DadsFam EFT Guard

If customers pay you by EFT, you know the routine: open the banking app, scroll, match the amount and the reference to an order, mark it paid, repeat. And every now and then somebody sends a "proof of payment" that was made in a photo editor, hoping you ship before you notice the money never came. EFT Guard does the checking for you. Your bank already emails you when money comes in. EFT Guard reads those emails, checks that they really came from your bank and are about your own account, and marks the matching WooCommerce order as paid. The customer gets the usual "we're processing your order" email, and you just pack. How it works

1. Create an email address just for payments, such as payments@yourshop.co.za, and connect it on the Setup tab. (On IsItPaid's Seller or Business plan you can skip this: Money Check reads your bank's emails for you. See below.)
2. In your banking app, turn on an email for every payment into your account, sent to that address (FNB calls it inContact, Absa NotifyMe, Standard Bank MyUpdates). Type that account's last four digits on the Setup tab.
3. That's it. Every five minutes EFT Guard reads new bank emails. When the amount and the reference match a waiting EFT order exactly, the order is marked paid.

Anything less certain waits for you on the Payments tab, with the likely orders listed, so confirming takes one tap. Any match can be undone. Why a fake email can't fool it Banks sign their emails with a digital signature (DKIM). EFT Guard checks that signature on every email, makes sure it belongs to the address the email came from, and only trusts banks on your list. A forged "payment received" email, a forwarded copy or a screenshot can never mark an order paid by itself. A signature only proves the bank sent the email, so EFT Guard also checks what the email is about. It must name your own account (by its last four digits), show one clear amount, and be your bank saying money arrived, not the payer's bank saying a payment was sent. Someone who sends in a real bank email about their own account, or a "notification of payment" for a payment they later cancel, gets nowhere: those wait for you. What a customer types in the payment reference is never read as the amount or the account. Fake proofs of payment, caught Customers can upload a proof of payment on the thank-you page or in their account. The order then shows "Proof uploaded, money NOT received" in big letters until your bank's own email arrives. If it still hasn't arrived after the time you choose, you get an email telling you not to ship. Catch fake proofs with IsItPaid Connect a free IsItPaid account (isitpaid.co.za, our proof-of-payment checker for South African banks) and every proof a customer uploads is checked the moment it arrives: edited files, covered-up amounts, fake templates, and proofs for a different amount or account than the order. The answer shows on the order and the Proofs tab, and you get an email when one looks wrong. A proof that looks real is still not money: the order is only marked paid when your bank's own email shows the money arrived. On IsItPaid's Seller and Business plans, Money Check can also bring in your payments, so you need no payments mailbox at all. Your bank emails your private Money Check address, IsItPaid checks the bank's digital signature on each email and that it is about your own account, and EFT Guard marks the matching orders paid. IsItPaid is optional, with free checks every month and paid plans for more. Without it, EFT Guard works exactly the same and sends nothing anywhere. Teach it any bank Banks don't publish what their emails look like. EFT Guard reads most of them with its built-in rules, and for anything new there's the Teach tab: paste one real email, tap the amount and the reference, and that bank's emails are read correctly from then on. What it never does

• It never marks, moves or deletes an email. It only reads the mailbox.
• It never ships anything or touches your bank account. It only marks orders paid.
• It never sends your data anywhere, unless you connect IsItPaid (see External services).

Built for South Africa EFT Guard knows the main South African banks, shows amounts in rand, works with PayShap payments into your account, and fits the way local shops actually get paid. It works anywhere a bank sends payment emails, though. A word about PRO I'll be straight with you. Everything described above is free, and stays free: reading your bank's emails, checking their signatures, matching and marking orders paid, the Payments screen, proof-of-payment uploads and warnings, and the Teach tab. I'm not going to start taking the mickey and lock the basics away. I'm a dad in Cape Town building these plugins, and PRO is how people who find them useful can support that. It's not there to "unlock your potential". A PRO add-on is on its way. It will add matching for invoices from DadsFam Invoice Manager, Invoice Creator and Recurring Billing, part payments, Investec's banking API and WhatsApp alerts. It is not the plugin working properly, because the plugin already works properly. If EFT Guard saves you an hour a week, brilliant. Genuinely. More at plugins.dadsfam.co.za. — Zak, DadsFam

1. Install and activate EFT Guard from Plugins, Add New.
2. Open EFT Guard in the admin menu and go to Setup.
3. Enter your payments mailbox (mail server, email address and password) and press Test the connection.
4. Type the last four digits of the account your customers pay into, then press Save setup.
5. Ask your bank to email that address for every payment into your account.
6. Optional: connect IsItPaid on the Setup tab with a shop key from your IsItPaid account (Your account, then "Connect your online shop"), so every proof of payment is checked.

EFT Guard watches orders paid by WooCommerce's "Direct bank transfer" method by default. You can add other methods on the Setup tab.

1.2.0

• New: works with IsItPaid (isitpaid.co.za). Connect a free IsItPaid account on the Setup tab and every proof of payment a customer uploads is checked for edited files, covered-up amounts and fake templates as soon as it arrives. The answer shows on the order and the Proofs tab, and you get an email when a proof looks wrong.
• New: on IsItPaid's Seller and Business plans, payments can come from Money Check instead of your own mailbox. No mailbox to set up: IsItPaid reads your bank's emails and checks their signatures, and EFT Guard marks the orders paid. A payment into an account you haven't confirmed on IsItPaid waits for you.
• New: a "Check with IsItPaid" button for any proof, and Home shows how many proofs IsItPaid checked this month and how many looked wrong.
• Better: FNB inContact's ":-)" and ":-(" emails are read as money in and money out more reliably, and GoTyme Bank is known. Both were learned from real bank emails by IsItPaid's Money Check.
• Better: EFT Guard's emails to you are clear HTML emails in your shop's name, with a plain-text copy for mail programs that want one.
• Faster: each part of EFT Guard now loads only when it is needed. A visitor's page loads 3 small files (11 KB) instead of 17 (185 KB), and admin screens outside EFT Guard load about a quarter of what they did.
• Better: the proof upload box brings its own style and script, so it looks and works right on custom thank-you pages made with page builders and funnel plugins too.
• The Payments tab shows which account each payment went into.
• Privacy: the suggested text for your privacy policy now says what goes to IsItPaid, when you connect it.

1.1.0

• Important: an order is only marked paid by itself when the bank's email names your own account. Type its last four digits on the Setup tab (more than one account is fine).
• A payment notification sent by the payer's bank (a proof of payment, which can be sent for a payment that is later cancelled) always waits for your OK.
• Emails that show more than one amount, name no account, or look like a copy of an email read before wait for your OK, with the reason shown.
• What a customer types in the payment reference is never read as the amount or the account.
• Order numbers must match exactly: a payment for INV-1001 can never pay INV-100.
• A signed email with an extra From, To or Subject line added, or a flood of signatures, is refused.
• Free email providers and shared endings such as co.za can't be trusted banks, and Teach no longer ticks trust for you.
• Marking an order paid is one locked step, so a payment can't be used twice, even when two people press Confirm at once. A different amount needs a tick from you.
• An assistant using the Abilities API can only confirm verified, exact matches.
• "Allow my mail server's own certificate" now remembers that certificate and refuses any other.
• The saved mailbox password is only sent to the saved mail server.
• One odd email can no longer stop the checks: EFT Guard keeps its place after every email and skips one that stalls.
• Home warns when checks have stopped, and you get an email when the saved password can no longer be read after a site move.
• Proofs of payment are deleted with their order and a while after it is paid, and are included in WordPress's Export and Erase Personal Data tools.
• The proof folder is locked on Apache, LiteSpeed and IIS, even where WordPress needs FTP details to write files. PDF proofs open in the browser again.
• The Proofs tab has a button to check a proof on IsItPaid, our proof-of-payment checker.

1.0.0

• First release.
• Reads your bank's "money in" emails from your own mailbox every five minutes, without marking them read or changing anything.
• Checks every email's digital signature (DKIM), so a forged email can never mark an order paid.
• Marks WooCommerce EFT orders paid when the amount and the reference match exactly; close matches wait for one tap, and any match can be undone.
• No order number in the reference? The payer's name picks the right order when it clearly fits one customer.
• A second email for an order that's already paid is flagged, so one payment can't be counted twice.
• Proof-of-payment uploads for customers, with a clear "money not received" warning on the order and an email if the money doesn't arrive.
• Teach tab: show it one real bank email and it reads that bank's emails from then on.
• Alerts when a payment needs you, when a proof comes without money, and when the mailbox can't be read.
• Abilities for the WordPress Abilities API, so an assistant can check payments for you.