In one of our Magento stores we were receiving orders with payment method 'Zero subtotal checkout' or as it says in the order grid 'No payment information required'. But actually the orders had a subtotal larger than zero, order amounts were up to € 500,-.
In the logs, we found these orders were pushed to Paypal somehow, but were never paid.
After some digging we found out what was happening.
In the checkout, open up your browser code inspector and change the input for for example Paypal:
<input id="p_method_paypal_standard" value="paypal_standard" name="payment[method]" title="PayPal" class="radio validate-one-required-by-name" type="radio">
<input id="free-payment-method" value="free" name="payment[method]" title="PayPal" class="free validation-passed" type="radio" checked="checked">
Then click Finish Order, you'll end up at Paypal, you just close that screen. The order is already in Magento with status No payment information required, and in our case Processing, which normally is the sign for 'OK, let's ship this'.
So we thought of the following solutions:
- Disable the payment method Zero Subtotal Checkout. But we need to have the Zero subtotal checkout payment enabled, because we use store credit and some coupon codes with 100% discount, so it's necessary to have this one enabled.
- Set the New Order status to Pending. This prevents the order from being shipped, but of course this also goes for orders that are legitimate.
For now we have chosen the latter.
What would be a better solution? Can this be prevented somehow, while maintaing the Zero Subtotal Checkout functionality?