CODEWITHSUNDEEP
phppaypal
Omar Abid
Omar Abid

Reputation: 15966

PayPal ExpressCheckout flow issue

I have implemented PayPal ExpressCheckout in my website. It worked fine, but I have a problem with the process flow. From what I did unerstand

  1. Your website gets a token, and then redirects the user to the PayPal website.
  2. The user login to his Paypal account. Then he is redirected to your Website.
  3. You process the payment in your website.

The problem is that the payment is actually processed in your website. It's possible that you charge the user any amount without even him knowing that. Isn't that a reasonably terrible security issue?

Am I missing something?

Upvotes: 0

Views: 97

Answers (2)

Robert
Robert

Reputation: 19356

You can't process a token with a higher amount than the buyer initially authorized (there are ways around this if you need to, with Reference Transactions, but that's not in the scope of this question).

Upvotes: 0

Explosion Pills
Explosion Pills

Reputation: 191819

Yes, you can come up with the amount to charge the user, but charging them for more than the amount you show them would be fraud and probably theft (i.e. highly illegal), especially if you provide a receipt and the amount on the receipt does not match the charge. Many credit card companies have a limit for large charges and will put a stop on them, or at least ask the holder if the charge is legitimate.

By the same token, you could give your card to a waiter in a restaurant and they can charge whatever they want to it before bringing it back to you. Offline credit card fraud is still much more prevalent.

Upvotes: 1

Related Questions