● Lab · live engine

Try to cheat it.

Pick a real case, choose how the buyer disputes it, and tamper with it the way a shop, buyer or agent operator might. The server re-runs the real engine on your request. Like an attacker, it has no signing keys. It never calls PayPal.

Or set the facts by hand and see which rule applies.

Case The buyer disputes it as

Tamper with itMerchant Edit one letter of the stored product page, to cover its tracksAgent operator Raise the budget in the record to $300 after the buyer approved itAgent operator Remove the buyer's passkey approval from the recordMerchant Have PayPal pay a different merchant account than the signed page namesAgent operator Claim the order was placed before the pages were signedBuyer or operator Present a record from a different purchase as the record of this order Stronger attacker The record was changed before payment, so PayPal’s custom_id matches the changed record