It is true that if a vendor defines an approved URL that allows access to the downloadable product/service they are selling, and the vendor takes no further security precautions, someone could download the product/service by including the ‘demo=Y’ parameter.

The ability to control the demo parameter is available from inside the 2Checkout system. You can choose from the following 3 options inside of your 2Checkout account to control the use of the Demo parameter. Those choices are:

• On: Using this setting all sales will be treated as demo, regardless of any parameter value.
• Off: Using this setting all sales will be treated as live, regardless of any parameter value.
• Parameter: Using this setting a demo parameter sent to the purchase routine will control the demo setting.

To access the Demo setting in your account you will need to log in to your account and then click the Account tab. On the Account page click the Site Management sub-tab. After you have selected the Demo setting that best fit’s your current need and then click the blue Save Changes button at the bottom of the page.

It is not recommended to provide a downloadable product/service to a customer immediately after a sale completes by means of a return to the Approved URL. It is recommended to allow the fraud review process to complete before providing your customer with the product/service.

We realize that some vendors may not wish to wait for the fraud review process to complete before providing their customer with a downloadable product/service. For such vendors, the MD5 hash is provided to help verify the authenticity of a sale. We intentionally break the hash code that is passed back if the ‘demo=Y’ parameter is used. You can compare the value of the hash we pass back with the value of what the hash should be (this needs to be calculated on your end). This will allow you to determine whether or not to provide the customer with the downloadable product/service. It should be noted that when using this method to provide a downloadable product/service immediately, you do run the risk of having your product/service stolen by someone placing a fraudulent order with a stolen credit card.

For full details on using the MD5 hash please refer to the article How do I use the MD5 Hash?

If you choose to provide a downloadable product/service immediately after a sale using the Approved URL, and do not check the MD5 key which is passed to the Approved URL to verify the validity of the sale before providing a customer with a product, then you are accepting the risk that your product may be taken without being paid for by someone who includes the ‘demo=Y’ parameter.

To download a sales report in the New Sellers Area (VA) please log in to your 2CO account, click on the “Sales” tab, then click on “Billing Activity Download” link at the bottom of the page.

Here you can specify a date range, currency, sale status and download the report. The CSV sales report will include the following information:

• Sale Number
• Total
• Date Placed
• Date Shipped
• Name
• Address
• City
• State
• Postal Code
• Country
• Phone
• Email
• Ship To
• Ship Address
• Ship City
• Ship State
• Ship Postal Code
• Ship Country
• Date Paid
• Refunded
• Refunded Date
• Chargeback
• Chargeback Date
• Merchant Order Id
• Product OID
• Qty
• Vendor Product ID
• Product Name
• Recurring Status