The Goldens Cards KYC Gate

The Goldens Cards KYC Gate stops customers from ordering until they have verified their identity with Sumsub. It is built for shops that must prevent fraud, chargebacks and stolen-card purchases.

How it works

• Customers verify their identity (ID document + liveness selfie) in the Sumsub WebSDK on My Account → Identity verification, or on any page with the [sskyc_verification] shortcode.
• Unverified customers who open the checkout are redirected to the verification page.
• Orders are blocked on the server for the classic checkout, the Cart/Checkout blocks (Store API) and the “Pay for order” page, so the rule cannot be bypassed.
• Approval comes only from Sumsub: a signed webhook (HMAC SHA-256/SHA-512) or a server-to-server API lookup. The browser never decides the result.
• Rejected (final) and deactivated applicants cannot order. “Resubmission requested” sends the customer back to verification.
• Guest checkout is disabled while the gate is active, because verification is tied to a customer account.
• Each order stores the KYC status, applicant ID and verification level at the time of purchase.

Anti-fraud

• Billing name must match the name on the verified ID document (locked on the classic checkout). Combine with 3-D Secure in your payment gateway so the card-holder’s bank confirms the card owner.
• Optional: block VPN, proxy and Tor connections during verification and checkout (proxycheck.io).
• Optional: billing country must match the visitor’s IP country.

Admin

• KYC column on the Users screen, KYC panel on each user profile (status, Sumsub applicant link, re-sync, logged manual override).
• Roles can be exempted (administrators and shop managers by default).
• Compatible with High-Performance Order Storage (HPOS) and the Cart/Checkout blocks.

A Sumsub account is required. This plugin is not affiliated with or endorsed by Sumsub.

This plugin is a tool to help reduce fraud. It does not by itself make your store compliant with KYC, AML or data-protection laws; you remain responsible for your own compliance.

External services

This plugin connects to the following third-party services. Nothing is sent until you enter your credentials (Sumsub) or enable the VPN check (proxycheck.io).

Sumsub (identity verification) – required for the plugin to work.

• What it is used for: creating the verification session for a customer, showing the verification widget, and reading the verification result.
• What is sent and when:
  • When a logged-in customer opens the verification page, the plugin sends Sumsub a random customer identifier generated by the plugin, the customer’s email address and your verification level name (api.sumsub.com).
  • The customer’s browser loads the Sumsub WebSDK script from static.sumsub.com and sends the documents, selfie and device data the customer provides directly to Sumsub.
  • When a webhook arrives, when the customer’s status is refreshed, and (optionally) at checkout, the plugin requests that customer’s verification status and verified name from api.sumsub.com.
• Sumsub Terms of Use: https://sumsub.com/terms-of-use/
• Sumsub Privacy Notice: https://sumsub.com/privacy-notice-website/

proxycheck.io (VPN / proxy detection) – only when “Block VPN / proxy / Tor” or “Billing country must match IP country” is enabled.

• What it is used for: detecting VPN, proxy and Tor connections and the country of the visitor’s IP address.
• What is sent and when: the visitor’s IP address (and your API key, if set) when a customer opens the verification page or places an order. Results are cached for 6 hours.
• proxycheck.io Terms: https://proxycheck.io/terms
• proxycheck.io Privacy Policy: https://proxycheck.io/privacy

Author

Developed by Khalaf Almazrouei for The Goldens Cards (https://thegoldenscards.com).