Stop fraud before it provisions

eKYC Guard holds services and domains until the customer has verified their identity. Stolen cards, fake sign-ups, phishing sites and spam VPS orders stop at the gate, before they cost you a chargeback, an abuse report or a blacklisted IP range.

Genuine customers finish in a few minutes. You decide who has to verify, when, and what happens if they don't. The gate, every enforcement action and every new check ship switched off, so installing the module changes nothing until you turn it on.

Why hosting companies use it

• Fewer chargebacks. People paying with a stolen card rarely finish a selfie and ID check, so the order never gets provisioned.
• A clean network. No server is created for an unverified customer, so fewer abuse reports reach your data center.
• No extra friction for good customers. Verify only first orders, large orders, high fraud scores, risky IPs or selected products. Everyone else checks out as usual.
• Your staff can see who is verified. A banner in support tickets shows the client's status before anyone resets a password or hands out an EPP code.
• It runs by itself. Invitations, reminders, grace periods and, if you want them, suspension. With auto-provisioning on, paid orders that were held are created the moment the customer passes.

New in 1.8.0

Fraud checks. Each check has its own switch and its own action: flag, send to review, or reject.

• Same person, new account. Recognises someone you rejected or banned who comes back on a fresh account. It compares a keyed fingerprint of the document number, or the name and date of birth. The numbers themselves are never stored.
• Name match. Compares the name on the ID with the client profile, contacts, the billing name on saved payment methods and PayPal/Stripe payer names.
• Company check (KYB). Looks up business customers in Norway's Brønnøysund Register, EU VIES and UK Companies House, and flags companies that are missing, closed or registered under another name.

Smart triggers. Require KYC only when an order meets your conditions: the customer's first order, an order total above an amount, a WHMCS fraud score above a value, or a client who signed up recently.

Verification for sensitive actions. Require a verified identity before a customer gets an EPP transfer code, unlocks a domain, changes domain contacts or the account email, changes a service password, or runs service buttons such as rebuild or reinstall. Each action has its own switch.

Instant alerts. Get notified on Telegram, Slack, Discord or a signed webhook when a review is waiting, a check finds something, or an order is held. There's a test button, and customer names are included only if you allow it.

Continue on your phone. A QR code on the verification page lets the customer take the photos with their phone camera, without logging in there. The link works once and expires.

Statistics. See the acceptance rate, time to a decision, customers who stopped half-way, and what each provider costs you, for 7, 30, 90 or 365 days.

Everything in eKYC Guard

7 verification providers + manual review

• Didit: ID document + liveness in 220+ countries, with an optional business (KYB) workflow for company accounts
• DigiLocker (India): government-backed verification (OAuth2 + PKCE)
• Stripe Identity, Sumsub, Onfido, Persona, Shufti Pro
• Manual review: customers upload their documents (desktop or phone camera) and your team approves or rejects. Admins can also upload on a customer's behalf.

Turn on one provider or several, and customers choose. Decisions arrive by signed webhook. For Didit, Stripe Identity, Persona and Onfido, a daily check also picks up any webhook that was missed.

Provisioning gate

• Holds service creation, domain registration and transfer, and orders at checkout until the customer is verified
• Auto-provisions paid orders and services that were held the moment the customer passes, with the normal WHMCS welcome emails (optional)
• Admins can override the gate when needed; every override is logged
• Choose how the client area behaves: no gating, a banner, or blocking new orders until verified

Scope: you decide who verifies

• By product or product group, by client or client group, and by domain TLD
• Country rules: let customers from listed countries skip KYC, or require it only for listed countries. The country comes from the IP location and the billing country. A VPN, proxy or unknown location never counts as a match.
• Risk-based KYC: checks the visitor's IP with ProxyCheck.io (free tier) or IPQualityScore. VPN, Tor and proxy users, or high risk scores, can be required to verify even when they're otherwise out of scope.
• Smart triggers: first order, order amount, fraud score, new client

Compliance & privacy

• AML / sanctions & PEP screening (OpenSanctions): a possible match goes to manual review instead of being approved automatically
• Consent checkbox recorded with a timestamp, so you have a GDPR lawful basis
• Documents encrypted at rest (libsodium), stored in a private folder outside the web root
• Retention: documents are deleted after the number of days you choose; the audit record is kept
• Optionally delete rejected records after a set time; records are removed when a client is deleted in WHMCS
• A full activity log, plus a log of who opened which document

Automation

• Invitation and two reminder emails, editable WHMCS templates in English, Arabic and Norwegian
• A grace period, then optional suspend, terminate or account disable. Every one of these is off by default, and Preview impact shows what would happen before you switch it on.
• Periodic re-verification after N months

For your staff

• A verification banner in support tickets from clients, with a one-click button to send the KYC invitation or open the review
• A review screen per customer with documents, fraud-check findings, risk panel and history
• Bulk actions, filters, ready-made rejection reasons and a statistics page

For your customers

• A clean verification page in English, Arabic (right-to-left) and Norwegian
• Upload from a phone camera, or continue on the phone with a QR code
• The status updates by itself when the provider confirms

Full admin control

All settings are on the module's own Settings page, in 12 clear tabs: Licence, Enforcement & scope, Automation, Providers, AML screening, Risk-based KYC, Fraud checks, Sensitive actions, Alerts, Client experience, Data & privacy and Advanced. Each setting has a short explanation, secrets are never shown again after saving, and every change is logged.

Requirements

• WHMCS 8.9 – 9.1.x
• PHP 8.1 or later (8.4 supported), with cURL, fileinfo and sodium, plus the free ionCube Loader (WHMCS 9.1 needs Loader 15)
• HTTPS (required for provider redirects and webhooks)
• An account with at least one verification provider, or manual review only

Pricing

$3.99 per month, or pay yearly and save 37%. One plan with every feature included. Free setup.

Documentation & support

A step-by-step installation and setup guide is in our knowledgebase at me.arahoster.com. For support, open a ticket at me.arahoster.com.

FAQ

Will good customers notice it? Only if you want them to. With smart triggers or risk-based KYC, most customers are never asked. Those who are usually finish in a few minutes.

What happens to unpaid orders? They stay pending. A service is only created once the invoice is paid and the customer is verified.

Can I use manual review only, without a paid provider? Yes. Turn on manual upload and your team approves the documents.

Does it change my WHMCS core files or theme? No. It's a standard addon module that uses WHMCS hooks, so it works with the default themes and with most custom themes and order forms.

What if my licence expires? eKYC Guard switches its enforcement off and new orders provision as normal, so your sales never stop. Orders that were already held wait for you to accept them.