A client reported today an apparent PayPal fraud, where a customer signed a parcel receipt with the deliverer, but then disputed the PayPal payment. Although sending an evidence (signed receipt of the parcel) to PayPal, they decided in favour of the customer. After contacting PayPal support, they pointed out, that the shop is not sending shipping address to PayPal, so they can't proof the receipt is the right one.
In the "Shipping address collection" gateway config, we were using the option "Do not ask for a shipping address at PayPal", which I thought that this just means that PayPal itself will never ask for a shipping address, but if the shop has already collected one, that this still would be sent to PayPal - but it isn't:
// No need to pass a shipping_address if the shipping address collection
// is configured to "no_shipping".
if ($shipping_address && $shipping_preference !== 'no_shipping') {
$params['purchase_units'][0]['shipping'] = $shipping_address;
}
So, the label is quite misleading. We are now using option 3 "Ask for a shipping address at PayPal if the order does not have one yet."
However, Ryan commented in Slack "it should still be sent imo, lemme look". Then compared the mentioned code part with the D7 version, where it was already present (so looks copied from D7 version), and also checked the API docs:
yeah, looking at the API docs, there's no indication we're "not supposed" to pass the shipping in ... no clue why that decision was made
want to open a ticket for it?
ok, so here's the ticket :D
We need to discuss, if we shouldn't just always send shipping info, if we have it (hence, do what the config label supposes). If there's a good reason, why we should not send the shipping info at all, when this config option is selected, then we should at least do 2 things: explain the reason(s) in the code comment + indicate that consequence in the admin UI's option label
Active
1.0
PayPal Checkout
Seems the main thing we need to confirm is that if we pass in a shipping address, can we ensure it is not editable in PayPal? It appears that may require an additional change to add support for SET_PROVIDED_ADDRESS as the shipping_preference. We should then have a follow-up ticket to switch from using the appllication_context object to the experience_context.