Stop Hosting Fraud, Chargebacks & Server Abuse Before Provisioning

eKYC Guard is the ultimate automated identity verification (KYC/AML) and fraud prevention gate for WHMCS. It stops fraudulent signups, stolen credit cards, phishing, spam VPS networks, and crypto mining abuse at the source by holding product and domain provisioning until the customer verifies their real-world identity.

Whether you want strict verification on high-risk VPS/dedicated servers, or completely frictionless zero-touch checkouts that only trigger KYC when suspicious VPNs, Tor exit nodes, or proxies are detected, eKYC Guard gives you complete, automated control directly inside your WHMCS admin.

Why Web Hosts Choose eKYC Guard

• Eliminate Chargebacks & Payment Fraud — Fraudsters using stolen cards or fake identities cannot pass biometric KYC. They abandon the cart before costing you chargeback fees.
• Protect Your IP Reputation & Infrastructure — Prevent your subnets from being blacklisted by stopping phishing hosts, spammers, and abuse networks before a single server is deployed.
• Dynamic Risk-Based KYC (Zero-Friction Checkout) — Don't add friction for good customers. With built-in IP reputation scoring, direct legitimate customers check out instantly, while visitors using VPNs, Tor, or anonymizers are automatically gated.
• Support Ticket Agent Warning Badge — Warn your support staff in real time inside the WHMCS ticket interface when a ticket is opened by an unverified customer, blocking social engineering and unauthorized server re-installs.
• Bank-Grade Compliance & AML Screening — Screen names against global sanctions and PEP watchlists (OpenSanctions). Stay compliant with GDPR, Indian UIDAI guidelines, and payment processor KYC mandates.
• 100% Set-and-Forget Automation — Automated KYC invitations, reminder cadences, grace periods, auto-suspension, auto-termination, and instant auto-provisioning the moment a customer passes.

Comprehensive Feature Breakdown

1.Dynamic Risk-Based KYC (IP & Proxy Gating) — NEW in v1.5.7

• ProxyCheck.io & IPQualityScore Integration: Inspects customer IP addresses in real time.
• Threat Detection: Automatically flags commercial VPNs, Tor Exit Nodes, Public/Private Proxies, and elevated fraud risk scores (0–100).
• Flexible Enforcement Modes:
  • Strict Only Mode (strict_only): Friction-free for clean domestic visitors—verification is only enforced if a VPN, proxy, or high risk score is detected.
  • Override Mode (override): Suspicious visitors are immediately gated, even if the product or client was normally excluded from scope.
• Quota-Saving Cache: 24-hour local caching eliminates redundant API lookups and preserves third-party quotas.
• Admin Risk Panel: Direct visibility into IP risk scores, ASN, country, and detection flags inside the verification audit view.

2.Multi-Provider Verification Suite

Connect with industry-leading identity verification providers through a single unified engine:

• Didit (Global): 220+ countries, passport/ID scanning, 3D biometric liveness, and dynamic KYB (Know Your Business) workflow routing for corporate accounts.
• DigiLocker (India): Official government-backed identity verification via OAuth2 + PKCE. Extracts verified demographic data (Name, DOB, Gender) in memory while maintaining strict UIDAI compliance.
• Stripe Identity: Hosted document and selfie verification backed by Stripe.
• Sumsub: Full-cycle identity verification with custom KYC levels.
• Onfido: Enterprise Studio workflows and document validation.
• Persona: Tailored inquiry templates and fraud risk signals.
• Shufti Pro: Real-time AI-powered document and facial verification.
• Manual Review: Secure customer document upload with drag-and-drop admin review and upload-on-behalf tools.

3.Provisioning Firewall & Auto-Provisioning

• Interception Hooks: Hooks seamlessly into PreModuleCreate, AfterShoppingCartCheckout, ShoppingCartCheckoutComplete, and registrar commands (PreRegistrarRegisterDomain, PreRegistrarTransferDomain).
• Zero Premature Activation: Free trials, promo codes, and unpaid orders are safely held in Pending until verified.
• Instant Auto-Provisioning: Once a customer passes verification, pending orders and services are automatically accepted and created, triggering WHMCS Welcome Emails (sendemail=true).
• Duplicate-Safe: Built-in order-first deduplication prevents duplicate server deployments or repeated welcome emails.

4.Support Ticket Agent Protection Badge

• Embeds an interactive security banner directly into the WHMCS Admin Support Ticket view (AdminAreaViewTicketPage).
• Displays instant status: Verified (with provider & document type), Under Review, or Unverified.
• Actively warns support agents: "Do not process password resets, server re-installs, or EPP transfers without verification."
• Includes a 1-click KYC Invitation Email trigger for rapid resolution.

5.Precision Scoping Controls

• Product Scope: Apply KYC to all products, or restrict enforcement to specific packages or product groups (e.g., enforce on Dedicated Servers & Cloud VPS, bypass for shared hosting).
• Client Scope: Enforce globally, or whitelist/blacklist specific Client IDs or Client Groups.
• TLD Gating: Filter domain registrations by TLD whitelist or blacklist.

6.Privacy, Security & GDPR Compliance

• AML & Sanctions Screening: Automatically checks verified customer names against sanctions, PEP, and criminal watchlists. Flagged hits route to manual review.
• GDPR Lawful Basis: Optional explicit consent checkbox captured with audit timestamp.
• Libsodium Encryption at Rest: Documents are encrypted on disk with strong cryptography outside the web root.
• Automated Data Purge: Auto-deletes stored identity documents after your configured retention period (e.g., 30 days) while preserving the audit trail.
• Auto-Delete Rejected Entries: Daily cron automatically purges rejected records and files after a customizable window.
• GDPR Right to Be Forgotten: Automatically cleanses verification records upon client deletion in WHMCS.

7.Native, Responsive Client Area

• Localized Multi-Language Support: Built-in translations for English, Spanish, French, and Arabic (with complete RTL support).
• Mobile Camera Capture: Mobile-optimized document and selfie uploading directly from smartphone cameras.
• Animated Banner & Status Badges: Sleek, non-intrusive floating alerts that notify unverified clients without disrupting page navigation.
• Real-Time Polling: Verification screens automatically refresh the instant an external webhook confirms approval.

Requirements

• WHMCS: Compatible with WHMCS 7.4 through 8.x and 9.x.
• PHP: PHP 7.4 to PHP 8.1, 8.2, 8.3+ with cURL.
• Web Server: HTTPS enabled (mandatory for provider webhooks and redirects).
• Extensions: sodium (optional, for document encryption at rest).
• Installation: Clean modular installation into modules/addons/ekycguard/. Zero modifications to WHMCS core files.

Frequently Asked Questions

Will this slow down legitimate customers during checkout?
No. Legitimate customers can complete verification in under 2 minutes. Furthermore, using the Dynamic Risk-Based KYC (strict_only) mode, safe direct connections bypass KYC completely, gating only visitors on VPNs, Tor, or suspicious proxies.

Can I offer manual review as a backup?
Yes! You can enable multiple automated providers alongside manual document upload. If an automated provider is unavailable, customers can upload their ID for admin review.

What happens to unpaid orders?
eKYC Guard checks the invoice payment status. Unpaid orders remain safely held until the customer both pays and passes verification, preventing premature provisioning.

Does it work with customized WHMCS themes and order forms?
Yes. eKYC Guard hooks into core WHMCS execution cycles and uses framework-independent styling, ensuring 100% compatibility with standard, Twenty-One, Lagom, and custom order forms.