Support

No. This is not something any site protection software will help you with.

This is something you have to deal at your business management side.

Typically, orders are prepaid and the shipping expenses are non-refundable in case of non-delivery for any reason. This dissuades such attacks, and if there are any you can report them to your payments service provider as malicious.

If you offer cash on delivery then this kind of malicious practice is something you have to factor into your pricing.

You can definitely block individual IPs. I seriously doubt that would help you any. IPs are assigned dynamically.

You cannot block VPNs unless you maintain a manual list of their egress IP addresses. Firstly, good luck with that. Secondly, you make the assumption that a. scammers use a VPN and b. legitimate users don't. These assumptions are unsubstantiated at best.

I will say this again, before closing this ticket as out of scope. Your problem is one of transaction risk assessment. It is not a security issue. You cannot and should not try to use a security tool to solve it. It's the wrong tool.

What you need to do is talk to your PSP (payment service provider) and inquire about their fraud assessment tools and fraudulent transaction feedback. They should be able to give you more information about that. Again, the best approach is to enact business rules which will incur losses to the fraudster, and factor in a percentage of fraudulent transactions in your pricing model. Managing transaction risk is a big part of the reason most small shops sell through an aggregating digital storefront such as Amazon, or (here in Greece and Cyprus) Skroutz. These storefronts have their own fraud controls which work really well because they have the behavioural visibility which comes from operating at a large scale.