Block Customers' Paypal Email Address or PAYERID?

Does anyone know if there is a way I can block payments from an email address? I've contacted paypal but not heard anything back, is there anything I can do in the store? The person has been banned and also their IP has been banned from the site but they change their IP and register to the store in another name but their paypal address stays the same. I need to block their paypal address due to their breach in the conditions of use and copyright infringement.

Thank you.

That's a tough one ... because they can register several other email addresses at PayPal just like they can do in your store.

Are they violating *your* TOS? or PayPal's TOS? In what way?
Are they committing fraud? theft? If so, maybe it's worth reporting them to PayPal as thieves ... maybe that's a workaround (if it's true)?

Thank you :smile:

They are violating our tos at the store, they are buying and downloading the downloadable products and then sharing them at various file sharing sites and also sharing through yahoo groups. When they are approached to please stop they are rude, nasty and do it more, it's becoming a real pain! It's annoying that despite banning their ip they stil manage to come back with another. I finally heard back from paypal and they weren't much help at all! They said it can't be done, can you do anything in a zen store to block the paypal addy?

Thank you for your time,

Here's what paypal said:

Thank you for taking the time to contact us with your concerns. I am happy
to assist you further.

We offer a feature which allows you to decide how to deal with certain
types of incoming payments.

I am afraid that there is no option for you to blocked specific email
address in your PayPal account.

You can change your payment receiving preferences by following these steps:

1. Log in to your account at www.paypal.co.uk
2. Click ‘Profile’ near the top of the page.
3. Click ‘Payment Receiving Preferences’ in the ‘Selling Preferences’
column.

On this Payment Receiving Preferences page you will be presented with the
following options:

1. Block payments sent to me in a currency I do not hold
• This setting allows you to choose to accept, deny or be alerted each time
you receive money in a currency which you don’t have an open balance for

2. Block accidental payments: You may prevent accidental payments by
blocking duplicate invoice IDs.
• This setting allows you to prevent a buyer paying you twice for the same
item or to allow multiple payments with the same invoice ID

3. Block payments from users who initiate payments from the Pay Anyone
subtab of the Send Money tab.
• This setting allows you to redirect buyers to the payment section of your
website if they try to send money directly through their PayPal account.
This is useful for you if you need specific order information which comes
through when a buyer uses your website to make their payment

4. Block the following payments: Pay with eCheque or German bank transfer
for all website payments except eBay (Note: You may not block eCheque
payments on eBay)
• This means that customers must use an instant payment method and you
don’t have to wait for an eCheque to clear
• Please note that this preference does not allow you to block eCheques
that are sent using the Send Money flow

5. Display ‘Add Instructions to Seller’ text input field:
• This allows you to give the buyer the option to send you a message with
their payment, sometimes used for specific instructions about their
purchase

6. The Credit Card Statement Name is the name that will appear on your
customers’ credit card statements. The name can be 11 alphanumeric
characters in length, including spaces.
• You can enter what you would like your buyers to see on their credit card
statements in the text box here

Finally once you have selected your preferences, click 'Save'.

It is my pleasure to assist you. Thank you for choosing PayPal.

There are a couple options:

1. Report the customer to PayPal as fraud. Maybe they've had complaints from others too, and their account might get terminated as a result.

2. PayPal transactions occur between your merchant account and the customer's PayPal account. They have an account number assigned. You could write some custom code into your PayPal module to check whether a certain customer account number has been used, and take appropriate action. Depending which module you're using you could possibly do an immediate refund and cancel the order, or you could prevent checkout at all, or you could at least leave the order in a "pending review" status so the download isn't made available until you get a chance to review it ... at which time you could do a manual refund and cancel the order. There are various options, all with varying programming complexities depending on how you want to handle it.


Either way, blocking one account doesn't stop the customer from coming back and using another PayPal account.

Thank you so much :smile:

I've sent another long email to paypal so i'll see what I can do with that but I don't expect a reply from them in a long time and I don't suppose they'll be too helpful judging by my previous experiences of their customer service lol!

I'm using the PayPal IPN Website Payments Standard module in my zen store. It would be great if I could do something that could prevent checkout, what sort of thing can I do because I wouldn't have a clue where to start with a custom code for the paypal module. I think that would be enough to deter them from coming back if they couldn't check out :wink2:

Thank you so very much for your help!

It's much more complicated with Website Payments Standard. It's much easier with Express Checkout.

Ok, thank you. Would it be better if I changed it to paypal express checkout then? Would it still work the same as the website payments standard with the auto redirect to the store for instant downloads? Also I have the paypal push order mod installed, would it work with that too?

Thank you so much for your time to stop by and help me out with this :hug:

I've changed it to PayPal Express Checkout now with no problem, how can I now prevent the persons email address from reaching the checkout?

Thank you!!

1. With Express Checkout, you need to also click "Remove" on the IPN/Standard module in Admin->MOdules->Payment

2. The "push order" mod serves no purpose with Express Checkout because Express Checkout doesn't have the limitations that Standard has.

3. You'll need to look up the offending customer's "PayPal Account Number" in your paypal records before you can do anything about blocking them.

I removed the PayPal IPN module, I tested the store with express and all was well and then realised that the paypal pushorder wouldn't be needed lol! Paypal Express is much better, I don't know why I didn't use it at first! Thank you!

I have the offending customers account number :wink2:

Thanks again! :hug:

Around line 1786 of your /includes/modules/payment/paypalwpp.php file you have code that looks like the following. Add the additional highlighted code as shown:

Code:

---

    // get the payer_id from the customer's info as returned from PayPal
    $_SESSION['paypal_ec_payer_id'] = $response['PAYERID'];
    if ($response['PAYERID'] == 'PUT_PAYER_ID_HERE') {
      $this->terminateEC('Sorry, your transaction cannot be completed at this time.', true, FILENAME_CHECKOUT_SHIPPING);
    }
    $gender = '';

---

And replace PUT_PAYER_ID_HERE with the customers ID you received from PayPal, for the customer for whom you wish to deny payment.

Just to clarify so I get it right, I replace 'PUT_PAYER_ID_HERE' with their Payer ID which is the 13 digits of letters and numbers, nothing else, just 13 digit Payer ID?

And this code stops them from getting to the checkout?

And thanks again so very much for taking the time to help me out with this! :hug:

Right. If their payer ID is "ABC1234567890" then you'd use:

Code:

---

    if ($response['PAYERID'] == 'ABC1234567890') {

---

Keep in mind that I've not tested this code. But I've no reason to believe it won't work properly.

Also note that you'll have no record of the customer's attempt. They'll just be taken back to the checkout screen, probably even being prompted to login if they haven't already.

Thank you!!!!!!

I just tested it on myself and it worked a treat!!!

I can't thank you enough! You really do deserve a medal for all you do and all the help you give others! :hug:

Glad it's working for you.

No medals required ... but if you're able to do something here we'd appreciate it: http://www.zen-cart.com/donate

Thank you :smile:

I happily made a donation for your help, wish it could be more but maybe after xmas I can do more lol! :wink2:

Thanks! Wishing you well with your holiday sales.

You're welcome and thank you! :smile:

I was just wondering if I needed to add another payer ID how would I add it to the code?

Quote:

---

Originally Posted by Opal

I was just wondering if I needed to add another payer ID how would I add it to the code?

---

Here's an example of 3:

Code:

---

    if ($response['PAYERID'] == 'ABC1234567890' || $response['PAYERID'] == 'AnotherNumber' || $response['PAYERID'] == 'AgainAnotherETC') {

---

Thank you so much once again! :hug:

Dr. Byte, I was just wondering, I have updated my zen store to version 1.3.9h and I noticed that the line I had to edit for this in the paypalwpp.php has now changed to around line 1638. It also has additional text added to it: $this->notify('NOTIFY_PAYPAL_EXPRESS_CHECKOUT_PAYERID_DETERMINED', $response['PAYERID']);

Where would I now put the block code for the new updated paypalwpp.php file?

Do I replace it with:

$_SESSION['paypal_ec_payer_id'] = $response['PAYERID'];
if ($response['PAYERID'] == 'PUT_PAYER_ID_HERE') {
$this->terminateEC('Sorry, your transaction cannot be completed at this time.', true, FILENAME_CHECKOUT_SHIPPING);
}
$gender = '';

or do I add after?

Thank you.

There's an even better way, which now means you won't have to edit the PayPal PHP file anymore!

That line that's replaced the part you were inserting before now allows the logic for your custom change to be handled by another file altogether. And that means it's easier for you to maintain the list without having to hunt through a huge long file to re-make the changes whenever an upgrade happens, or when you want to add another ID to the list.

Create two new files on your server, as follows:

1. /includes/auto_loaders/config.paypal_restricted_buyers.php

Code:

---

<?php
/**
 * Autoloader to instantiate observer class
 */
$autoLoadConfig[200][] = array('autoType'=>'class',
                              'loadFile'=>'observers/class.paypal_restricted_buyers.php');
$autoLoadConfig[200][] = array('autoType'=>'classInstantiate',
                              'className'=>'paypal_restricted_buyers',
                              'objectName'=>'paypal_restricted_buyers');

---

2. /includes/classes/observers/class.paypal_restricted_buyers.php

Code:

---

<?php
/**
 * Deny certain PayPal buyers (intended only to be used when certain buyers are chronic refunders or fraudulent but PayPal isn't shutting them down)
 *
 * @package observers
 * @copyright Copyright 2003-2011 Zen Cart Development Team
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: class.paypal_restricted_buyers.php 18039 2011-03-08 20:53:35Z drbyte $
 */

class paypal_restricted_buyers extends base {
 /**  constructor method !
  *
  * Attach observer class to the global $zco_notifier and watch for a single notifier event.
  */
  //function paypal_restricted_buyers() {  //use this line if using old version of PHP (4 or lower), instead of the next line
  function __construct() {
    $this->attach($this, array('NOTIFY_PAYPAL_EXPRESS_CHECKOUT_PAYERID_DETERMINED'));
  }
 /**  Actual Method that does the desired activity
  *
  * Called by observed class when any of the notifiable events occur
  *
  * @param object $class
  * @param string $eventID
  */
  function update(&$class, $eventID, $paramsArray = array()) {
    $denied = array();


    // Set list of denied PayPal PAYERIDs here:
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';
    $denied[] = 'PUT_PAYER_ID_HERE';

    //repeat additional lines ABOVE as needed, following the same pattern

    //---------------------------------------------------
    // Do not touch below:
    foreach($denied as $key=>$val) {
      if ($val != '' && $val != 'PUT'. '_PAYER_ID_' . 'HERE') {
        if ($paramsArray == $val) {
          $class->terminateEC('Sorry, your transaction cannot be completed at this time.', true, FILENAME_CHECKOUT_SHIPPING);
        }
      }
    }
  }
}

---

The part in red is the only thing you'll edit. Everything else should work exactly as-is.

I recommend testing with your own ID for verification.

Thank you so very much Dr.Byte! It's very much appreciated!

Dr. Byte,

does this new method in 1.3.9h still work only with paypal express checkout, or can it be made to work with PayPal Website Payments Standard?

I gotta couple of problem buyers with the same problem as the original poster.

Due to PayPal's architecture of Website Payments Standard, this method cannot be used with that module.
It can be easily used with Express Checkout though, as described above.

After yet another raid on my site yesterday by someone who buys my digital downloads and puts them on auction sites I did a quick hack on my site. I am still using PayPal Website Payments Standard and am more of a DBA than a programmer so put my DBA hat on and created a trigger on the paypal table. It checks the Paypal payer_id of any new entries against a lookup table of banned id's and, if it finds a match, changes the order to Pending so that they don't get a download button. I can then cancel the order and refund the payment at my leisure.

I am sure it won't stop them if they are determined but it made me feel better :smile:

Hi all,
Resurrecting an old thread, but this interests me greatly.

We have a repeat offender (digital downloads) and we've blocked him via both our .htaccess file and through our Gateway.
We use Paymate, and the slippery little sucker got through both of our restrictions, I am now looking at a full country ban.

Can the above be adapted to use for Country ID/Code/Name as Paymate do not accept the country at all.

I like the solution in #23 by Dr. Byte as it is elegant, and can be run independantly, which means it's safer in some respects to alter. Having it adapted for more than 1 gateway, would be fab.
http://www.zen-cart.com/showthread.p...00#post1004800

Great work.

Yes it can. You just have to edit your paymate payment module code and find where it processes responses from the gateway, and then inspect the transaction details for whatever criteria you're able to use to identify bad buyers. Your best bet for help with that is to talk to the Paymate folks, since they're the experts on what you can use to determine bad buyers.