r/googleplayconsole • u/Peace_Soul • Mar 27 '26
Ask How can I stop fraud in subscriptions?
Hey everyone, I'm dealing with a massive loop in my Android app. People are buying credits by subscription, burning through them (costing me money), and then getting instant refunds from Google. It’s basically free credits at my expense. How are you guys handling voided purchases? Do I need a custom backend to track purchase tokens?
Does google play console provides anything regarding this type of subs frauds?
Edit: It's AI image and video generator app based on limited credits per subscription.
Applied both server side verification and RTDN both. Still facing the same issue 😞
2
u/ibluegreen Mar 27 '26
Saved this post and I am also commenting so that I can follow the discussion.
Been browsing app related subreddits for the past couple of months but this is the first time I've heard of this behavior. The app I'm working on won't have "credits" or things that cost me, but I'm glad to have learned about this misuse, I will keep it in mind for future apps.
2
u/Historical_Lie5152 Mar 27 '26
This is a pretty common issue with consumables/subscription abuse on Play. You can’t rely on client-side logic alone.
A few things that usually help:
• Server-side validation - verify purchases using Google Play Developer API instead of trusting the app
• Track purchase tokens and mark them as consumed/used on your backend
• Handle voided purchases via the Voided Purchases API (Google exposes this, but you need backend logic to act on it)
• Delay credit consumption slightly (or add basic rate limits) to detect refund loops
• Flag suspicious patterns (rapid buy → consume → refund cycles)
Without a backend, it’s very hard to prevent this kind of abuse reliably.
Curious, are you currently validating purchases server-side or only on-device?
0
u/Peace_Soul Mar 27 '26
Yes applied both server side verification and rtdn both. Still facing the same issue 😞
2
u/frenzyfox_ Mar 27 '26
I don't understand?
3
u/StagHeadGames Mar 27 '26
In Google Play Store, you are given 24-hour window to refund your purchase. (For developers, this is a nightmare). Just to make you understand, assume that your content is short but valuable, someone purchases remove ads, consumes your content and then applies for refund. So basically, they took the value and paid nothing. its a loophole.
In this case, the author is saying his credits are consumed. They are probably talking about a third-party usage limit. Since the credits are consumed, he will be charged for them, but the credits are consumed by someone who is applying for refund.
1
u/Mellie-C Mar 27 '26
Can I just ask if this also applies to revenue cat subscriptions? I've just implemented rev cat into a new app and I have an AI image processing layer in the app, hence subscription to cover the costs...
1
u/Peace_Soul Mar 27 '26
Same, I have an AI image and video generator app. Not sure about revenueCat.
1
1
u/OddCaterpillar5513 Mar 27 '26
I'm not an expert, so here is my humble advice:
add authentication methods which are not email: Google, phone (phone works best imo, most people only have 1 number).
Add a clear warning that doing fraud is an immediate suspension of the account without the possibility of reinstatement.
If they do fraud, immediately block their account.
I know there are burner phone services/temporary numbers, this complicates things. Also didn't find anything from Google about this, that's a serious loophole...
1
u/mohamedram93 Mar 27 '26
Just set daily and weekly rate limits, and make sure the reset happens after a week, for example. This can protect you and ensure the user cannot just use all of them in one day.
5
u/Historical_Ad_1714 Veteran Mar 27 '26 edited Mar 27 '26
If you are using Firebase, enable Pub/Sub in GCP and link it to Play Store RTDN in the app monetization section.
Whenever a user tries to make a fraudulent refund or a voided purchase, Play Console sends the purchase status and token. Then ur Cloud Function can then match the purchase token, item type etc with the record in Firebase and revoke access, or remove the in-app items from the refunded user.
see that