Can Wcart flag customers who keep failing online payments?

Not on its own yet. Failed-payment velocity is listed under Rules on Orders → Fraud Protection, but failed card attempts aren't counted towards it at the moment, so it won't catch card testing by itself.

What helps today:

1. Make sure Enable risk scoring is ticked and the Order velocity rule is on. It scores many orders from one email or IP in a short window. Wcart saves each order before sending the shopper to the gateway, so repeated checkout attempts show up as several orders.
2. Under Auto-action policy, set High-risk orders to Flag “Hold” or Flag “Needs review”.
3. Click Save settings.

If you know the email, phone or IP behind it, add it in the Blocklist section and click Add. Matching orders then always score High.