XF 2.0 Payment Fraud - Editing prices

[mikez006]

Someone purchased an upgrade and was able to edit the price to $0.01. We received a payment via Paypal for $0.01.

I refunded the payment and banned the user.

I don't see the upgrade listed in the "Active user upgrades" but they were able to purchase it, so the system didn't block the purchase.

Does XF2 check for this? Is that why the upgrade wasn't added?

Does it also check for other addons that use the payment system? For example we have a "credit" addon that allows members to buy a credit currency on our site.

 

[Mike]

Users can edit the request that goes to PayPal -- that isn't unexpected with the system we use -- which is why we validate that the payment received is both to the person we expect and for the amount expected. This is exactly why the upgrade wasn't processed -- you'll probably see logs indicating this the payment log.

This is handled at the payment system level, so provided add-ons use the built in payment system, then they don't have to worry about it.

 

[mikez006]

Great Thank you.