Rejected Payment Method Can Be Reused on Different Accounts
Product/Feature: Blocklet Store - Subscription/Payment Processing
Severity: High (Potential for abuse, poor user experience, and payment processing issues)
Status: Open
1. Description
The Blocklet Store payment system allows a user to successfully subscribe using a credit/debit card (ATM card) that was previously rejected or declined when attempting a subscription on a different user account.
This indicates that the system is only checking the card's validity against the current account's transaction history, rather than checking the card's global status (e.g., if it was permanently declined, reported lost/stolen, or if the issuing bank has flagged it for repeated failed transactions).
2. Steps to Reproduce
- Account A: Attempt to subscribe to a Blocklet using a specific ATM card (Card X).
- Ensure the transaction for Card X is rejected/declined by the payment processor (e.g., due to insufficient funds, an expired date, or a bank block).
- Log out of Account A.
- Log in to Account B (a different user account).
- Attempt to subscribe to the same or a different Blocklet using the same Card X.
3. Expected Result
The subscription attempt on Account B using Card X should also be rejected, especially if the previous rejection was due to a permanent or non-transient issue (e.g., the card is expired, canceled, or flagged by the payment processor).
If the card was rejected for a transient reason (e.g., temporary insufficient funds), the system should still perform a fresh, full validation check, but it should not allow a subscription to proceed if the card is known to be invalid or permanently rejected by the payment gateway.
4. Actual Result
The subscription attempt on Account B using Card X is successful, despite the card being rejected on Account A.
5. Potential Impact
- Financial Risk: The system may accept a subscription with a payment method that will ultimately fail to process the recurring charges, leading to revenue loss and administrative overhead.
- Security/Abuse: Allows users to bypass payment blocks by simply creating new accounts.
- Poor User Experience: Creates confusion if a user is told a card is rejected on one account but works on another.
6. Environment
- Application: Blocklet Store
- Feature: Subscription Checkout / Payment Gateway Integration
- Payment Method: ATM Card (Credit/Debit Card)
1 reply
Payment Kit has no permission to verify the card status and does not assume the responsibility for such verification; the relevant verification is not performed by Payment Kit. Instead, during the actual payment phase, it is completed collaboratively by the card issuer and Stripe, and the availability of the USD account will also be confirmed simultaneously in this process.