eKYC Guard for WHMCS: Identity Verification Before Provisioning
eKYC Guard holds services and domains in WHMCS until the customer has verified their identity, so stolen cards, fake sign-ups and abuse orders are stopped before anything is provisioned. Seven verification providers or manual review, smart triggers, and every check off until you switch it on.
Stop fraud before the server is built
Most abuse is only discovered after the VPS is running or the domain is registered. eKYC Guard moves the check to the front of the queue.
Without eKYC Guard
- Orders paid with stolen cards provision instantly, then come back as chargebacks
- Fake sign-ups get servers that send spam or host phishing
- Staff chase ID copies by email and tickets, with no clear record
- Anyone with a client login can request an EPP code or change the account email
- Passport scans sit unprotected in mailboxes and ticket attachments
With eKYC Guard
- Services and domains are held until identity is verified, then released
- Verification only where risk is real: first orders, large orders, high fraud scores or new clients
- One review screen with document viewer, risk panel and approve or reject
- EPP codes, domain unlocks, contact, email and password changes require verification
- Documents encrypted outside the web root, every decision in the audit log
Everything you need to verify customers inside WHMCS
All features are included in one licence. Data stays in your own WHMCS database.
Verify only the orders that look risky
Checking every customer slows down good buyers. Smart triggers let you require KYC only when an order meets the conditions you choose.
- First order from a client
- Order total above your threshold
- WHMCS fraud score above a value
- Client registered within the last N days
Match any or all conditions. Older completed orders never trigger. Add client, product, TLD and country scopes, plus optional risk-based KYC with ProxyCheck.io or IPQualityScore.
Catch repeat abusers and mismatched identities
Fraud checks are off by default. When you switch one on, each finding can flag, send to review or reject.
- Same person on another account: matches by document number or name plus date of birth, using only a keyed fingerprint
- Name match: compares the ID name with the profile, contacts and payer names, tolerating accents, hyphens and word order
- Company check (KYB): registry lookups for Norway (Brønnøysund), the EU (VIES) and the UK (Companies House)
A registry outage is never a reason to reject a customer.
Protect domains and accounts after the sale
Account takeovers often end with a stolen domain. eKYC Guard can require a verified identity before the actions that matter most:
- EPP code requests and removing the registrar lock
- Changing domain contacts or the account email
- Changing service passwords and chosen service buttons
Admin-initiated actions are never blocked, and ticket banners show agents the client's verification status with a matching action button.
eKYC Guard vs manual ID checks by email and tickets
Many hosts ask for a passport copy by email. Here is what changes when verification lives inside WHMCS.
| Feature | eKYC Guard | Manual email and tickets |
|---|---|---|
| Hold services until verified | ✓ Automatic gate | ✗ Staff must remember |
| Verification providers | ✓ 7 providers or manual review | ✗ Eyeballing a scan |
| Only verify risky orders | ✓ Smart triggers | ✗ Case by case |
| Same person on another account | ✓ Fingerprint match | ✗ |
| AML and sanctions screening | ✓ OpenSanctions | ✗ |
| Lock EPP codes and email changes | ✓ Built in | ✗ |
| Document storage | ✓ Encrypted, auto-deleted by retention | ✗ Mailboxes and attachments |
| Audit trail | ✓ Full audit log | ✗ Scattered threads |
| Alerts and statistics | ✓ Telegram, Slack, Discord | ✗ |
Provider fees, where a provider charges them, are billed by that provider.
One licence, every feature
eKYC Guard for WHMCS
Identity verification, fraud checks and sensitive action protection for your WHMCS install.
- 7 verification providers plus manual review
- Smart triggers and fraud checks
- AML screening, GDPR consent, encrypted documents
- Alerts to Telegram, Slack or Discord and a statistics page
- Licence key and download on your service page
From order to live in four steps
Frequently asked questions
Which WHMCS and PHP versions are supported?
WHMCS 8.9 to 9.0.x with PHP 8.1 or later, including the cURL, fileinfo and sodium extensions. HTTPS and the standard WHMCS cron are required.
Which verification providers can I use?
Didit, Stripe Identity, Sumsub, Onfido, Persona, Shufti Pro and DigiLocker (India only), or manual document upload reviewed by your staff. You can enable more than one.
Will it affect my existing customers?
Not unless you choose. Every check and automation is off until you switch it on, and by default only services ordered after enforcement started are affected.
Do I have to verify every order?
No. Smart triggers let you require verification only for first orders, large orders, high fraud scores or new clients, and you can limit it by client, product, TLD or country.
Where are identity documents stored?
In your own WHMCS, encrypted at rest outside the web root. Retention rules delete documents and rejected records after the period you set.
What happens if the licence check fails?
The module fails open, so new orders provision normally. A signed local copy of the licence also covers short outages.
Where do I get the licence key and download?
After ordering, both are on the service page in the client area.
How do I get help?
Read the installation guide or open a ticket with your WHMCS, PHP and module versions and a description of the issue.
Stop fraud before it is provisioned
Hold risky orders until the customer is verified, and keep good customers moving.
