I am confused how this "bug" is any different that using something like the payments pro API. Sure your cart page says you'll charge X amount, there is NOTHING keeping you from charging some other arbitrary amount when they press pay.
> Sure your cart page says you'll charge X amount, there is NOTHING keeping you from charging some other arbitrary amount when they press pay.
Which is exactly why I only use shops with paypal where I see the amount charged on paypal.com if I don't completely trust the shop. I was under the impression that this was the value paypal provides. Apparently I was wrong. Might as well get a prepaid credit card now.
After looking into the issue, we don't think this is in fact a vulnerability. We work closely with our merchants who use Express Checkout to provide them the flexibility they need to complete their transactions in a timely manner so they can offer excellent payments experiences to their customers. We offer robust buyer and seller protection to cover both ends of the transaction and our systems are pretty good at finding and flagging this kind of illegal behavior if a merchant were to start overcharging your customers.
It's different if you are having your customers type in their details, even though they hope you will charge them $19.95, and not double charge them or steal their credit card information - this is a reason why people use PayPal.
But yeah, like you said it is fraud, though a business could argue shipping charges or tax or "addon pricing" or whatever for a small amount (a company I would see doing this is GoDaddy), but larger amounts their PayPal account would probably be banned.
Good luck with that. It's very hard to get your money back when the merchant knows how to answer Paypal's questions. I failed at doing so when a merchant sold me something he could not deliver and then insisted on giving me a voucher instead returning my money.
I wouldn't be astonished to see chargebacks (by buyers who think they were overcharged) resulting from this - that can hardly be in anyones interest.
I asked paypal and they confirmed that there's no limit.
It is a little weird, but since paypal always sides with customers in disputes, it's probably not so bad if you get hit with this.
1) You get the check with a total of food and drink.
2) The waiter/waitress takes your card to the register for authorization.
3) You get your card back.
4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote.
5) The restaurant charges the amount you wrote, but you don't know this for sure until you check your statement.
1) You get the check with a total 2) the waiter hands you a mobile card terminal (like this: http://pay-tec.de/cms/paytec/wp-content/uploads/2014/04/1.jp... ) 3) You put your card in the terminal 4) waiter enters amount to pay + what you said you'd tip 5) You see the total, enter your PIN, press confirm 6) waiter hands you back your card.
It's not a bug, it's the way things should work with more services. PayPal's product may be outdated in many ways, but this is not one of them.
