Cut Ecom Fraud and Chargebacks With WhopPayment Rules, 3D Secure, and Review Holds for Ecommerce Brands

On September 17, 2026, Whop announced that payment rules are live: businesses can block, request 3D Secure, or review payments based on customizable thresholds for risk score, amount, location, and customer email. A fraudulent order costs an ecommerce brand more than the sale. You lose the money, you have usually shipped the product, and the chargeback adds a fee and pushes your dispute rate up. Whop's developer guide to managing fraud describes a set of payment rules you write yourself, on top of Whop's own fraud controls, that can block, hold, or challenge risky checkouts. This is what the rules do, how an ecom store would use them, and where they stop.

How Payment Rules Work

A payment rule has a name, an action, and conditions. When a checkout matches all the conditions, Whop takes the action. Rules run after Whop's own fraud controls and never loosen them, so a payment Whop blocks stays blocked. New or changed rules are published to checkout every minute and start applying within a couple of minutes.

When several rules match, the order is: allow beats everything, block beats review and 3D Secure, review beats 3D Secure. A rule can read risk_score, amount_in_usd, card_country, card_bin, customer_email, and ip_address. Whop's advice is to challenge rather than block where you are unsure, because a block also turns away real buyers who match, while a challenge lets them prove they are the cardholder.

Four Rules an Ecommerce Store Could Start With

The Review Hold, for Physical Products

A review rule authorizes an eligible card payment without capturing it. Whop captures automatically 48 hours later unless you capture or void it sooner. Capturing sends a payment.succeeded event, which Whop calls your signal to fulfil the order. Voiding releases the hold, revokes access, and returns reserved stock. For a store that ships goods, the safe pattern is to hold shipment until the payment is captured, so you never ship against an authorization you might void.

• ▶Only on-session cards can be held: Apple Pay, Google Pay, bank, balance, and off-session payments such as renewals skip review.
• ▶Capture is all or nothing: refund afterwards to return part of it.
• ▶Buyers get access at authorization: for digital products that means they have the product before you decide, so tell them if you void.
• ▶Payments created with capture false keep their own schedule: a review rule never overrides it.

3D Secure Challenges

A 3D Secure challenge has the buyer confirm the payment with their bank, and the payment records three_ds_verified true when they pass. It is skipped, though still recorded, when the checkout cannot carry a challenge: off-session payments such as renewals, variants with their own 3D Secure level, non-card payments, cards the processor cannot challenge, and American Express. If most of your buyers pay with wallets or Amex, these rules will touch fewer orders than you expect.

Measure Whether the Rules Work

Each payment lists the rules that matched it in payment_rule_matches. Whop's guide gives two checks: disputes arriving on payments with no matches mean a rule is too narrow, and a rule matching far more payments than you were losing is too broad. The Stats API also reports payment rule matches and matched volume by rule or action. To change a rule, you replace it, which creates a successor and keeps the old decisions pointing at the old rule, so your history stays honest.

Fraud Rules Are Only Half of Chargeback Control

Whop's account health docs say a refund costs you one sale, while a dispute costs the sale, a dispute fee, and a hit to your dispute rate. Their steps for bringing the rate down apply directly to stores.

• ▶Early dispute alerts: resolve a dispute before it hits your record, with automatic refunds under an amount you set.
• ▶Resolution Center: send unhappy customers there so they reach you instead of their bank. You have 7 days to respond.
• ▶Refund faster: a high dispute rate with a low refund rate means customers are choosing their bank over you.
• ▶Clear billing descriptor: customers who do not recognize a charge file fraud disputes.
• ▶Tracking and honest delivery estimates on every order.
• ▶Policies uploaded as legal documents, so Whop includes them when you fight a dispute.

When a dispute does land, Whop debits the amount and the $15 fee, uploads some evidence automatically, and gives you 7 to 21 days to respond in the Dispute fighter, with the bank's decision taking typically 2 to 3 months.

Where This Stops

• ▶Whop checkout only: rules do not protect orders taken on Shopify or another checkout.
• ▶Your own fraud signals are not included: the rules read the six fields above, not address mismatches or order velocity unless they come through the risk score.
• ▶Setup is documented through the API: the guide's examples create rules with API calls and the payment:manage permission. Whop's announcement does not show a dashboard flow, so check your dashboard, and expect a non-technical store owner to need a developer or the Whop CLI if there is none.
• ▶Beta: Whop labels the payment rules endpoints as beta.

For the broader picture of running a store on Whop, see Whop for Ecommerce Brands. Whop's risk scores feed these rules, and Whop financial reports show the dispute and fee line items so you can measure the cost. For ad-side traffic quality, see Google Ads versus Meta Ads.

New to Whop or still deciding? Start with why Whop: what it does, what it costs, and who should skip it. For the checkout, subscription and alert fixes that work on any processor, see how to lower your chargeback rate.