PayPal Express Checkout: Unsupported country is allowed

I've got a store where multiple countries have been removed from the countries table. If a customer uses the PayPal Express Shortcut button to pay for their order and their country is not present in the countries table, instead of disallowing the unsupported country the country is improperly changed to United States and the order is processed (with the incorrect address).

If, instead, I'd gone to the trouble of restoring all countries to the countries table and disabling those that are not supported by the store, all addresses would be allowed because the countries-table checks performed by the paypalwpp.php module don't include checking that the country is actually enabled.

I'm in the process of evaluating what changes are necessary to correct this issue and wanted to post the symptoms in case someone has already discovered and corrected the issue.

Question which probably would be obvious if the code were reviewed or independently tested, but if paypal express is the method of payment and instead of using the express checkout button payment selection is deferred to the checkout_payment page, this problem does not occur in either country arrangement? (Assuming checkout_shipping doesn't first preclude purchase or is bypassed in standard processing such as with virtual or download product.)

mc12345678, that's the *standard *answer (turn off the Express Shortcut button). My client has seen an increase in customers since enabling the shortcut, so would like the process to function properly.

If you go through the "normal" checkout process, the create-account page won't let you create an account based on an unconfigured/unsupported country.

Yes, it doesn't take any action to deny the sale if the country doesn't match.

Question: If you have a paying customer who has gone to the trouble of authenticating in PayPal and has proceeded through checkout, are you saying your client wants to tell them they don't want that customer's business, and just send them away?

ie: what would you actually like the code to do if the country doesn't match?
Is the action different based on whether the shopping-cart contains virtual vs physical goods?
What's the niche/reason for this merchant refusing sales from certain countries?

DrByte:

Yes, it doesn't take any action to deny the sale if the country doesn't match.

Question: If you have a paying customer who has gone to the trouble of authenticating in PayPal and has proceeded through checkout, are you saying your client wants to tell them they don't want that customer's business, and just send them away?

ie: what would you actually like the code to do if the country doesn't match?
Is the action different based on whether the shopping-cart contains virtual vs physical goods?
What's the niche/reason for this merchant refusing sales from certain countries?
I don't know the reason that the countries were removed initially (they were gone before the store was upgraded to v1.5.4), so I'll need to ask!

If the country isn't configured, I think (in general) that the processing in ec_step2_finish should proceed down the path that's there today if the United States (which is set as the default) isn't configured (without regard to the virtual/physical nature of the cart): The EC process is terminated with a message. It's kind of no different than going through the "normal" checkout process, trying to create an account and finding that your country isn't in the drop-down list. You'll either call/email the store or go find someplace else.

lat9:

mc12345678, that's the *standard *answer (turn off the Express Shortcut button). My client has seen an increase in customers since enabling the shortcut, so would like the process to function properly.

If you go through the "normal" checkout process, the create-account page won't let you create an account based on an unconfigured/unsupported country.

Well good, then that closes the loop on my question (regardless of either a general or unique solution to follow) that there is no specific reason to avoid using PayPal Express as it is still possible to use PayPal Express to accomplish the desired limitation.

The increase in customers is an expected result of using the Express Shortcut button. Agree that it would be a problem for new customers but doesn't address performing the change on a system that has existing customers where a "scrub" is not performed of those "out of the service area". Regardless, the first part about PayPal Express properly prohibiting an out-of-the-service-area purchase when accessed from the checkout_payment page answered my question that could have been asked better. :)

DrByte:

Question: If you have a paying customer who has gone to the trouble of authenticating in PayPal and has proceeded through checkout, are you saying your client wants to tell them they don't want that customer's business, and just send them away?

Well I for one have no intentions of proceeding with orders placed in our online dive shop going to a whole heap of countries like Nigeria, Zimbabwe, Zambia, Iran, Iraq, Ukraine, Uzbekistan, Sudan, Syria, Somalia, Nigeria, Libya, Ghana, Chad, Congo, etc. I don't care if PayPal thinks it's okay, I'm not going to waste time and risk losing money with them.

Best regards, Lloyd Borrett.

We have also experienced this problem, it doesn't happen often so when we see it in the order, usually the warehouse is trying to print the shipping label and it doesn't validate, we then cancel and refund the order. But it would be helpful if it never got to that point in the first place. We have the shortcut from the shopping cart because we got a sizable bump in conversions with it there.

There are likely many users that want to block certain countries due to high incidence of fraud. We do not ship to Indonesia, China, Ukraine, Russia, Thailand due to too many fraudulent orders with stolen credit cards coming from those countries.

lloyd_borrett:

Well I for one have no intentions of proceeding with orders placed in our online dive shop going to a whole heap of countries like Nigeria, Zimbabwe, Zambia, Iran, Iraq, Ukraine, Uzbekistan, Sudan, Syria, Somalia, Nigeria, Libya, Ghana, Chad, Congo, etc. I don't care if PayPal thinks it's okay, I'm not going to waste time and risk losing money with them.

Best regards, Lloyd Borrett.
Again I ask ... is this specific to physical goods, or also for virtual goods?

I'm trying to gather sufficient information to assemble a possible resolution to the problem, which suits all merchants, not just a couple shops.

lankeeyankee:

We have also experienced this problem, it doesn't happen often so when we see it in the order, usually the warehouse is trying to print the shipping label and it doesn't validate, we then cancel and refund the order. But it would be helpful if it never got to that point in the first place. We have the shortcut from the shopping cart because we got a sizable bump in conversions with it there.

There are likely many users that want to block certain countries due to high incidence of fraud. We do not ship to Indonesia, China, Ukraine, Russia, Thailand due to too many fraudulent orders with stolen credit cards coming from those countries.
Thanks for indirectly stating that your concern is related to physical goods, and not related to virtual goods.

DrByte:

Thanks for indirectly stating that your concern is related to physical goods, and not related to virtual goods.

Sorry, I was being a guppy. Yes, we sell only physical goods. We do not sell any virtual goods.

DrByte:

Again I ask ... is this specific to physical goods, or also for virtual goods?

Physical goods for me. But if the goods were virtual, I'd probably still block the same countries.