v1.5.2 - Remove payment_hash from block tokens to fix false positives

Bug Fix

• Remove payment_hash from block tokens — The payment signature (gateway + total + country) is shared by every buyer using the same payment method, amount, and country. When a fraudster was blocked, their payment_hash entered the block list and every legitimate customer with the same payment profile was caught by matched_existing_block.

Root Cause

Your colleague at 180.150.45.221 was blocked because the store owner's test order at 180.181.228.227 (braintree_cc, $1.00, AU) was blocked earlier. That block stored the payment_hash for "braintree_cc|1.00|AU" in the block list. Any subsequent $1.00 Braintree order from Australia then matched that token.

This is the same class of false-positive as the ua_hash issue fixed in v1.5.1.

What changed

• payment_hash is no longer stored in the block list when a visitor is blocked
• payment_hash is no longer checked for matched_existing_block on future attempts
• payment_hash is still used for the reused_gateway_amount_identity_churn scoring signal (counts unique emails per gateway+amount+country combo)

Block tokens now only include

• ip_hash (unique per IP address)
• email_hash (unique per email)
• address_hash (unique per billing address)