Fraud attempt on my store, possibly a bug

Hello,

Today, I received an order totaling about $2,000. However, upon checking my payment gateway portal, it appears that the payment made by this individual was only $3. I am puzzled by how this could have happened. I have been using OpenCart 2.0.3.2 for many years and have never encountered something similar. I'm not explicitly stating that there is a bug in OpenCart; it could potentially be a bug in the payment gateway plugin itself. Does anyone have any suggestions on what I should do regarding this issue? Does anyone have an idea of how this person was able to do it?

Thanks

Some payment extensions can have that issue. For example the PayPal Standard module can have the value changed on the checkout page to a lower value. However, if that happened the order status would be set to the default one (so make sure it is set to something clear and unique) and you would see a PP_STANDARD :: TOTAL PAID MISMATCH! error in the OpenCart error log.

What payment extension are you using?

Hi there,

I'm using Moyasar Payment Gateway. I think this is a serious issue that could potentially incur substantial costs for store owners if they don't pay attention for this kind of transactions. I've reached out to Moyasar regarding this matter, and they confirmed it's a fraudulent attempt on my store.

Consequently, they have blocked the credit card associated with this fraudulent activity on their system and assured me that they're working on updating their plug-in as for me not sure what should I fix on my store to avoid this from happening again the plugin setting is very basic not much to do.

I attempted to replicate the same action they performed on my store to understand how they did it, but I couldn't ascertain the exact method they used.

It sound it may be an issue with the payment extension it they are going to release an update. Until then or you know what happened manually checking the order value matched the amount received may be only thing you can do.

Will do, thanks!

If you haven't already done so, you should check your server's access log, to see what exactly happened, and how the fraudster managed to do it. The access log may also show calls from the payment gateway back to your OpenCart server.