XeroWP
DadsFam EFT Guard
DadsFam EFT Guard

DadsFam EFT Guard

0/5 (0 ratings) — active installs Updated Nov 12, 2026
bank transfereftpaymentssouth africawoocommerce
Download v1.2.0 Plugin Website
Home: one glance tells you whether your EFT money is being checked.

Home: one glance tells you whether your EFT money is being checked.

If customers pay you by EFT, you know the routine: open the banking app, scroll, match the amount and the reference to an order, mark it paid, repeat. And every now and then somebody sends a “proof of payment” that was made in a photo editor, hoping you ship before you notice the money never came.

EFT Guard does the checking for you. Your bank already emails you when money comes in. EFT Guard reads those emails, checks that they really came from your bank and are about your own account, and marks the matching WooCommerce order as paid. The customer gets the usual “we’re processing your order” email, and you just pack.

How it works

  1. Create an email address just for payments, such as [email protected], and connect it on the Setup tab. (On IsItPaid’s Seller or Business plan you can skip this: Money Check reads your bank’s emails for you. See below.)
  2. In your banking app, turn on an email for every payment into your account, sent to that address (FNB calls it inContact, Absa NotifyMe, Standard Bank MyUpdates). Type that account’s last four digits on the Setup tab.
  3. That’s it. Every five minutes EFT Guard reads new bank emails. When the amount and the reference match a waiting EFT order exactly, the order is marked paid.

Anything less certain waits for you on the Payments tab, with the likely orders listed, so confirming takes one tap. Any match can be undone.

Why a fake email can’t fool it

Banks sign their emails with a digital signature (DKIM). EFT Guard checks that signature on every email, makes sure it belongs to the address the email came from, and only trusts banks on your list. A forged “payment received” email, a forwarded copy or a screenshot can never mark an order paid by itself.

A signature only proves the bank sent the email, so EFT Guard also checks what the email is about. It must name your own account (by its last four digits), show one clear amount, and be your bank saying money arrived, not the payer’s bank saying a payment was sent. Someone who sends in a real bank email about their own account, or a “notification of payment” for a payment they later cancel, gets nowhere: those wait for you. What a customer types in the payment reference is never read as the amount or the account.

Fake proofs of payment, caught

Customers can upload a proof of payment on the thank-you page or in their account. The order then shows “Proof uploaded, money NOT received” in big letters until your bank’s own email arrives. If it still hasn’t arrived after the time you choose, you get an email telling you not to ship.

Catch fake proofs with IsItPaid

Connect a free IsItPaid account (isitpaid.co.za, our proof-of-payment checker for South African banks) and every proof a customer uploads is checked the moment it arrives: edited files, covered-up amounts, fake templates, and proofs for a different amount or account than the order. The answer shows on the order and the Proofs tab, and you get an email when one looks wrong. A proof that looks real is still not money: the order is only marked paid when your bank’s own email shows the money arrived.

On IsItPaid’s Seller and Business plans, Money Check can also bring in your payments, so you need no payments mailbox at all. Your bank emails your private Money Check address, IsItPaid checks the bank’s digital signature on each email and that it is about your own account, and EFT Guard marks the matching orders paid.

IsItPaid is optional, with free checks every month and paid plans for more. Without it, EFT Guard works exactly the same and sends nothing anywhere.

Teach it any bank

Banks don’t publish what their emails look like. EFT Guard reads most of them with its built-in rules, and for anything new there’s the Teach tab: paste one real email, tap the amount and the reference, and that bank’s emails are read correctly from then on.

What it never does

  • It never marks, moves or deletes an email. It only reads the mailbox.
  • It never ships anything or touches your bank account. It only marks orders paid.
  • It never sends your data anywhere, unless you connect IsItPaid (see External services).

Built for South Africa

EFT Guard knows the main South African banks, shows amounts in rand, works with PayShap payments into your account, and fits the way local shops actually get paid. It works anywhere a bank sends payment emails, though.

A word about PRO

I’ll be straight with you. Everything described above is free, and stays free: reading your bank’s emails, checking their signatures, matching and marking orders paid, the Payments screen, proof-of-payment uploads and warnings, and the Teach tab. I’m not going to start taking the mickey and lock the basics away.

I’m a dad in Cape Town building these plugins, and PRO is how people who find them useful can support that. It’s not there to “unlock your potential”.

A PRO add-on is on its way. It will add matching for invoices from DadsFam Invoice Manager, Invoice Creator and Recurring Billing, part payments, Investec’s banking API and WhatsApp alerts. It is not the plugin working properly, because the plugin already works properly.

If EFT Guard saves you an hour a week, brilliant. Genuinely. More at plugins.dadsfam.co.za.

— Zak, DadsFam

External services

EFT Guard talks to two things, both to do its one job:

  • Your own mail server. It connects over IMAP to the mail server you enter on the Setup tab, signs in with the email address and password you gave it, and reads new emails in the folder you chose. It only reads: nothing is marked, moved or deleted. The connection is encrypted unless you choose otherwise.
  • DNS, for your bank’s public key. To check an email’s digital signature (DKIM), it looks up the sending domain’s public key, a DNS TXT record such as selector._domainkey.yourbank.co.za. Only the selector and domain named in the email are looked up, and the answer is kept for an hour.
  • IsItPaid (isitpaid.co.za), only if you connect it. IsItPaid is DadsFam’s proof-of-payment checker. Nothing is sent to it until you paste a shop key from your IsItPaid account on the Setup tab and press Connect. Every request goes over https to https://www.isitpaid.co.za/wp-json/iipc/v1/ with your shop key, and only for these jobs:
    • When you connect, when you open the Setup tab, and once a day, EFT Guard asks which account the key belongs to: the plan, the checks left this month and, with Money Check, your Money Check address and confirmed accounts.
    • Each proof of payment a customer uploads (the file) is sent to be checked, with the order number, the order total and, when you have exactly one, the last four digits of your account, so IsItPaid can tell whether the proof was edited or faked and whether it fits the order. IsItPaid deletes the file straight after the check and keeps the result in your IsItPaid history. You can switch this off on the Setup tab.
    • If you choose Money Check for your payments (IsItPaid’s Seller and Business plans), every five minutes EFT Guard fetches the payments Money Check confirmed: the amount, reference, payer’s name, bank, last four digits of the account and when it arrived.
    • When you disconnect, EFT Guard asks IsItPaid to forget the key.
      IsItPaid’s terms of use: https://www.isitpaid.co.za/terms-of-use/ and privacy policy: https://www.isitpaid.co.za/privacy-policy/

Nothing else is sent to DadsFam or any other company, and there is no tracking. The Support tab links to dadsfam.co.za, forum.dadsfam.co.za, wordpress.org, isitpaid.co.za and sadomainz.co.za, and the Proofs tab to Capitec’s proof checker (capitecbank.co.za). These links open only when you click them.