get_user_id();
$ip = sanitize_text_field( $order->get_customer_ip_address() );
$total = (float) $order->get_total();
$this->check_order_velocity( $customer_id, $ip );
$this->check_large_order( $order_id, $customer_id, $total );
$this->check_ip_multiple_accounts( $ip, $customer_id );
}
private function check_order_velocity( $customer_id, $ip ) {
global $wpdb;
$recent = $wpdb->get_var( $wpdb->prepare(
"SELECT COUNT(*) FROM {$wpdb->prefix}posts p
JOIN {$wpdb->prefix}postmeta pm ON p.ID = pm.post_id
WHERE p.post_type = 'shop_order'
AND p.post_date > DATE_SUB(NOW(), INTERVAL 1 HOUR)
AND pm.meta_key = '_customer_user' AND pm.meta_value = %d",
$customer_id
) );
if ( $recent > 5 ) {
$this->log_alert( null, $customer_id, null, 'velocity', 'high',
"Customer $customer_id placed $recent orders in the last hour." );
}
}
private function check_large_order( $order_id, $customer_id, $total ) {
$threshold = (float) get_option( 'vv_fraud_order_threshold', 500 );
if ( $total > $threshold ) {
$this->log_alert( null, $customer_id, $order_id, 'large_order', 'medium',
"Order #$order_id total " . wc_price( $total ) . " exceeds threshold " . wc_price( $threshold ) . "." );
}
}
private function check_ip_multiple_accounts( $ip, $customer_id ) {
global $wpdb;
$count = $wpdb->get_var( $wpdb->prepare(
"SELECT COUNT(DISTINCT pm.meta_value) FROM {$wpdb->prefix}postmeta pm
JOIN {$wpdb->prefix}posts p ON pm.post_id = p.ID
WHERE p.post_type = 'shop_order' AND pm.meta_key = '_customer_user'
AND p.ID IN (
SELECT post_id FROM {$wpdb->prefix}postmeta
WHERE meta_key = '_customer_ip_address' AND meta_value = %s
)",
$ip
) );
if ( $count > 3 ) {
$this->log_alert( null, $customer_id, null, 'ip_multi_account', 'high',
"IP $ip associated with $count different accounts." );
}
}
public function check_registration( $user_id ) {
$ip = sanitize_text_field( $_SERVER['REMOTE_ADDR'] ?? '' );
global $wpdb;
$recent = $wpdb->get_var( $wpdb->prepare(
"SELECT COUNT(*) FROM {$wpdb->prefix}usermeta
WHERE meta_key = '_registration_ip' AND meta_value = %s",
$ip
) );
update_user_meta( $user_id, '_registration_ip', $ip );
if ( $recent > 3 ) {
$this->log_alert( null, $user_id, null, 'registration_spam', 'medium',
"IP $ip registered $recent accounts recently." );
}
}
private function log_alert( $vendor_id, $customer_id, $order_id, $type, $severity, $details ) {
global $wpdb;
$wpdb->insert( "{$wpdb->prefix}vv_fraud_alerts", [
'vendor_id' => $vendor_id,
'customer_id' => $customer_id,
'order_id' => $order_id,
'alert_type' => $type,
'severity' => $severity,
'details' => $details,
] );
// Notify admin of high-severity alerts
if ( $severity === 'high' ) {
$admin_email = get_option( 'admin_email' );
wp_mail( $admin_email,
'[VendorVerse] High Severity Fraud Alert: ' . $type,
'' . esc_html( $details ) . '
Review in WP Admin → VendorVerse → Fraud Alerts
',
[ 'Content-Type: text/html; charset=UTF-8' ]
);
}
}
}