Konduto Antifraud for OpenCart — fraud analysis of orders for Brazil

Konduto Antifraud for OpenCart 4.x, 3.x and 2.3 sends the orders of your shop to Konduto, a Brazilian fraud analysis service, and shows the answer in the order itself: a risk score from 0 to 1, a recommendation (approve, review or decline), the rules and lists that fired, the buyer’s location and device. The module is made for shops that sell in Brazil: the buyer’s CPF/CNPJ, addresses with a CEP, reais, Pix, boleto and cards. The module interface is in English and português (pt-BR).

An unofficial module. Konduto is a trademark of its owner; this is an independent integration made by CatCode, not a Konduto product. The analysis itself is paid on the Konduto side: you need your own Konduto account and contract, and Konduto sets the prices and the terms, not the module.

What the buyer sees

Nothing new: the checkout does not change, and the buyer does not wait for Konduto. The order goes to the analysis after the buyer has been shown the “order placed” page (on a server with PHP-FPM; without it, on the next admin page, a payment callback or a cron request). The Konduto script in the storefront, which sees how the buyer moved through the shop (Pro), is switched on in the settings; telling buyers about it under LGPD is the shop’s job.

What the admin gets

Extensions → Extensions → Modules → Konduto Antifraud: the tabs “Connection”, “Order data”, “Automation”, “Konduto lists” and “Licence”. On “Connection” you enter the private key from the Konduto portal: it is stored encrypted and never shown again, and the “Check the key” button asks Konduto whether it accepts the key. The key prefix shows the environment: T is test, P is production. The order number prefix is needed because Konduto accepts an order number only once per account: give each shop or test copy that uses the same account its own prefix.

On the “Order data” tab you choose where the buyer’s CPF/CNPJ comes from: a custom checkout field or our Brazilian Checkout Fields module (document, house number, neighbourhood). The name, e-mail, phone, IP, addresses, products and amounts come from the order itself. Each payment method gets a payment type for Konduto: Pix and boleto are recognised by the method code, a card (credit or debit) you choose yourself. OpenCart does not keep the card BIN or the last digits, so a card payment is sent with its status; if Konduto refuses that, the order is sent again without the payment block.

The order gets a “Konduto antifraud” panel. The “Analyse with Konduto” button sends the order; the panel answers with the score, the recommendation, the Konduto status, the rules or lists that fired, the location and the device, and a line stays in the order history. A second click does not duplicate anything: the module says that the order is already analysed. “Refresh from Konduto” pulls the current status. A network error, a 5xx error or Konduto’s request limit do not lose the order: the module sends it again, and when an answer got lost on the way it fetches the result with a request instead of creating a duplicate.

Pro: automatic analysis. The order goes to Konduto when it is placed or when it reaches the statuses you choose (for example, after the payment is confirmed); payment methods that need no analysis (for example, cod) are left out with a list. The order status can follow the recommendation: approve, review, decline; by default the status is kept, and it changes only if nobody changed it by hand while the analysis ran. Decisions of Konduto analysts arrive through a webhook with a signature check and move an order that waited for review to the approve or decline status. The shop’s decisions go back to Konduto: a completed order as approved, a cancelled one as cancelled, a chargeback as fraud, or by hand from the panel.

Lists and the order list (Pro). The Konduto blocklist, allowlist and review list are managed from the admin (e-mail, phone, IP, CPF/CNPJ and other values), and the order has buttons for a quick block of the buyer’s e-mail, CPF/CNPJ, IP and phone. A separate page, Sales → Konduto antifraud, shows the analysed orders with filters (review, declined, approved, waiting, failed), a 30-day summary and a button that queues the recent orders Konduto has not seen yet (their status does not change).

How it works, step by step

1. Install the archive for your OpenCart version and enable the module.
2. Take the public and private keys from the Konduto portal, enter them in the settings and press “Check the key”.
3. On the “Order data” tab choose the CPF/CNPJ field and the payment type of your payment methods.
4. Open an order and press “Analyse with Konduto”: the score and the recommendation appear in the panel.
5. In Pro switch on automatic analysis, choose the statuses by recommendation and give the notification address to Konduto support.
6. The decisions of the shop and of Konduto analysts are synchronised both ways.

Under the hood

• Konduto API v1: the order is sent to api.konduto.com/v1/orders, authorised with the private key, and the answer is read as the score, the recommendation, the rules, the lists, the location and the device.
• The private key is stored encrypted; the requests do not print it to a log or a page.
• Konduto failures (network, 5xx, request limit) do not lose the order: sending is repeated with pauses, and an order Konduto has already stored is fetched with a request, with no duplicate.
• The webhook is checked with an HMAC-SHA256 signature made with the private key; a wrong signature is refused and nothing in the order changes.
• The module works through OpenCart events and does not change the core; an update keeps the settings.
• Module language: English and português (pt-BR).

How to install

1. Extensions → Installer: upload the archive for your version without renaming it (OpenCart 4: cc_konduto.ocmod.zip, 3.x: cc_konduto-oc3.ocmod.zip, 2.3: cc_konduto-oc23.ocmod.zip).
2. For 3.x and 2.3: Extensions → Modifications → Refresh.
3. Extensions → Extensions → Modules → Konduto Antifraud: install it and open the settings.
4. Enter the private key and press “Check the key”.
5. On the “Order data” tab choose the CPF/CNPJ field.
6. For Pro: paste the key or start the trial on the “Licence” tab.