated welcome discount is the visible cost, and it’s the one you can total up once you find the cluster. The quieter costs come from the fact that WooCommerce treats every email address as a separate customer, so a ring distorts much of what you measure and enforce:
- Customer counts inflate and lifetime value deflates. One buyer spread across five accounts looks like five small customers. That changes how you segment them, which campaigns they receive, and which loyalty tier they reach.
- Return rates get diluted. A heavy returner whose refunds are split across several accounts can keep every individual account below the level that would prompt a review. The pattern only appears when the accounts are viewed together — the same blind spot covered in our guide to spotting serial returners.
- Acquisition numbers stop meaning much. When some “new customer” coupon redemptions are existing customers on fresh accounts, the coupon looks like it is acquiring people when it is discounting the same ones again.
- Per-customer limits become per-email limits. Once-per-customer coupons, purchase caps and usage limits are enforced against the account, and accounts are free.
- Blocks don’t stick. Blocking an email blocks one of the person’s accounts. The others keep ordering, so the block looks like enforcement without being it.
- Disputes look unrelated. Chargebacks spread across several accounts read as separate incidents rather than one customer’s pattern.
The Six Fingerprint Signals TrustLens Uses to Connect Accounts
TrustLens’s Linked Accounts Detection module is part of the free version — all eight detection modules are available without a Pro license. The module records six types of behavioral fingerprints from every order and uses them to identify when different customer accounts share identifiable characteristics.
The six signal types, verified against the plugin code in class-linked-accounts.php:
| Signal type | What it captures | Notes |
|---|---|---|
| Shipping address | The full shipping address, normalized and hashed | Normalization expands abbreviations (“st” → “street”) so minor formatting differences don’t create false misses |
| Billing address | The full billing address, normalized and hashed | Tracked separately from shipping so mismatches between the two are also visible |
| Phone number | The billing phone, digits only | Leading country codes stripped; “+1 (555) 555-0100” and “5555550100” produce the same hash |
| IP address | The customer’s IP at checkout | Loopback addresses (127.0.0.1) are excluded. Never links accounts on its own — shared IPs (household, office, mobile carrier, VPN) are too common — but shows as supporting detail next to a stronger match |
| Payment method | Saved payment token ID, Stripe card fingerprint, and/or last-4 card digits | Multiple token identifiers can combine; requires the customer to use a saved payment method or Stripe integration |
| Device (user agent) | The HTTP User-Agent string from the order | A weak signal — many shoppers run identical browsers, and user agents are easy to change — so, like IP, it never links accounts by itself; it adds weight only alongside a stronger match |
When a new order is placed, TrustLens hashes each of these values and stores the hash alongside the customer’s email hash. It then looks for other customer accounts that share any of those fingerprints. Two accounts count as linked only when at least one shared fingerprint is identity-grade — shipping address, billing address, phone, or payment method. Since version 1.3.8, an overlap on IP address or device alone never links accounts or moves a score, because shared networks and common browsers collide across unrelated shoppers. When a link exists, the linked accounts and their count are stored on the customer’s profile.
Within a link, the number and type of shared signals still matter. A link resting on one shared address is far weaker evidence than one where address, phone and payment method all match. The module records which signal types overlapped — including IP and device when they appear next to a strong match — so you can weigh the evidence yourself rather than relying on a black-box verdict. The section on weighing a link below turns that into a practical scale.
The IP address signal requires careful interpretation
An IP address match is significant only when the accounts also share a shipping address, phone number or payment method. On its own, it can easily reflect a household, an office building, a university campus, a mobile carrier, or a shared VPN exit node — which is why TrustLens doesn’t link accounts on an IP or device match alone. Once a link exists, the score penalty depends on how many accounts are linked and how risky they are, not on which signal types matched.
For a deeper look at the coupon abuse patterns that fraud rings typically exploit alongside linked-account detection, see how TrustLens detects WooCommerce coupon abuse before it costs you — the two modules work together to surface the full picture.
HMAC-SHA256 Pseudonymization: What It Means for GDPR
The obvious concern with any fraud detection system that tracks shared shipping addresses and phone numbers is: where does this data go, and who can read it?
TrustLens’s linked-account fingerprints never reach the database as raw values. Before any address, phone number, IP, or payment token is stored, it passes through wstl_hash_personal_value() — a function that computes hash_hmac('sha256', context . '|' . value, wp_salt('auth')). The result is a 64-character hex string with no reversible path back to the original data.
The keying material is your WordPress authentication key, accessed via wp_salt('auth'). This means:
- The hash for “123 Main Street, Springfield” on your store is completely different from the hash for the same address on any other store.
- No one who obtains your database can reconstruct a shipping address from a fingerprint hash.
- TrustLens never sends customer identifiers to an external service. All data stays inside your WordPress installation.
For GDPR purposes, pseudonymized data (data that cannot identify a natural person without additional information held separately) is treated differently from directly identifying data. The fingerprint hashes in the TrustLens database are pseudonymous because the hash-to-original mapping is not stored. If a customer requests erasure, WordPress privacy tools remove the hashes, and there is nothing left to trace back.
One important trade-off: rotating WordPress secret keys
Because the hashing uses your WordPress auth key as keying material, regenerating your WordPress secret keys invalidates every fingerprint and customer hash already stored. After key rotation, TrustLens can no longer match returning customers to their existing profiles. If you need to rotate WordPress secret keys, plan to run Historical Sync afterward to rebuild the customer table with the new keying material. Manually set block/allowlist status on individual customers won’t auto-recover — those need to be re-applied.
For a complete technical walkthrough of the hashing mechanism, the TrustLens linked-account detection and GDPR explainer covers what gets stored, what doesn’t, and how the system stays privacy-compliant without sacrificing detection quality.
How Linked Accounts Move the Trust Score
Detecting a linked account doesn’t automatically tank a customer’s score. TrustLens applies a tiered penalty based on how many linked accounts exist and how risky those linked accounts themselves are.
The base penalty structure, confirmed from the plugin’s add_linked_signal() method:
| Linked account count | Base score penalty |
|---|---|
| 1 or more linked accounts | −5 points |
| 3 or more linked accounts | −10 points |
| 5 or more linked accounts | −15 points |
On top of the base penalty, TrustLens applies an additional configurable penalty (default 5 points) for each linked account that is in the Risk or Critical segment, and double that rate for each linked account that is actively blocked.
So a customer with three linked accounts — one of which is in the Risk segment and one of which is blocked — would receive: base penalty of -10 (three or more linked), plus -5 for the Risk link, plus -10 for the blocked link. A total penalty of -25 from this module alone, without any other behavioral signals firing.
This compound structure matters because it means the first linked account produces a small flag, but a web of connected accounts carrying bad history can push a score into the Caution or Risk segments even before the individual customer has done anything obviously wrong. The contamination is bidirectional: being linked to blocked accounts is itself a risk signal.
Every customer starts at a neutral score of 50. All behavioral modules apply positive or negative adjustments, and the final score is clamped to 0–100. For customers below the full-confidence order threshold (default: 3 orders), most module signals are held back until enough history exists — only the confidence-weighted Returns signal applies — which prevents noisy conclusions from thin data. The linked-account penalty is not held back: it applies from a customer’s first order, which is what lets a fresh email tied to a risky cluster stand out early — and, as the roommate problem section explains, what can nudge a new customer in a shared household into Caution.
What a Flagged Linked-Account Profile Looks Like
When TrustLens detects linked accounts, the connection shows up in two places: the customer’s trust score (the penalty reduces the number) and the customer’s profile page (the linked accounts section lists the connected accounts by email hash, segment, and match types).
The profile view shows you:
- How many accounts are linked and what their segments are
- Which signal types produced the match (shipping address, phone, IP, etc.)
- Each linked account’s trust score, total orders, and whether they are blocked
- The match count per linked account (a match on three signals is stronger evidence than a match on one)
This is deliberately all information, not a verdict. TrustLens surfaces the evidence and leaves the decision to you. A customer linked to a Risk-segment account via shipping address and phone number is worth investigating before blocking. The same link via IP address alone is probably not.
What this looks like in practice
Imagine you run a store with a 15% first-order welcome discount. In TrustLens’s customer list, you notice a customer in the Caution segment with a trust score of 42. You open their profile and see: “Linked to 3 other accounts (1 high-risk, 0 blocked).” The match types show shipping address and phone across all three. One of those linked accounts has a 90% refund rate and is in the Risk segment. The current customer has only placed two orders — within the minimum threshold, so no other module has fired yet. That’s the signal: this account is almost certainly the same person as the high-refund Risk-segment account, just under a different email. You have the picture before account three claims another welcome discount.
If you want to understand how TrustLens’s six risk segments are defined and what each one means operationally, the TrustLens segments explained guide covers the full VIP-through-Critical range, what score thresholds apply, and how the segments should inform your response decisions.
Free vs Pro: Detection vs. Automated Response
Linked Accounts Detection is a free feature. The module runs, the fingerprints are stored, the matches are found, and the score penalty is applied — all without a Pro license. This is true regardless of how many customers you have or how many accounts are linked.
What free detection gives you:
- Real-time fingerprint recording on every new order
- Linked-account matches surfaced on customer profiles
- Trust score adjustments reflecting the linked-account network
- Visibility into which signal types matched
- The linked account count and segment displayed in the customer list
What free detection does not do is act on what it finds. If a customer with six linked accounts — all in the Risk segment — places an order at 2 a.m. on a Saturday, the free version flags them in the dashboard. A notification may fire. But the order goes through. Blocking requires you to be online and checking.
TrustLens Pro adds Automation Rules. These are trigger-based rules that fire when specific conditions are met. The linked_accounts_detected trigger fires each time TrustLens identifies a new linked-account relationship. The linked_accounts condition field — verified from the plugin’s automation class — lets you set a numeric threshold: “if linked account count is greater than 2, block customer.”
Pro Automation Rules also let you combine conditions. A rule that fires when a customer has more than three linked accounts AND has a trust score below 40 AND has used a first-order coupon is a much more precise response than blocking anyone with any linked account. That precision matters for avoiding false positives — households and families share addresses legitimately.
The block_customer, send_email, send_webhook, add_tag, and add_note actions are available in response to a linked-accounts trigger. Order-level actions such as hold_order are not, because a linked-account detection isn’t tied to a single order — the save-time validator rejects that pairing. To hold orders for review, use an order trigger such as order_placed with customer conditions like trust score or segment. Webhooks include an HMAC-SHA256 signature and are delivered asynchronously with automatic retry on failure.
For a complete breakdown of how Pro Automation Rules work — including the save-time validator that prevents rules from being set up in ways that can never fire — see the TrustLens automation rules guide.
The right starting automation for linked accounts
If you are setting up Pro Automation Rules for the first time, start conservative. A rule that tags customers with 3+ linked accounts (rather than blocking them) lets you manually review for a few weeks before escalating to automated blocking. You will quickly learn how many legitimate matches your store generates — families ordering separately, households with shared addresses — versus genuinely suspicious patterns. Once you have a sense of the false-positive rate in your specific context, tighten the threshold or add a trust-score condition. The same “watch before you automate” logic applies to chargeback enforcement: deciding when to let TrustLens auto-block after lost disputes walks through how to set that threshold safely.
Why Customers Create Multiple Accounts
Before deciding what a flag means, it helps to know why linked accounts exist at all. Most fall into one of four motives, and each calls for a different response.
The coupon recycler
The most common case. A welcome code works once per account, so a second email address resets it. Many people who do this don’t think of it as fraud — they found a loophole and used it. The durable fix is usually to the promotion rather than the customer: unique single-use codes, an automatic first-order discount instead of a shareable code, or a reward on the second order rather than the first. Our guide to spotting WooCommerce coupon abuse covers the promotion-side fixes in detail.
The block evader
You blocked an account for serial returns, abuse, or a lost dispute, and a “new” customer appears with the same address and card. This is the most damaging type because it undoes an enforcement decision you already made. It is also where linked-account detection earns its keep: a link to a blocked account adds a double-weight penalty on top of the base one, so the new profile shows up with a reduced score and the blocked account listed on its profile.
The limit circumventer
Per-customer caps — one bundle per account, two units per customer in a flash sale, a once-per-customer coupon — are really per-email caps. Several accounts multiply the allowance. The cost is easy to miss because each individual order respects the rule.
The accidental duplicate
Some customers forget they already have an account, or check out with a different email than the one they registered with. Nothing is being abused; their history is simply split in two. These links often match on every strong signal yet show no coupon or refund pattern, which is exactly why “everything matches” is not, by itself, a reason to act.
The first three motives deserve a response; the fourth is a data-quality issue. The next two sections are about telling them apart.
One Signal vs. Several: Weighing a Link
No single shared identifier proves two accounts belong to one person; several together come close. TrustLens already applies the first half of that rule by refusing to link on IP or device alone. Everything above that floor is for you to weigh.
| What the accounts share | What it usually means | Reasonable response |
|---|---|---|
| One strong signal (shipping address or phone) | Could be a household, roommates, a couple, or a shared workplace delivery address | Note it. Don’t act on the link alone — look at what the accounts do. |
| Two strong signals (address + phone) | Probably the same person or the same household | Review the combined behavior across all the linked accounts. |
| Three or more (address + phone + payment method) | Very likely the same person | Treat the accounts as one customer when you assess risk. |
| Payment method (in any combination) | Rarely shared outside couples or families on one card | Give it more weight than an address match. |
| IP or device next to a strong match | Supporting detail | Adds a little weight; never decisive. |
One caveat on payment methods: the fingerprint is built from the payment details available on the order — a saved token ID, a Stripe card fingerprint, the last four card digits, or a combination of them. If the last four digits are the only detail your gateway records, two unrelated customers can share that value, so weigh such a match like an address rather than a card. The profile view shows the match count and match types for every linked account, so placing a flag on this scale takes seconds.
Acting on a Linked-Account Flag Responsibly
The gap between “this customer has three linked accounts” and “this customer is committing fraud” is real. Not every linked-account flag is abuse. Couples order to the same address. Siblings use the same phone number for their accounts. A small business has employees order on behalf of the company from the same IP. These are false positives, and acting on them carelessly costs you legitimate customers.
A reasonable evaluation process for a linked-account flag looks like this:
Step 1: Check the number and type of signals that match
A link resting on a single shared address or phone number is weak evidence on its own. Two or more strong signals (shipping address and phone, or billing address and payment token) are substantially more meaningful, and IP or device matches alongside them add some weight. Look at what matched, not just that something matched — the scale above is a reasonable guide.
Step 2: Check the risk profile of the linked accounts
A customer linked only to Trusted or Normal segment accounts is a different situation from one linked to accounts in the Risk or Critical segment. If the linked accounts have high refund rates, coupon abuse flags, or are already blocked, that changes the picture significantly.
Step 3: Look at the pattern across the linked accounts
Do the linked accounts all use first-order coupons? Do they all have low order counts and no repeat purchases? Do they all ship to the same address but use different payment methods? A consistent pattern across the linked accounts is much stronger evidence of coordinated behavior than a mix of independent-looking histories.
Step 4: Check whether there is a plausible innocent explanation
A household ordering for a home address is not a fraud ring. If the linked accounts have varied order histories, different product categories, and no pattern of coupon abuse or refund cycling, the odds of a benign explanation are high. Do not block first and investigate later — start with investigation.
Step 5: Act proportionately
Blocking is the most aggressive action available. If you are not confident, start with watching — add a note, tag the customer, or set a Pro automation rule to hold orders for manual review. A held order stays on hold until someone reviews and releases it. A block is permanent until you reverse it manually.
The behavioral picture from the order pattern fraud detection module can also help here — unusual order velocity, high cancellation rates, and consistent buying of specific categories all add context alongside the linked-account signal. When you’re looking at a suspicious cluster of accounts, check whether the individual customer profiles show other red flags before drawing conclusions from linked-account data alone.
The Roommate Problem: When Shared Signals Aren’t Fraud
The biggest risk in linked-account detection isn’t missing a ring — it’s penalizing people who simply live or work together. TrustLens records a link whenever an identity-grade signal is shared, so legitimate sharing shows up the same way abuse does. Behavior is what separates them.
| Scenario | Typically shared | What usually differs |
|---|---|---|
| Roommates | Shipping address, often IP and device | Separate phones and payment methods; no coupon or refund pattern across the accounts |
| Family members | Address, sometimes a shared landline | Usually separate cards; a different product mix per account |
| Couple sharing a card | Address and payment method | Separate phones; purchases that complement rather than repeat each other |
| Workplace deliveries | Shipping address (a shared office IP alone never links) | Everything else |
| Forgot-password duplicate | Nearly everything | Nothing abusive — the combined history reads like one ordinary customer |
Links suggest, behavior confirms
Treat a link as a reason to look at combined behavior, not as a finding. If the linked accounts show repeated first-order coupons, high combined refunds, or a new account appearing right after a block, you have a problem. If they look like two ordinary customers at one address, you have roommates. Act on what the accounts do, not on the fact that they’re connected.
This matters more than it might seem, because the score does react to the link itself. With default settings, one linked account costs 5 points, and that penalty applies even before a customer reaches the full-confidence order threshold. A brand-new customer whose partner already shops with you therefore starts at 45 — the top of the Caution band — rather than a neutral 50. That isn’t a verdict, but it’s worth knowing before anyone on your team filters or holds orders by segment.
Allowlisting as a safety valve
When you’ve confirmed that linked accounts belong to separate, legitimate people, allowlist them. An allowlisted customer’s score is locked at 100, and negative signals — including the linked-account penalty — no longer move it. Allowlisting is per customer, so a verified household needs each of its accounts allowlisted; and because an allowlisted profile sits in VIP rather than Risk, it never adds the extra high-risk penalty to the accounts it’s linked to. False positives are inevitable when linking on shared data, so add a short admin note to the profile each time you allowlist someone — it keeps the call reversible and easy to audit.
See fraud ring detection in action
TrustLens’s linked-account detection runs in the free version — no Pro license needed to start recording fingerprints and seeing which customer accounts share signals. Pro Automation Rules add the ability to automatically hold or block orders when linked-account thresholds are crossed.
Frequently Asked Questions
Does TrustLens linked-account detection work for guest checkout?
Yes. TrustLens identifies customers by a hash of their email address, so guest orders are tracked the same way as registered accounts. If the guest uses a shipping address or phone number shared with another account — guest or registered — the link is recorded. If a guest later registers with the same email address, their history carries over.
Will TrustLens automatically block customers with linked accounts?
No — not in the free version. The free tier surfaces the detection and adjusts the trust score. Blocking requires you to manually take action on the customer’s profile, or to configure a Pro Automation Rule that triggers on the linked_accounts_detected event with a condition like “linked account count is greater than N.”
How many signals need to match before two accounts are flagged as linked?
One identity-grade signal is enough: a shared shipping address, billing address, phone number, or payment method. IP address and device (user agent) matches never link accounts on their own — they only appear as supporting detail next to a strong match. The match_count on each linked-account relationship tells you how many signal types overlapped. The trust score penalty scales with the total number of linked accounts and their risk level, not with the number of signals per match — so a single strong-signal match (like a shared payment token) that produces multiple linked accounts will still affect the score meaningfully.
Can a household with two accounts set off a false positive?
Yes, it can. Two accounts sharing a shipping address or phone number will be flagged as linked, and each takes a small penalty (-5 points by default). For an established customer with positive history that rarely changes anything, but a brand-new customer starts at 50, so one link puts them at 45 — just inside the default Caution band. If you’ve verified the accounts belong to different people, allowlist each of them; allowlisted customers keep a locked score of 100. The real concern is compounded links — three, five, or more accounts — or links to accounts already in the Risk segment or blocked. One linked account in a household is generally not worth action on its own.
What does TrustLens actually store for linked-account detection?
TrustLens stores HMAC-SHA256 hashes of the six signal values — not the raw shipping address, phone number, IP, or payment token. The hashes are keyed to your WordPress authentication key, so they can’t be reversed and can’t be matched across different sites. The raw personal data never reaches the TrustLens database tables.
Does linked-account detection work on historical orders?
After installation, TrustLens records fingerprints from new orders automatically. For historical orders, you run Historical Sync from the dashboard — it processes past orders in small batches in the background without affecting frontend performance. Historical Sync does have one limitation: the IP address and device user-agent signals require that data to be present in the order record. Older orders that didn’t capture those fields at checkout won’t produce those fingerprints. Fingerprints are also kept for 365 days after an identifier was last used, and Historical Sync doesn’t record them from orders older than that, so links reflect roughly the last year of activity.
What happens to linked-account fingerprints when I rotate WordPress secret keys?
Rotating your WordPress secret keys invalidates every stored fingerprint and customer hash because the HMAC key material changes. TrustLens can no longer match returning customers to their existing profiles. After key rotation, running Historical Sync rebuilds the customer table using the new keying material. Manually set block and allowlist statuses on individual customers need to be re-applied — they are not automatically restored by the sync.
Can Pro Automation Rules fire when a new linked account is detected?
Yes. The linked_accounts_detected trigger in Pro fires each time TrustLens identifies a new linked-account relationship. You can combine it with condition fields like linked account count, trust score, segment, or coupon-then-refund pattern to build rules that respond precisely to the situations you actually want to act on automatically.
Key Takeaways
- Fraud rings in WooCommerce typically start with a single account exploiting a first-order incentive, then multiply across weeks or months. The damage compounds before any individual account looks suspicious on its own.
- TrustLens’s Linked Accounts Detection module records six behavioral fingerprints from every order — shipping address, billing address, phone, IP, payment method, and device user agent — and links accounts that share at least one identity-grade fingerprint (address, phone, or payment method). IP and device matches only corroborate. The module is free; no Pro license is required.
- A fraud ring costs more than duplicated discounts: it inflates customer counts, dilutes return rates across accounts, turns per-customer limits into per-email limits, and lets blocked customers keep ordering under new emails.
- All fingerprints are stored as HMAC-SHA256 hashes keyed to your WordPress authentication key. Raw personal data (addresses, phone numbers, IPs) never reaches the TrustLens database. Fingerprints are site-specific and non-reversible.
- The score penalty for linked accounts scales with the count of linked accounts and their risk level: 1+ linked accounts = -5, 3+ = -10, 5+ = -15, plus additional penalties for Risk-segment or blocked linked accounts.
- The free version detects and surfaces linked accounts but does not act automatically. Blocking or holding orders in response to a linked-account flag requires either manual action or a Pro Automation Rule.
- Pro Automation Rules support a
linked_accounts_detectedtrigger and alinked_accountscondition field, allowing precise automated responses — block, hold, tag, or webhook — when a threshold is crossed. - A single linked account is often a household, roommates, or a forgotten-password duplicate — and because the penalty applies from the first order, a new customer in a shared household can start in Caution. Allowlist verified households. Multiple linked accounts sharing two or more strong signals (address + phone, payment + address) — especially when those accounts have Risk-segment histories — is a pattern worth investigating before shipping.
