Refund of In-App Purchase

The Exploit:

Requesting for refund of in app purchases.

How it works?

For most freemium games, we have in-app purchases but we only design it such that when the player purchases it, we will reward them with some in-game currency.

For the fraudsters, they buy some IAP and after which, request refunds from Google/Apple. Most developers do not check if past receipts are still valid. Hence the player actually gets free in-game currency.

How to fix it?

Check for validity of past receipts whenever the game starts and deduct in-game currency if there are any discrepancy. Allow your in-game currency to go into negative and after multiple times, you can choose to ban the player.

How to check for validity of purchases?

Google Play have provided a nice article and API for checking refund frauds:

Prevent Refund Frauds

For Apple App store, you can check the receipts: Receipt Validation

For those using Unity API, you can use Unity IAP API: Unity Receipt Validation

Hope this article helps some developer out there..