CardRaabta Manual Payments for WooCommerce

Description

Accept manual bank transfers, mobile wallet payments and Raast payments in your WooCommerce store. CardRaabta displays your receiving details, collects payment proof and helps you review submissions before confirming payment.

Customers transfer PKR to your existing receiving account and submit a screenshot or transaction reference. You check the actual funds in your account, then approve the payment or reject the proof with a helpful reason.

The plugin does not require payment-provider API credentials. You need an account permitted by your provider to receive your intended payments. CardRaabta is independent third-party software, not affiliated with or endorsed by WooCommerce or the payment providers. It does not verify funds automatically, connect to bank/wallet APIs, process cards or issue automatic refunds.

How it works

1. Add your receiving account details and enable the methods you want to offer.
2. The customer selects a method and transfers the order amount using your instructions.
3. The customer submits proof at checkout, or later if you allow unpaid orders without checkout proof.
4. Review the submission in Transactions and verify the transfer in your actual receiving account.
5. Approve the payment, or reject the proof with a reason so the customer can correct it.

Bank, wallet and Raast methods

Offer JazzCash, Easypaisa, SadaPay, NayaPay, Bank Transfer (IBFT), Raast, Zindigi, UPaisa, HBL Konnect, Cash Bank Deposit or a custom payment method.

Configure a display name, account title, receiving number/IBAN/identifier, instructions and optional QR image for each method. Customers see the details matching their selection. These are receiving instructions, not direct provider integrations. Never enter account passwords or PINs.

Checkout and customer payment proof

• Supports Classic Checkout, Checkout Blocks and WooCommerce HPOS.
• Responsive payment forms with receiving details and account-copy controls.
• Proof is required at checkout by default. Optionally allow unpaid orders with later proof submission.
• Configure screenshot, reference, date, note and confirmation fields. Use the same settings for checkout/order pages or separate rules.
• Screenshot and date are enabled and required by default; other fields start disabled.
• Every proof submission must include a screenshot or transaction reference, according to your enabled field settings. Dates must be valid and not in the future.
• JPG, PNG and WebP uploads; configurable 1–8 MB limit, default 5 MB, with server-side validation.
• Pending/Rejected proof forms open when the customer chooses to update proof. Paid orders cannot resubmit.

Registered customers use authenticated access. Guests use private order-key links and may need billing-email verification. Selecting or preparing a file does not mean the server has received the proof.

Manual review and proof history

Search by order/reference, filter by status and expand transaction details. Review individual payments or use confirmed bulk actions. Bulk rejection requires a customer-visible reason; approval accepts an optional note. Stale or ineligible records are skipped with a notice.

Customers can replace Pending/Rejected proof under the same transaction ID. Earlier submissions and review decisions remain in manager-only history. Allow 1–10 replacements after the initial submission, default 3, between completed reviews. Completed rejection resets used attempts; changing the configured limit does not. Replacements are complete submissions, so omitted current fields are cleared while prior values stay in history.

All transactions and Trash use pagination, with 20 rows by default and Screen Options for 1–100. Pending proof for an existing order must be reviewed before removal. Trash/Restore change visibility; they do not reverse payments, stock changes or refunds.

Exports, notifications and Email Logs

• Separate manager-only CSV exports for current transactions and proof history, including recorded proof/review information.
• Screenshots appear as attachment IDs, without embedded files or public image URLs. Spreadsheet formula-prefix protection applies.
• Eleven customer/admin notification types covering proof received/updated, review decisions, missing proof and interrupted reviews.
• Configure admin recipients, notification switches and reminder delay. Customer messages use the order billing email.
• Edit email subjects, headings, messages, buttons and reviewer-note highlights; branding uses WooCommerce email settings.
• Desktop/mobile sample previews and logged test emails.
• Email Logs with masked recipients, transport status, attempts, filters and clearing controls.

Missing-proof reminders default to 15 minutes, configurable from 1 minute to 7 days, and recheck eligibility. Dispatch depends on Action Scheduler/WP-Cron and your mail transport. Mail-server acceptance does not confirm inbox delivery. Clearing logs does not cancel queued work or reset duplicate-send protection.

Private evidence and data retention

Payment screenshots use AES-256-GCM encryption and manager-only authenticated access. Back up the database, private evidence and crmp_evidence_key together; losing the key makes retained screenshots unreadable. Server-level protection is also required for private evidence storage: see Installation below.

The plugin stores receiving details, proof, customer/reviewer notes, recorded field settings and email operational data. Queue recipients/message snapshots are scrubbed after 30 days; minimal deduplication metadata remains. Visible Email Logs have separate optional 30-day cleanup.

Proof has no automatic expiry. Permanent transaction removal deletes proof, revisions and private notes while retaining minimal receipt/reference and decision metadata against duplicate approval. Uninstall retains data, settings, evidence and its encryption key; deactivation clears scheduled email work. There is no dedicated personal-data exporter/eraser. Managers should set an appropriate retention policy.

No plugin analytics/tracking, remote executable code or payment-provider API calls are included. A customer confirmation checkbox does not verify that funds were received.

Full documentation | Hosting setup guide

Support

WordPress.org support | GitHub issues | Documentation and source

Developed by Malik Arslan. GPL-2.0-or-later; license text is included in LICENSE.