Ignoring the amount customers confirm is no security bug according to PayPal
1–10 of 41 posts
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#2This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fraud.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#3I recently integrated paypal. I did a test to see how much extra we could charge if the customer chose an obscure shipping address and there didn't appear to be any limits like I was expecting(I was expecting a percentage +- of the "confirmed" amount).
I asked paypal and they confirmed that there's no limit.
It is a little weird, but since paypal always sides with customers in disputes, it's probably not so bad if you get hit with this.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#4This confuses the heck out of me every time I have to work with the Paypal API. I never understood why they implemented it this way. It makes absolutely no sense IMHO but has always been this way. I'm surprised that this isn't used much more often for fraud.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#5This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…
If a bug causes behaviour that everybody expects, is it still a bug?
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#6This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…
True, but how many customers read the documentation? If that's the way it is, the user should at least be told that on the checkout screen.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#7This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…
It's a flaw though. A user trusts that the amount that they see in PayPal ($19.95) is what they will be charged when they click accept - not $21.95 or $25.95 or $2,000.
It's different if you are having your customers type in their details, even though they hope you will charge them $19.95, and not double charge them or steal their credit card information - this is a reason why people use PayPal.
But yeah, like you said it is fraud, though a business could argue shipping charges or tax or "addon pricing" or whatever for a small amount (a company I would see doing this is GoDaddy), but larger amounts their PayPal account would probably be banned.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#8This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…
True, but how many customers read the documentation? If that's the way it is, the user should at least be told that on the checkout screen.
It's shouldn't really affect customers in any way. By terms of Express Checkout, after returning from the authorization at PayPal (which is NOT a checkout screen), the business must show the final checkout screen with the finalised price. If the business doesn't do this, it is the business committing fraud. PayPal is rather good at holding payments from businesses until they are happy everything is legitimate.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#9This confuses the heck out of me every time I have to work with the Paypal API. I never understood why they implemented it this way. It makes absolutely no sense IMHO but has always been this way. I'm surprised that this isn't used much more often for fraud.
Some businesses store their delivery costs at PayPal (by country), rather than on their own servers. Hence, they have to go to PayPal to determine these costs. But then, that's just rather poor implementation on part of the retailer.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#10This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…
True, but how many customers read the documentation? If that's the way it is, the user should at least be told that on the checkout screen.
It doesn't really matter because the customer isn't on the line. It's PayPal that is. Considering how fanatically PayPal fights fraud, that they don't consider this an issue pretty much tells you that it isn't one.