Paypal Payment $0.01 - WTF?

[Scorpion Ghost]

I just received a payment via Paypal from one of my websites for $0.01.

The service purchased actually costs $51.99. And in fact, somebody bought this same services a week ago, and it came through fine. I also just went through the payment process for the product, and on Paypal I get the correct amount.

The buyer is from the Philippines. I can see Philippines in my analytics as their IP address (Cagayan De Oro City, Cagayan De Oro, Philippines, Philippine Long Distance Telephone), and I can see Philippines as their Paypal information on the payslip.

What kind of insanity is this? Is this some sort of scam, or could it be a glitch of sorts?

 

[Deleted Member 112605]

What kind of insanity is this? Is this some sort of scam, or could it be a glitch of sorts?

I've had this done to me, too.

I think there's a method that tricks PayPal into making the price $0.01. It's done by manipulating the files that process the payment. Highly illegal.

Or it could be just a glitch, but I know there used to be a way to make payments one cent.

 

[Scorpion Ghost]

See

And

I've had this done to me, too.

I think there's a method that tricks PayPal into making the price $0.01. It's done by manipulating the files that process the payment. Highly illegal.

Or it could be just a glitch, but I know there used to be a way to make payments one cent.

See the screenshots in my last post.

I Googled it and it seems it's been done before.

The service the person bought from me could be automated delivery, but I don't have it set up to be automated, I process the orders manually. Good thing because if it was automated, this is a $52 dollar package, I'd be at a loss here.

Well... I'll contact the person. They gave their email (which could be fake) so I'll send an email to it and see if I get a reply.

Be careful everybody. Fucking internet man...

 

[Vintage Wolf]

You using 3rd party plugin or something to place PayPal on your website?

 

[macdonjo3]

Haha - age old trick. Used to get these attempts all the time with my last company.

If you manually fulfill then you're good. Enjoy the free penny lol.

Hackers play with the client-side scripts to get the IPN to fire a purchase for $0.01. Lazy and budget programmers don't implement the IPN per-spec (aka checking the received amount) and sometimes you can get a free info product by doing this.

 

[Scorpion Ghost]

You using 3rd party plugin or something to place PayPal on your website?

No, I'm not. The paypal code is hardcoded on each page and for each service, and the price for each service is fetched from one main php file. This also makes it easy to change the price for any service from one central place.

 

[macdonjo3]

This also makes it easy to change the price for any service from one central place.

Easy for the hackers too.

 

[Scorpion Ghost]

Haha - age old trick. Used to get these attempts all the time with my last company.

If you manually fulfill then you're good. Enjoy the free penny lol.

Hackers play with the client-side scripts to get the IPN to fire a purchase for $0.01. Lazy and budget programmers don't implement the IPN per-spec (aka checking the received amount) and sometimes you can get a free info product by doing this.

See my screenshot, no free penny, Paypal TOOK it from me

haha

Well I'm glad nothing gained nothing lost. All good

Easy for the hackers too.

You don't think my site was hacked? I checked the site and payment process a few minutes after the payment was made and everything is correct.

 

[MrRandQm]

Your IPN code is not waterproof, it's that simple. I've had a guy trying exactly things like that to test my code if there was no holes in it.
Make sure to read the docs carefully of your payment provider to implement safely. Don't half ass things like this

 

[patadeperro]

Aren't they able to do this with virtual credit cards?

 

[macdonjo3]

You don't think my site was hacked? I checked the site and payment process a few minutes after the payment was made and everything is correct.

No, it's not hacked. It was manipulated on the client-side. You're fine. No damage done.

 

[SpoonFeeder]

It's an age old exploit. I believe the site is still using the old Paypal Standard payments.

https://developer.paypal.com/docs/checkout/how-to/server-integration/#how-a-server-integration-works how you want to set it up and https://developer.paypal.com/docs/checkout/integrate/ your current setup.

 

[Notion]

This is done with an extension I believe. Shady stuff.

 

[Deleted member 657006]

it usally when using the reguest php code, so in the url can change the price .

like this

whatever.com?price=15.00

request price what £15

but the hacker set a varable before post to

00.01

so you get that amount

that why we all use post and change varables names

hope u understand

even if there a md5 on the money on the link still works as md5 one way cript .

this is usally caused from copy and paste programmers selling ipn paypal code on there themes .

the problam is anyone can learn programming but understanding secuity while programming confuse them so you get secuity holes in the codes

 

[Scorpion Ghost]

Thanks for all the information you guys. I appreciate the replies.

So basically the person who tried to exploit me lost $0.01 cent. I lost nothing. I didn't gain anything either because Paypal STOLE that $0.01 cent from me, and now I'm poor and miserable

 

[BassTrackerBoats]

now I'm poor and miserable

See, every cloud has a silver lining.

 

[Deleted member 657006]

Thanks for all the information you guys. I appreciate the replies.

So basically the person who tried to exploit me lost $0.01 cent. I lost nothing. I didn't gain anything either because Paypal STOLE that $0.01 cent from me, and now I'm poor and miserable

you done very wel,l and so glad not automated download fully checked, well done deserve 10/10 for that, you beat the hacker !. your thinking when desiging your business concept was good.

 

[umerjutt00]

lol. You got 1 penny and then paypal took it too

 

[super11]

Ya, this has happened to me a few times ( about 5-6 years back) when I was selling somthing (non-physical item) on my site. I thought this manupulation was fixed. Surprisingly, it still exists.

The eventual goal of the scammer is to fool the website creator into believing that a payment is received...so ship the item. What happens is when you have a single website and you offer a single service, you sometimes don't check the amt and other stuff before delivering the product. I remember, I was almost about to deliver the item and stopped to check my email and realized that the payment was only one cent. Didn't lose anything at the time but lost about an hour or two trying to find out if there was a flaw in my website or not.

 

[hem98]

Seeing the topic I thought payment of 0.01$ is possible.