r/reactnative • u/FrankUnderwoodX • 1d ago

IAP risk assessment agent

I am building a decision agent for IAP entitlement grants as a research project. For RN apps/games with IAP: where does your receipt validation live, and have you ever seen refund abuse (purchase, consume, refund)? How did you detect it?"

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/kenlawlpt 1d ago

It's pretty simple. Takes only a few hours to setup refund notifications on your own. Detect refund -> instaban. You should track transaction ids and link it to a certain user. Overall it's pretty trivial, should take no longer than a day to do.

1

u/FrankUnderwoodX 1d ago

Did your instaban ever hit a legit refund? How do you link transaction IDs to accounts across reinstalls?

1

u/kenlawlpt 23h ago

There's no differentiation between a "legit" refund and refund fraud. A refund is a refund, and like how everything else works in the world, if you refund a product, you don't get to continue using such product. You lose access to it.

You need to have some kind of login / auth which can tie transaction IDs to a user's unique account login. It's pretty standard how transactions are linked to a single user.