-
Notifications
You must be signed in to change notification settings - Fork 10.7k
Description
Is your feature request related to a problem? Please describe.
As correctly identified in #3155 automatic account and password creation boosts checkout conversion rates.
Downside: malicious actors arrive at checkout and try to purchase items with a variety of stolen e-mails and credit cards.
Stripe Radar often correctly blocks such credit card charges as too risky.
But each new e-mail address / CC attempt generates a new user, order and in our case, a new subscription + triggers external integrations (e-mail marketing platforms, etc), which for all intents and purposes are instantly garbage data, and should be prevented from occurring at the source.
Describe the solution you'd like
Account creation should be triggered only after a successful payment. (BACS scenario needs 🤔)
I haven't dug through source yet. If orders are immediately looking for user accounts to save to, it seems like keeping things in Guest mode during payment method success evaluation might be useful.
Describe alternatives you've considered
Malicious actors can generate spam accounts at a high rate, which can intermittently spike various manual cleanup work.
It feels like prevention, not cleanup, is the correct solution.
Additional context
Previous discussed in detail at woocommerce/woocommerce-gateway-stripe#479
Your thoughts?
(I searched issues for multiple related keywords on this, but did not see this topic discussed anywhere before.)