Why is the SLA 3 hours instead of 1 or 2?

Orders placed after 11pm are often reviewed by the morning team. A 3-hour SLA for an 11pm order means the review is due by 2am, which is tight. In practice, the SLA serves as a morning priority flag. Adjust the duration to match your team's overnight coverage.

Does 'after 11pm' include the early morning hours like 1am-5am?

The NL text says 'after 11pm', which the compiler interprets as hours 23 onward. Whether hours 0-5 are included depends on the compilation. Check your compiled rule and adjust the NL to explicitly include early morning if needed.

What if a legitimate customer places a large order late at night?

The Approve button is designed for this. Review the order, verify the payment, and approve it. Over time you can adjust the thresholds to reduce false positives based on your actual fraud-to-legitimate ratio.

Can I combine this with payment method checks?

Yes. Create a variant of this rule that adds 'and payment method is cod' or another condition. Alternatively, use this rule alongside a separate COD-specific rule for layered coverage.

How to flag suspicious late-night guest orders in WooCommerce | Late Night Risk rule

The problem

Stolen credit card data is frequently tested and used during late-night hours when the cardholder is unlikely to notice immediate alerts. Guest checkout removes identity traceability, and a high order value maximises the fraudster's return per transaction. Without a combined flag, each factor appears mildly suspicious on its own but together they form a high-confidence fraud signal.

The solution

OrderBadger can flag high-value guest orders placed late at night, combining three fraud risk signals into a single critical alert.

Who this is for

Stores selling high-value goods that operate 24/7 online - electronics, luxury, jewellery, and fashion retailers - where late-night guest orders with large totals should be reviewed before dispatch.

At a glance

Guest checkout orders only Placed after 11pm local store time Order total over £500 3-hour SLA with Approve/Hold actions Badge: Late Night Risk (red, critical)

People also search for

WooCommerce flag high-value guest orders placed after midnight How to detect late-night fraud from anonymous buyers Badge overnight guest checkout orders for morning review WooCommerce fraud rule for after-hours expensive orders Spot stolen card usage on late-night high-value purchases

How it works

Evaluates three conditions: the order must be placed after 11pm (local store time, including early morning hours), the total must exceed £500, and the checkout must be a guest without an account. When all three are true, the order receives a critical badge with Approve/Hold buttons and a 3-hour SLA.

Do not dispatch until the order has been reviewed. Verify the payment details and check for signs of stolen card usage. Contact the customer by phone or email to confirm the order. Use the Approve button to release for fulfilment or Hold to pause pending verification. The 3-hour SLA gives your morning team time to review orders placed overnight.

Rule template

Plain English rule Order was placed after 11pm and order total is over £500 and customer is a guest checkout

Write this (or something similar) in the OrderBadger rule builder. The AI compiler turns it into executable logic automatically.

Make it yours

Adjust thresholds

Change 'after 11pm' to 'after 10pm' if your fraud data shows elevated risk starting earlier in the evening.
Lower 'over £500' to 'over £300' if your product range makes 300-value orders attractive to fraudsters, or raise to 'over £1000' for luxury-only coverage.
Shorten the SLA from 180 minutes to 120 minutes if your team monitors orders overnight, or extend to 240 minutes if all review happens the next morning.

Add or remove conditions

Add 'and shipping method contains express or next-day' to narrow this to overnight guest orders requesting fast delivery, the strongest fraud combination. …nd order total is over £500 and customer is a guest checkout and shipping method contains express or next-day
Remove 'and customer is a guest checkout' to flag all late-night high-value orders regardless of account status, useful if your fraud patterns include registered accounts.

Badge preview

Default: Late Night Risk✓✗

Passed: Late Night Risk✓

Failed: Late Night Risk✗

This badge appears in the WooCommerce order view with action buttons. Your team can respond directly from the badge pill.

When this rule matches

Guest Midnight High Value

Order total: £750.00 | Guest: yes

Order placed at hour 0 (midnight, which is after 11pm), order total is £750 (over £500), and customer is a guest. All three conditions met.

Guest 11pm High Value

Order total: £620.00 | Guest: yes

Order placed at hour 23 (11pm), guest checkout, and total of £620. The hour meets the after-11pm threshold.

Guest 2am Very High Value

Order total: £1200.00 | Guest: yes

Order placed at hour 2 (2am), guest checkout, and total of £1200. Peak fraud hours with a very large basket.

When this rule does not match

Registered Customer Late Night High Value

Order total: £600.00 | Guest: no

Order placed at hour 23 and total is £600, but the customer has a registered account - not a guest checkout.

Guest Late Night Low Value

Order total: £180.00 | Guest: yes

Guest checkout at hour 1 (1am), but order total is only 180 - under the 500 threshold.

Guest Daytime High Value

Order total: £800.00 | Guest: yes

Guest checkout and order total is £800, but the order was placed at hour 14 (2pm) - not after 11pm.

Workflow

This rule includes workflow features that help your team act on flagged orders.

Inbox

Yes

Interaction

Approve / Hold

SLA

3h (from created at)

Good to know

The local hour is based on the WordPress timezone setting, not the customer's timezone. A customer in a different timezone ordering at their local 8pm could trigger the rule if it is after 11pm in your store's timezone.
This does not include the early evening - only 11pm onward (hour 23) and early morning hours (0-5) depending on your NL interpretation. Adjust the hour threshold as needed.
Guest checkout means no customer history is available. This rule cannot assess whether the buyer has previously been flagged under a different guest email.

Frequently asked questions

Why is the SLA 3 hours instead of 1 or 2?

Orders placed after 11pm are often reviewed by the morning team. A 3-hour SLA for an 11pm order means the review is due by 2am, which is tight. In practice, the SLA serves as a morning priority flag. Adjust the duration to match your team's overnight coverage.
Does 'after 11pm' include the early morning hours like 1am-5am?

The NL text says 'after 11pm', which the compiler interprets as hours 23 onward. Whether hours 0-5 are included depends on the compilation. Check your compiled rule and adjust the NL to explicitly include early morning if needed.
What if a legitimate customer places a large order late at night?

The Approve button is designed for this. Review the order, verify the payment, and approve it. Over time you can adjust the thresholds to reduce false positives based on your actual fraud-to-legitimate ratio.
Can I combine this with payment method checks?

Yes. Create a variant of this rule that adds 'and payment method is cod' or another condition. Alternatively, use this rule alongside a separate COD-specific rule for layered coverage.

How to flag suspicious late-night guest orders in WooCommerce