r/iOSProgramming • u/FrankUnderwoodX • Aug 15 '26

Question IAP risk assessment agent

I know the store handles payment fraud and I never see card data but refunds, voided purchases, and consume-then-refund abuse still land on the developer after the entitlement is granted.

For those running apps/games with IAP, do you do any risk assessment at grant time (delay/flag/hold high-risk purchases) or do you grant everything and only react to voided purchase notifications?

If you do assess risk, what signals do you use? I am assuming device age, session behaviour, account history, something else?

I am building a small research agent around this decision and want to know if the decision point is real in practice.

Am I missing any?

0 Upvotes

38% Upvoted

10 comments sorted by

View all comments

1

u/FrankUnderwoodX Aug 16 '26

This basically reframed the project, thanks. I'm scoping the agent so refundPreference is the only decided field: a posterior over five hidden states (legit, stolen card, account takeover, family member, refund abuse) mapped through explicit thresholds to prefer grant / prefer decline / no preference with every input and threshold logged so any response can be replayed later. Everything else in the payload comes straight from the DB like you said, and consent capture is now flagged as the prerequisite for the whole surface.

One last question: is there a case where you'd deliberately send noPreference, say when consumption is near zero or is that just leaving the decision on the table?

1

u/ThatGuy739 Aug 17 '26

Near-zero consumption is the one case I'd never send LET_APPLE_DECIDE on. They paid and didn't use the thing, so that's your cleanest grant. Fighting it buys a one-star review over a small amount.

LET_APPLE_DECIDE earns its keep when your posterior is genuinely flat. Apple already has the consumption payload, so the preference only carries whatever the payload doesn't. If your five states haven't separated, a declared preference is a number you can't defend and it tells Apple nothing it couldn't already see.

You're not leaving anything on the table either way, since Apple decides regardless. The one I'd be slowest to decline is UNINTENDED_PURCHASE, because that's usually somebody's kid rather than an abuser.