prevent use of hacked paypal accounts

[yorksred]

I have a store selling digital only products  which are instantly downloadable after purchase.  The problem I have is every so often I get  a number of products purchased with what I presume are stolen/hacked paypal accounts. I then get emails from the owner of the accounts or disputes from paypal. which puts pressure on my paypal account and which has resulted in my account being permanently limited in the past.

The only way round this I see is to put a note on the registration form that if paying via paypal their registered email must match their paypal account.  This way I could check it before completing the purchase and sending them the link to their paypal email.  This is really how a store should work anyway digital products should be sent to the paypal email address not the address they use to signup with., even a physical product should be sent to the customers paypal address. 

I want to keep products as a digital product with a download link. So is there a way to manually complete a digital product purchase. ie keep it processing even after successful paupal purchase.  At first I thought about just editing the digital download email but the product would still be downloadable from their account.

When a digital purchase has been made where can I change it so the status is updated to processing rather than complete

Thanks

 

 

 

 

 

[Noodleman]

the best solution is don't us PayPal, they suck quite badly ad digital goods as I learnt recently in a similar dispute.

PayPal do not cover digital goods in thier seller protections, I would look at other providers

[Dirty Butter]

There is a checkbox on the Standard PP - Plugin for email address override that I have unchecked. Don't know if that would help you or not.

[yorksred]

not using paypal isn't really an option, tried it before and sales drop dramitically.

the paypal averride box is unchecked for me,  no idea what that is

 

[yorksred]

that email address override seems a bit pointless. It tries to match the post address before you can even try logging into paypal lol. so will always be wrong.   Would be prefect if it made you use the registered email

[Dirty Butter]

Perhaps it could be coded differently so it would require use of the PayPal registered email? I know PP can be set to only accept the buyer's PP mailing address. Can digital buyers be required to register on your site with PP physical mailing address??

I don't use the Pro PP and I don't sell digital, so I can't do anything but grab at straws on this. Hopefully some other digital seller will be along who has solved this one already.

[yorksred]

can anyone at cubecart please help me with this.

is there an edit I can do so that after a successful payment for a digital product via paypal.  the order status  DOES NOT go to order compete but to processing so that I can manually complete the order

Thanks

[bsandall]

I don't have any experience selling digital goods either, but I don't think physical goods should be sent to the PayPal address - customers may need to ship items to a job site, an alternate location, or even be purchasing a gift to send somewhere.

Similarly for digital goods, how would you handle a gift purchase if it forced the digital product to be sent to the PayPal email address?

As to your specific issue: in the PayPal module settings, there should be a 'Payment Action' setting - set that to 'Authorization' instead of 'Sale'. This way PayPal will authorize the funds and allow you to review the order before manually capturing the funds from within your PayPal account. You will then also need to manually set the order to 'Complete'.

With that setup, you could implement a policy in your ordering process that any time the PayPal and delivery email addresses don't match, you email the customer's PayPal address and request confirmation, giving you both a chance to prevent fraud.

[bsmither]

"When a digital purchase has been made where can I change it so the status is updated to processing rather than complete."

I infer you are willing to manage each and every order made in your store.

The PP gateway and the PPP plugin tell CubeCart what to change the status of an order to once the transaction has been verified (after receiving the IPN). The gateway code could be manually edited to move the order to Pending (as opposed to Processing) on a successful transaction.

An order moved to Processing will also add the download record and make it available to the signed-in customer (Account, Downloads).

In both the Paypal plugin module and gateway module, gateway.class.php, there is a series of statements that test for the VERIFIED results, and moves the order to that respective status.

Look for:

case 'VERIFIED':
  switch ($_POST['payment_status']) {
    case 'Completed':
      $transData['notes'][] = "Payment successful. <br />Address: ".$_POST['address_status']."<br />Payer Status: ".$_POST['payer_status'];
      $order->paymentStatus(Order::PAYMENT_SUCCESS, $cart_order_id);
      $order->orderStatus(Order::ORDER_PROCESS, $cart_order_id);
      break;

From:
      $order->orderStatus(Order::ORDER_PROCESS, $cart_order_id);

To:
      $order->orderStatus(Order::ORDER_PENDING, $cart_order_id);

This change affects all orders made through Paypal, not just digital orders.

[yorksred]

thankyou thats great. the only reason I didn;t want pending was so it would be easy to differentiate between a completed order to review and a order that was ever paid for which would still be classed as pending.

 

but its ok i will just check the order

 

thanks again

[bsmither]

Someone has a mod that adds more Order Status conditions. I don't know how it works. But, perhaps it can add a ORDER_REVIEW status (behaves similar to PENDING).

[Noodleman]

That would be my plugin..

It certainly will do what you want, but might need a couple mods of the code. Essentially it will create new numeric ID's for the order status, hard coded ones are 1=pending,2=processing, 3=completed etc

The module adds new ones with an ID of 100 or higher.You just need to set the order status to the custom ID..

So....

$order->orderStatus(Order::ORDER_PENDING, $cart_order_id);

 

Replace "order::ORDER_PENDING" with the new ID, for example

$order->orderStatus(100, $cart_order_id);

[yorksred]

Thanks for this, I'll  check out the demo of that plugin.