Overview
Fraud Prevention risk-scores every order server-side the moment it is placed. There is no storefront integration to add and nothing a fraudster can bypass by skipping your checkout JavaScript — the assessment runs inside Vendure on OrderPlacedEvent.
Weighted signals roll up to a 0–100 score:
- Velocity — orders per IP per hour/day, orders per email identity per day, daily spend per identity. Emails are canonicalised first:
[email protected],[email protected]and[email protected]count as one identity. - Lists — your manual allow/block entries plus daily-synced threat feeds (FireHOL Level 1, Spamhaus DROP, Tor exit nodes, ~3,500 disposable-email domains). CIDR ranges are matched properly.
- Payment behaviour — failed/declined payment attempts from the same IP within the hour.
- Order shape — value ceilings, first-order-high-value, high-risk countries (your list).
Per-channel thresholds decide the outcome: below the review threshold the order flows normally; at or above it the order is held for review; at the block threshold the customer is additionally told the order is being verified. Every assessment is written to a filterable audit log.
Install
One package, one line of config. Tables are created automatically on boot.
Orders need an IP for the IP-based signals — store it in the Order.customFields.ip custom field at checkout.
Modes & thresholds
Each channel runs in one of three modes:
- Off — no scoring, no logging.
- Monitor — every order scored and logged; risky orders flagged but never held. The default, and the recommended starting point: watch the Activity tab for a week, then tune.
- Enforce — orders scoring ≥ the review threshold open a case in the Review queue and licence keys / downloads wait for approval. Orders ≥ the block threshold also email the customer that the order is under verification.
Defaults: review at 40, block at 70. The status sentence at the top of the admin page always describes, in plain English, exactly what the current configuration will do.
Review queue
Held orders land in the Review queue with their score, the exact signals that fired (with per-signal point contributions), customer identity and age.
- Approve — releases fulfilment; the customer gets your approved-order email.
- Reject — cancels the order and notifies the customer with your rejection email (refund timeline + a human-appeal path in the default copy). Add notes; everything is audited.
Customer messages are templates, per channel: held / approved / rejected each have an editable subject + body with {{orderCode}}, {{firstName}}, {{supportEmail}} and {{reviewHours}} variables, live preview and reset-to-default (Settings tab). A per-channel policy decides when held customers are told: never, block-level only (default), or always.
Ops alerts fan out to every channel you configure — Slack, Discord, Microsoft Teams, Telegram, and a generic JSON webhook signed with HMAC-SHA256 (X-Hulo-Signature) for custom integrations. Held, approved, rejected and auto-released cases all ping.
Fulfilment hold integration: if your fulfilment is custom, gate it with one call:
Lists & threat feeds
Two manual lists ride on top of the feeds:
- Allowlist — emails, email domains or IPs that bypass every check. Add your test accounts and key B2B customers here.
- Blocklist — manual bans: emails, domains, IPs, or CIDR ranges.
Built-in threat feeds
These sync automatically every night at 03:00 (licensed installs) and can also be synced on demand from the Lists tab. All are free, reputable public sources:
| Feed | What it covers | Type | Source |
|---|---|---|---|
| FireHOL Level 1 | High-confidence malicious IPs & ranges (attacks, spam, C2), aggregated from dozens of sources — the safest IP feed to enforce. | IP / CIDR | iplists.firehol.org |
| Spamhaus DROP | Hijacked and leased netblocks used by professional spammers and cybercriminals. | CIDR ranges | spamhaus.org/drop |
| Tor exit nodes | Live Tor exit relays — legitimate for privacy, but a common origin for card testing. | IP | check.torproject.org |
| Disposable email domains | ~3,500 throwaway / temporary-mailbox providers (mailinator, guerrillamail, …). | Email domain | community list |
Other feeds you can layer in
Add your own feeds. In the Lists tab, paste any public line-based blocklist URL (one entry per line, # comments ignored), pick its type (IP, CIDR range, email or email-domain), and it syncs nightly alongside the built-ins and is matched exactly the same way — CIDR ranges included. Some popular options:
| Feed | What it covers | Source |
|---|---|---|
| FireHOL Level 2–4 | Progressively broader IP reputation — higher coverage, higher false-positive risk. Try in monitor mode first. | iplists.firehol.org |
| IPsum | Daily aggregate of IPs seen attacking honeypots, ranked by how many lists flag each one. | github.com/stamparm/ipsum |
| blocklist.de | IPs reported for SSH / mail / web attacks in the last 48 hours. | lists.blocklist.de |
| Emerging Threats — compromised IPs | Known-compromised hosts, updated frequently. | rules.emergingthreats.net |
| StopForumSpam | Emails & IPs tied to spam sign-up abuse — useful against fake-account fraud. | stopforumspam.com |
| AbuseIPDB | Community-reported abusive IPs with a confidence score (free API key). | abuseipdb.com |
Simulator
The Simulate tab runs the full assessment for a hypothetical order — email, IP, value, country, first-time-customer flag — against live data (velocity counts your real recent orders) and shows the signal-by-signal score breakdown. Nothing is logged and nothing is held. Use it to sanity-check threshold changes before switching a channel to enforce.
Licensing
Without a licence key the plugin runs in the free tier: monitor mode, manual lists and the simulator — full scoring visibility, no enforcement. A licence enables enforce mode (review queue + fulfilment holds), threat-feed sync and email alerts.
Licences are JWTs bought from the plugin page — monthly with a 7-day free trial, or lifetime. Set the key as HULO_LICENCE_KEY_FRAUD_PREVENTION and pass it to init().