Skip to content

Account creation: failed payments should avoid triggering new accounts #24603

@lkraav

Description

@lkraav

Is your feature request related to a problem? Please describe.

As correctly identified in #3155 automatic account and password creation boosts checkout conversion rates.

Downside: malicious actors arrive at checkout and try to purchase items with a variety of stolen e-mails and credit cards.

Stripe Radar often correctly blocks such credit card charges as too risky.

But each new e-mail address / CC attempt generates a new user, order and in our case, a new subscription + triggers external integrations (e-mail marketing platforms, etc), which for all intents and purposes are instantly garbage data, and should be prevented from occurring at the source.

Describe the solution you'd like

Account creation should be triggered only after a successful payment. (BACS scenario needs 🤔)

I haven't dug through source yet. If orders are immediately looking for user accounts to save to, it seems like keeping things in Guest mode during payment method success evaluation might be useful.

Describe alternatives you've considered

Malicious actors can generate spam accounts at a high rate, which can intermittently spike various manual cleanup work.

It feels like prevention, not cleanup, is the correct solution.

Additional context

Previous discussed in detail at woocommerce/woocommerce-gateway-stripe#479

Your thoughts?

(I searched issues for multiple related keywords on this, but did not see this topic discussed anywhere before.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions