Um ... no. The sandbox should only allow transactions from sandbox accounts. Which means the customer could not actually complete checkout (and no order would show in the store) since they would need your sandbox account master password before being able to complete a transaction. At least as far as Express Checkout or Website Payments Pro are concerned.
There are two ways to confirm that the customer has not actually paid anything: (a) ask the customer for a copy of the PayPal receipt; (b) call PayPal tech support and get verification. Practically speaking, if the money has not arrived into YOUR PayPal account, then the customer hasn't paid yet. (Of course, this assumes you specified a valid PayPal account and/or API credentials when setting up the module.)
The other possibility is that you specified an email address in the Website Payments Standard module, where that email address is not actually registered to a valid PayPal account. In which case, that email address will receive a message from PayPal stating that money is waiting to be claimed and that they'll need to set up a PayPal account using that email address in order to claim the funds.
If all that confuses you, talk to PayPal. They're the ones who can tell you where the money is, even if it's still in the customer's account, with or without a hold on it.
Chances are the money never went anywhere. But, that's up to you to confirm.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
