The Foxy forums are on the move!

We're in the process of moving our forums over to a new system, and so these forums are now read-only.
If you have a question about your store in the meantime, please don't hesitate to reach out to us via email.

Customer not charged shipping

I have a customer that selected USPS 3 day and was charged $0. When I recreate the same order with same products and address I am charged $7.xx. Can you please investigate? Was the checkout form potentially hacked or some other issue?

Store is gonegreen and order is 825482004

  • We had the same thing happen to us three weeks ago. (I did contact support... haven't heard any confirmation or resolution from them, though.)

    This suggests that it's reproducible, at least.
  • brettbrett FoxyCart Team
    @happycloud and @oskay, sorry about this. We'll reach out about these issues by email. (@oskay, I'm terribly sorry if we missed an email or didn't respond a few weeks ago. We'll look into how we did that.)
  • @brett: We did get a clear acknowledgement (but ending with a developer's "we'll look into it"). Would be nice to know when you've identified the cause. :)
  • This happens to us too, about once in every 100-200 international orders (domestic shipping is free, so those aren't affected). We think it is something to do with a bug in our own custom shipping script,, but we haven't looked into it yet. The most likely cause for us is something to do with ensuring that the first shipping option is selected before allowing checkout, especially if a customer changes the shipping country during checkout and then doesn't select a shipping option.

    If you only use a front end shipping script, the checkout (we use v1.1) could definitely be hacked by someone to make the shipping cost free.
  • Ok I ran some tests. I am on 2.0. After selecting "Free Ground Shipping" ($0) I then looked at the source code and located the hidden field with the name 'shipping_service_description' and changed it's value to "Expensive Ground Shipping". I then placed the order and the final result is "Expensive Ground Shipping" for $0. So Foxy is not running a check for form hack. Please address that.
  • fc_adamfc_adam FoxyCart Team
    @happycloud, @xcorlett, @oskay,

    Sorry for the delays in looking into this. I've unfortunately not had as much time as I would have liked to dig into this issue.

    Just to quickly respond to the last couple posts here - it is possible to alter the shipping results in the checkout like you're describing. It's a known issue but a requirement if we are to allow stores to make use of our custom shipping snippets which essentially making use of that exact set up.

    Our upcoming (and long awaited) shipping rebuild will negate the need for the snippets and allow us to lock the shipping options down to be server-side validated, but until that time it's unfortunately not possible.

    So while it is possible for a customer to alter a shipping result - it would require that that customer have a decent understanding of javascript and how to alter the values. I would be surprised if that was the issue in this case - but it's definitely something to keep in mind.

    Again - I'm sorry for the extended delays - and thank you for your patience!
  • I agree. I don't think it's a hack issue. Perhaps the customer selected the paid shipping option, but the price did not update - only the title. I have not been able to reproduce that scenario.
  • In the one case of this that I've been able to analyze, I see no hint of wrongdoing on the customer's part. It seems like there is a bug here-- some kind of non intuitive path through checkout that allows this to happen.
  • @oskay - did that order have a free ship option? It might help narrow down the issue if its a case of the shipping selection not quite working or something else. In my case my first ship choice is free shipping.
  • It should not have had a free shipping option. We have free shipping for domestic customers, but this was international.

    The order came through with $EXPENSIVESHIP option selected, but $0 charged for shipping.
Sign In or Register to comment.