How do i prevent IAP abuse using restoring purchases in an online game?

Question

Lets say i have a mobile mmorpg (ios/android) where you can purchase premium currency using IAP's... how do i actually prevent the following case :

• Player purchases premium currency
• Server side checks if the purchase is valid, grants the user premium currency
• Player uses the premium currency to buy some items
• Player restores his purchase on google play and gets his money back

Result : Player didnt spended money and still got what he wanted

As long as i know theres no option to prevent that case in google playstore or ios app store... Users can restore purchases within 48 hours after the purchase.

So what could i basically do to prevent this, aslong as i dont use 3rd party payment services like PayPal ?

Answer 1

One way to prevent this is by tracking user's purchases on back-end/server and saving the game state when the user purchased the item along with the Order Id and pacakge name for every purchase, then if the user restores the purchase within 48 hours (which you can check using Void Purchases API) then just restore the game state to the saved one and if the player doesn't issue a restore request then delete the saved state from the server.

Here's the reference article from Google: Protect your apps from refund abuse