If you're using WooCommerce PayPal Payments, you may have started seeing a dashboard warning like “Fraud protection is now required — enable today” or “Activate PayPal fraud management”.
This notice is about a very specific threat: card-testing (carding) bots hammering checkout pages with stolen card numbers. Even if you never get a successful fraudulent order, the traffic can create failed authorizations, gateway noise, and operational headaches.
What the warning means
In short: enable the PayPal Payments reCAPTCHA protection inside WooCommerce. Card networks and processors increasingly expect merchants to run fraud-prevention controls. Not enabling controls can expose your store to automated attacks and, in some cases, lead to payment restrictions.
WooCommerce has published official setup guidance for this feature in their PayPal Payments documentation: Fraud prevention (WooCommerce PayPal Payments).
Why this is happening now
Card-testing attacks have become much more common across ecommerce. Bots can run thousands of authorization attempts quickly, often targeting any checkout that supports card entry. The PayPal Payments plugin now includes native bot protection so stores can harden PayPal payment routes without adding a visible challenge for most legitimate buyers.
What you need to enable (and how it works)
PayPal Payments uses a layered system with Google reCAPTCHA v3 (invisible scoring) and reCAPTCHA v2 (a visible challenge only when traffic looks suspicious).
- v3 runs invisibly and assigns a score from
0.0to1.0. - A score threshold decides when a visitor should be challenged.
- v2 only appears as a fallback for lower-scoring (more suspicious) traffic.
Setup steps (reCAPTCHA v2 + v3)
Update PayPal Payments
Ensure you're on a recent version of the WooCommerce PayPal Payments plugin (the docs reference 3.3.0+).
Open the PayPal Payments reCAPTCHA settings
In WordPress go to WooCommerce → Settings → Integration → WooCommerce PayPal Payments reCAPTCHA.
Create Google reCAPTCHA keys
In the Google reCAPTCHA admin console, generate v3 keys and v2 keys for your domain, then paste the Site Key + Secret Key pairs into WooCommerce.
Keep the v3 threshold at 0.5 to start
Start with the recommended default threshold (0.5), then tune it based on customer behavior and reCAPTCHA activity.
Save and verify it's active
The docs note the protection is only active when both v2 and v3 are configured. After enabling, you should typically see the reCAPTCHA badge on the site (v3 runs silently).
How to avoid hurting conversion
- Don't over-tighten the threshold immediately. Start at
0.5. - If legitimate users get challenged too often, raise the threshold slightly.
- If bots still get through, lower the threshold incrementally and confirm v2 fallback is triggering in the reCAPTCHA dashboard.
- Use “Guest orders only” carefully (only if logged-in flows are protected elsewhere).
Troubleshooting
“Nothing changed” after enabling
That can be normal: v3 is invisible. Confirm both v2 + v3 keys are configured for the exact domain, then clear server/CDN/browser caches.
Legitimate customers see challenges too often
Increase the v3 threshold slightly and re-test checkout flows.
Bots still getting through
Lower the threshold incrementally and confirm v2 challenges are being triggered. Consider adding rate limits/WAF rules as a second layer.
Need help enabling it (without breaking checkout)?
If you're seeing failed payments, unusual authorization spikes, or you want this configured cleanly with minimal conversion impact, we can implement and verify it quickly.
Summary
If WooCommerce is warning that fraud protection is required for PayPal Payments, enable the plugin's built-in reCAPTCHA integration. It's designed to protect PayPal payment endpoints from card-testing bots while keeping checkout friction low for legitimate customers.
For the official reference and the latest requirements, follow WooCommerce's documentation: Fraud prevention (WooCommerce PayPal Payments).