CBSubs Paypal Gateway Incorrectly Marking Payment as Complete

Hi Guys,

I've had this issue a few times now and it's really disturbing. This time someone purchased an $819 software program and my team sent them the license file as CBSubs marked it as complete. Paypal though shows that the payment/subscription was created and canceled at the exact same time and no money was actually paid. The buyer got our product for free.

Situation: The user signed up for a $799 program (1 plan, single pay) and a $20/mo (1 plan, subscription) at the same time.
CBSubs shows 3 logs in the history, the initialization, the payment cleared and then the cancellation, all occurring within 40 minutes but PP shows it occured during the same minute (21:11:00). CBSubs: Created but not paid yet: 21:09:09, Completed: 21:11:00, Cancelled: 21:41:29


Paypal shows a subscription being created and canceled in the same minute.

This is the Paypal Pro gateway.

I have PDF's of the records from PP and CBSubs that I don't want to post here as they have some private info on them. If someone can let me know where to send them, I'll do so asap. This is a huge problem and obviously just cost us quite a bit of money. Going back through our records it looks like it's happened at least 3 or 4 other times recently.

Is "Accept payment once" set to "Payment is authorized and captured (means completed)" within your PayPal Pro gateway? Otherwise it's accepting payments before the full authorization process. If it is set to that then I don't see how this is possible as an API request is sent to PayPal to verify the payment was completed; I don't know how they could be tricking PayPal into reporting completed, but cancelled at the same time.

Hi Kyle,

Yes, "Payment is authorized and capture" is selected for the gateway. The same thing happened again this weekend. I contacted Paypal and they directed me to their API support team. I'm still waiting for a response from them. The support person I talked to said she can see that a profile was created (as it was 2 plans, a one time purchase and a subscription) but then the buyers bank rejected the payment as a risk (possibly because of the amount, though we ran it via Authorize.net later, just fine). The oddest part is on the CBSubs logs I can see the subscription creation and a log for a verification that the payment went through. I'm stuck here as our system is sending out licenses to people who haven't actually purchased our software. I'm afraid this has been happening more and I just haven't caught it like I did this time.

I'm not sure what to advise then. PayPal created the subscription profile and reported it's paid successfully then I guess a day or hours later the payment was rejected, but an IPN wasn't sent to CBSubs to cancel it. If PayPal doesn't send an IPN to let CBSubs know it was cancelled then CBSubs can't do anything about it. When their API support gets back to you I suppose suggest that they send a profile cancellation IPN when this happens and if they already do send some form of IPN we'll need more details about it so we can add support for that IPN.

It all actually happened within seconds. Their IPN/API team reached out to me so I'm waiting to see what additional information I can get and will pass it on here.