Our client sells several products in an online shop (our software) for a especially low price on the first purchase. Further purchases of each product will fallback to the regular price.
E.g. product costs 10 EUR on the first purchase (quantity fixed to 1) and 20 EUR each on the next purchases (any quantity).
To prevent customers playing tricks and attempting to order products more than once, we compare e-mail, name/address before accepting any order. Although there are still ways to bypass this, we block most naive attempts. Thus customers usually order once and never come back (that’s fine, it’s solely purpose is product promotion).
However, we just encountered a case where a customer tricked our system. But first, let me explain how our checkout works: When hitting the “buy button”, we generate an unique transaction with all order details and redirect the customer to the payment gateway (e.g. PayPal Standard). As soon as we receive a valid and successful payment notification from the payment service provider (e.g. PayPal IPN), this transaction is converted to an actual order. Since the ordered products are now considered purchased, we would block further attempts to purchase them for the lower price.
The said customer did the following to trick the validation: He opened a second browser tab of the summary page with “buy button”. He pressed the “buy button” in each tab resulting in two browser tabs (1st tab with transaction ID 1234 and 2nd tab with transaction ID 1235 – same session). The customer then paid for both transactions (e.g. on PayPal) and thus successfully generated two orders with the same products for the low price.
While it is possible to detect such a case or even deny the second purchase here (additional validation after payment notification), we still would need to deal with the money paid by the customer. Is there any technical way to prevent a simultaneous purchase to begin with?
You say:
When hitting the “buy button”, we generate an unique transaction with all order details and redirect the customer to the payment gateway
So why wouldn’t you check the customers second purchase against this transaction that you have in your database. Even if it’s pending and waiting for the payment it still could be used to block any further orders. At least until the customer either cancels this transaction or it times out.
If you don’t store this transaction iun the database you should do so and add a flag like “pending”.
1
This is hard to prevent, so your best attempt may be to display the customer always the full price (and let him transfer the full money), but display an additional notice under the price that he will get a refund afterwards if it turns out that his purchase was the first. So he may get this message in each browser tab twice, but you don’t guarantee him that he will get the refund twice, only tell him that he may gets the money back. This puts you in the situation where you can check what the customer really purchased afterwards, and send him the correct amount of money back when you know for sure what he ordered.
I understand that this may not be ideal since it will make the whole money transfer more complicated, and you need a payback channel for each payment method, but I actually don’t see how to solve this differently in a manner where you can be sure you won’t get tricked.