问题描述
我们注意到，在我们的服务器上有很多应用帐单付款记录，这些记录未反映在Google Play订单管理中。在查看收据后，我们注意到订单管理与不存在订单管理之间的差异。对于那些不在订单管理中的人：
- （总是）订单ID显然使用旧版本：3925053605191231569.4699441885150531
- （总是）purchaseToken非常短：neliazyrqesvgwagglfwccfa
- （通常）title几乎是IAB项目ID，没有下划线：standardannual subscription b $ b
- （通常）描述几乎是IAB商品标识，没有下划线：standardannual_subscription
- （通常）价格是错误的，没有面值（例如0.11 或0.26，而不是59.99美元）
下面是一个传递和一个失败的订单收据。
阅读后，我的印象是，这可能是欺诈性的收费，但没有直觉的可能性。如果这不是欺诈性收费，我们确实有很多动机来弄清楚，因为我们会把钱留在桌上。 Google Play的帮助团队已确认它不会是无效的信用卡或网络连接不正确。任何关于将要发生的事情的想法都会很棒。
收据失败
传递收据
解决方案最明显的是通过类似于详细描述的流程获得的欺诈性交易。
要确认怀疑，请尝试离线验证失败收据的签名（使用作为Java或Ruby的指导），并且很可能它不会通过它（因为在您提供的示例中，解码后的长度为239个字节，而不是预期的256个），因此表明这是一个欺诈行为
只是为了总结更广泛的欺诈性症状：
- 订单管理控制台无法找到这样的订单
- 旧格式的订单ID以格式
[商家ID]存在[实际订单ID] - PurchaseToken似乎有短的/随机的/意外的长度
- 订单签名验证失败
如果您发现了其他内容，请发布您的调查结果
We've noticed that are a lot of in app billing payment records on our server that aren't reflected on Google Play Order Management. After looking at the receipts, we've noticed several differences between the ones from Order Management vs the ones that aren't there. For those that aren't on Order Management:
- (Always) Order ID is apparently using the older format: 3925053605191231569.4699441885150531
- (Always) purchaseToken is quite short: neliazyrqesvgwagglfwccfa
- (Usually) title is almost the IAB item id, without an underscore: "standardannual subscription"
- (Usually) description is almost the IAB item id, without an underscore: "standardannual_subscription"
- (Usually) price is wrong and without the denomination (such as "0.11" or "0.26", rather than "$59.99")
Below is a passing and a failing order receipt.
After reading, my impression is that it's possibly fraudulent charges, but don't have an intuition as to the likelihood. If it isn't fraudulent charges, we do have a lot of incentive to figure it out as we would be leaving money on the table. Google Play's help team has confirmed it wouldn't be an invalid credit card or spotty internet connection. Any thoughts on what would be going on would be awesome.
failing receipt
passing receipt
解决方案It is most obviously a fraudulent transaction obtained through a flow similar to described in details here.
To confirm the suspicion, try offline validation of the signature of a failing receipt (use this question as a guidance for Java or Ruby) and most likely it will not pass it (as in your provided example signature is 239 bytes long after decoding, instead of expected 256) thus indicating this is a fraud one
Just to summarize wider fraudulent symptoms:
- Order Management console fails to find such order
- Old-style order id present in format
[merchant ID].[actual order ID] - PurchaseToken seems to have short/random/unexpected length
- Order signature validation failures
Please post your findings if you're discovered something otherwise
这篇关于在应用帐单购买不在Google Play /奇怪收据上的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！