README

Introduction

The Fraud.net Plugin connects your Shopware 6 store to the Fraud.net Ecommerce Risk API, scoring orders for fraud at the moment they are placed and recording the result on the order for review.

Fraud.net is a fraud detection and risk intelligence platform. This plugin collects a device fingerprint in the storefront, submits each order together with its customer, payment, device, and product context, and stores the returned risk score and decision so your team can review flagged orders in the Shopware Admin.

Key Features

Device Fingerprinting

Injects the Fraud.net device fingerprint SDK into the storefront header, collecting a device identifier that is submitted with the order.
The SDK loads only when fingerprinting is enabled and a site ID is configured.

Order Risk Screening

Sends placed orders to the Fraud.net Ecommerce Risk API (/v2/risk/order/ecommerce) from the CheckoutOrderPlacedEvent subscriber.
The payload carries transaction totals, customer order history, billing and shipping addresses, payment method, device fingerprint, and line items.

Risk Score & Decision on the Order

The returned risk score and a derived decision are stored as custom fields on the order, visible in the Admin order detail.
The decision is derived from the tags Fraud.net returns: a cancel tag becomes reject, a queue tag becomes review, otherwise allow. A failed call is recorded as error.
The full API result, matched rules, and fingerprint ID are stored on the order transaction.

Configurable Screening Frequency

Run Fraud.net on every order (default) sends every order for scoring.
When disabled, only a customer's first order is screened, plus any order placed 150 or more days after their previous one. Guest orders are not checked while disabled.

PII Masking

Before the request payload is stored on the order, names, street, phone, email, IP address, and session/fingerprint tokens are masked, so no raw personal data is persisted in custom fields.

Product Enrichment

Line items are submitted with SKU, brand, and category, resolved from the product record when not present on the line item payload.

Bounded API Calls

The HTTP client is scoped with a 5 second idle timeout and 10 second maximum duration, so a slow or unresponsive endpoint cannot hold checkout workers indefinitely. A timed-out call is recorded as an error decision and order placement continues.

Comprehensive Logging

Every stage — event received, payload built, request finished, result saved — is written to var/log/FraudNet-<env>.log on a dedicated log channel for troubleshooting.

Compatibility

✅ Shopware 6.7.x
✅ PHP 8.2+
✅ Requires a Fraud.net account and Ecommerce Risk API credentials

Get Started

Installation & Activation

Clone the plugin into your Shopware plugins directory:

git clone git@bitbucket.org:solution-25/fraud-net-shopware-6-solution25.git

Install the Plugin in Shopware 6
- Log in to your Shopware 6 Administration panel.
- Navigate to Extensions > My Extensions.
- Locate the plugin and click Install.
Activate the Plugin
- After installation, click Activate to enable the plugin.
- Run the following commands from your Shopware root:

bin/console plugin:refresh
bin/console plugin:install --activate FraudNet
bin/console cache:clear

Verify Installation
- After activation, you will see Fraud.net in the list of installed plugins.
- A FraudNet order check custom field set is created on the order entity by the plugin's migration.

Note: The plugin ships no storefront JavaScript or SCSS, so no asset build step is required.

Updating

When updating an existing installation, run the plugin update so new migrations are applied:

bin/console plugin:refresh
bin/console plugin:update FraudNet
bin/console cache:clear

Plugin Configuration

After installing the plugin, configure your Fraud.net credentials through the Shopware Administration panel.

Accessing the Configuration

Go to Extensions > My Extensions, then open the plugin's Configuration
Select the Sales Channel you want to configure
Set the following fields:

Fraud.net Device Fingerprint

Field	Description
Enable Fraud.net fingerprint in storefront header	Loads the device fingerprint SDK in the storefront
Fraud.net site/account identifier	Your Fraud.net site ID, passed to the fingerprint SDK

Fraud.net Ecommerce Order Check

Field	Description
Enable order check API call on checkout	Turns order screening on for the sales channel
Order check API base URL	Fraud.net API host (defaults to the sandbox endpoint)
Order check API username	Your Fraud.net API username
Order check API password	Your Fraud.net API password
Fingerprint field name from checkout form	Name of the checkout form field carrying the fingerprint payload (default `device_data`)
Run Fraud.net on every order	When enabled, every order is screened. When disabled, only first orders and orders placed 150+ days after the previous one are screened

Note: The base URL defaults to the sandbox endpoint. Update it before going live, or production orders will be sent to sandbox.

How It Works

1. Device Fingerprint Collection

When fingerprinting is enabled and a site ID is set, the plugin loads the Fraud.net device fingerprint SDK in the storefront header. The SDK collects a device identifier that the checkout form submits alongside the order.

2. Order Placed

On CheckoutOrderPlacedEvent, the plugin reloads the order with the associations it needs — currency, line items, billing address, deliveries, customer, and transactions — then checks whether screening applies to this order.

3. Screening Decision

If Run Fraud.net on every order is enabled, the order is always screened. If it is disabled, the plugin looks at the customer's order history: first orders are screened, repeat orders only once 150 days have passed since the previous one, and orders without a customer account are skipped.

4. Payload Build

The plugin assembles the request from the order: transaction totals and currency, the customer's lifetime order count and spend, billing and shipping addresses, payment method, device fingerprint, and line items with SKU, brand, and category.

5. Risk Call

The payload is posted to the Fraud.net Ecommerce Risk API. The call is bounded by a 5 second idle timeout and 10 second maximum duration; any failure is caught and recorded rather than interrupting order placement.

6. Result Storage

The risk score and derived decision are written to the order's custom fields, along with a masked copy of the request payload. The full API response, matched rules, and fingerprint ID are stored on the order transaction. The response link is normalized to the Fraud.net event overview URL for that order.

Uninstallation

bin/console plugin:deactivate FraudNet
bin/console plugin:uninstall FraudNet
bin/console cache:clear

Note: Uninstalling does not remove the FraudNet order check custom field set or the values already stored on existing orders. Remove them manually if they are no longer needed.

License

MIT

Support

For questions or issues, contact Solution25.

solution25 / fraud-net

Maintainers

Package info

Statistics

Security