Sandbox accounts in production being used for Fraud

App & System Services StoreKit
asalvotr OP
Created 2w
Replies 4
Boosts 0
Views 148
Participants 2

Starting a few months ago, we noticed that we are receiving sign-ups to our application using Sandbox accounts. These accounts were not created by us, and certainly do not show up under Sandbox users on App Store Connect.

When we setup In App Payment, our server side validation followed the guidance to always allow sandbox receipts (see https://developer.apple.com/documentation/appstorereceipts/verifyreceipt).

I think we assumed that only Sandbox users that we setup in App Store connect would be allowed to be used with our app. Another assumption was that Apple reviewers could create Sandbox accounts to use to test our IAP sign-up during app review.

How are other developers preventing fraudulent sign-ups from sandbox accounts? Has something changed with In App Payments this year related to sandbox accounts?

Replies  4
Boosts  0
Views  148
Participants  2
asalvotr OP
2w

After reviewing our data more, it's been a rash of sandbox signups over the past week (approximately 40). When we have not been actively testing, we see anywhere from 0-2 a month and there are far more months were we see 0. Always assumed these were Apple reviewers using throw away e-mail addresses.

0
endecotp OP
2w

our server side validation followed the guidance to always allow sandbox receipts

What do you mean by "always allow sandbox receipts"? I hope you don't mean that when you receipt a sandbox receipt, you always just accept the request? The page you linked to says:

"call the production URL https://buy.itunes.apple.com/verifyReceipt first and proceed to verify with the sandbox URL if you receive a 21007 status code."

What exactly are you doing?

0
asalvotr OP
2w

First we try to validate the receipt against the apple production environment. If it returns a 21007, then we try to validate it against the sandbox environment. If that second verification succeeds, we continue with our processing (check for a valid subscription, etc).

0
endecotp OP
2w

OK. I read "always allow" as perhaps meaning that you were not actually validating sandbox receipts. It looks like you're doing it right.

Sorry, I don't have any particular insight into your problem.

0
Sandbox accounts in production being used for Fraud
First post date Last post date
 
 
Q