Konduto Antifraud for WooCommerce — fraud analysis of orders for Brazil

Konduto Antifraud for WooCommerce sends the orders of your shop to Konduto, the Brazilian fraud-prevention service, and shows the answer right in the order: a risk score from 0 to 1, the recommendation (approve, review or decline) and the rules that fired. The module is made for shops that sell in Brazil: the buyer’s CPF/CNPJ, addresses with CEP, reais, Pix, boleto and cards. It works with the classic and the block checkout and HPOS. The interface is in English and português (pt-BR).

Unofficial module. Konduto is a trademark of its owner; this is an independent integration by CatCode, not a Konduto product. The analysis itself is billed by Konduto: you need your own Konduto account and contract, and Konduto, not the module, sets the prices and terms.

What the free version does

Everything is set on one page: WooCommerce → Konduto. Enter the private key from the Konduto dashboard (it is stored encrypted and never shown again) and press “Check connection”: Konduto tells you whether it accepted the key. A key starting with T belongs to the test environment, P to production. The order-number prefix is there because Konduto accepts an order number only once per account: give the shop and its test copy different prefixes when they share an account. For each payment method you choose the payment type reported to Konduto: Pix, boleto, credit or debit card, transfer, voucher or balance. The module guesses the type from the payment method and you can set it yourself. WooCommerce does not keep the BIN and the last four digits of a card, so a card order goes without them; if Konduto refuses the data because of the card, the order is sent again without the payment block.

The order screen gets a “Konduto antifraud” box. The button “Send to Konduto for analysis” sends the buyer (name, e-mail, phone, CPF/CNPJ), billing and shipping addresses, the items of the cart, the totals, the IP address and the payment type. CPF/CNPJ, house number and neighbourhood are read from the fields that Brazilian checkout-field plugins create (for example our Brazilian Checkout Fields). The box then shows the recommendation, the score, the Konduto status and the rules that fired, and the same goes to the order notes. An order cannot be sent twice: the button becomes “Refresh the analysis” and reads the current status, for example after an analyst decided in Konduto. In the free version the WooCommerce order status is never changed. Instead of raw API errors you see clear messages: key refused, a missing field (“/customer/tax_id”), Konduto not reachable.

What Pro adds

Automatic analysis. An order goes to Konduto by itself, as soon as it is placed or when it is paid (status “Processing”), in the background through Action Scheduler; if Konduto cannot be reached, the order is sent again up to three times. Action on the recommendation. “Review” puts the order on hold, “Decline” puts it on hold or cancels it (cancelling does not refund a payment already taken, and the setting says so). An unpaid Pix or boleto order is not touched until the payment arrives; then it waits on hold instead of going to “Processing”. Konduto webhook. When a Konduto analyst approves or declines the order, the order follows: back to its status, or cancelled. Every notification is checked with the HMAC signature. The webhook address is shown in the settings and has to be given to Konduto support. Your decision back to Konduto. Approve, decline or mark as fraud (chargeback) with a comment from the order screen; cancelled orders and failed payments are reported to Konduto so that the model learns from them. Failed payments can be sent without analysis (Konduto bills only analysed orders). Storefront script. The Konduto script, the page tags and the visitor ID in each order: the behaviour data Konduto weighs most. Blocklist, allowlist and reviewlist. The e-mail, CPF/CNPJ, phone or IP of an order are added with one click, and any value can be added or removed from the report page. Orders list and report. The orders list gets a Konduto column with the recommendation and the score and the bulk action “Send to Konduto for analysis”. The report page shows the last 30 days by recommendation, the orders waiting for review or declined, the lists and the journal of every call to Konduto. Updates from catcode.com.ua.

Good to know before you start

• You need your own Konduto account: the public and the private key from the Konduto dashboard. The contract and the access come from Konduto; the module does not provide them.
• The analysis is billed by Konduto under your contract. The module, its free version and Pro do not include the cost of the analysis. Automatic sending (Pro) sends every order, so choose when: at checkout or after payment.
• Konduto requires the buyer’s document. If the shop has no CPF/CNPJ field, the analysis is refused for the field “/customer/tax_id”: add a checkout field, for example Brazilian Checkout Fields.
• Cancelling an order on the “Decline” recommendation does not return money that the payment provider already took: refund it in the order or in your payment provider.
• Holding paid orders relies on the payment plugin finishing the payment the standard WooCommerce way. A payment that jumps straight to “Completed” (for example for virtual goods) is not held by the module.
• The Konduto script on the storefront (Pro) collects page-browsing and device data of the visitor; mention Konduto in your privacy policy and inform buyers as LGPD requires.
• The webhook needs a site reachable from the internet over HTTPS and an address given to Konduto support. Without the webhook you still see the analyst’s decision after “Refresh the analysis”.
• If a shop and its test copy share one Konduto account, give them different order-number prefixes: Konduto accepts a number only once.

How it works, step by step

1. Take the private key (and the public key, if you switch the script on) from the Konduto dashboard.
2. In WooCommerce → Konduto paste the private key and press “Check connection”.
3. Look at how your payment methods are reported to Konduto (Pix, boleto, card) and save.
4. Open an order and press “Send to Konduto for analysis”: the score and the recommendation appear.
5. With Pro choose the automatic sending mode and the actions on the recommendation, and give the webhook address to Konduto support.

Under the hood

• Konduto Orders API: the order is sent to api.konduto.com, authenticated with the private key; the score, the recommendation, the status and the rules and lists that fired are read from the answer.
• The private key is stored encrypted; requests never print it to a log or to a page.
• Konduto failures (network, 5xx, rate limit) do not lose the order: sending is repeated with pauses, and an order that Konduto already saved is read back with a request, without a duplicate.
• The webhook is checked with an HMAC signature; a notification with a wrong signature is refused and the order is not changed. A decision the shop owner already made in the admin is not overwritten by a late Konduto answer.
• Compatible with HPOS and with the classic and block checkout; languages: English and português (pt-BR).

How to install

1. Plugins → Add New → Upload Plugin: choose the zip and activate it.
2. WooCommerce → Konduto: paste the private key, “Check connection”.
3. Check the payment type of your payment methods and save.
4. For Pro: start the trial or paste a licence key in the “Licence” section.

The module is not on wordpress.org yet: the free version and Pro are one archive from this page. Without a key it works as the free version.