[#7495] triple charge - no record of subscription

We just had a user triple charged for a subscription which doesn't appear in our system at all.

The charges (via Authorize.net) appear with different Trans ID numbers in Authorize.net, but the Invoice Numbers are the same (and valid numbers per our CBSubs configuration) and were submitted 3 min. apart from each other.
However, we see no subscription, payment basket, etc. in the admin of CBSubs.
Additionally, I have searched through the _cbsubs_payment_items, _cbsubs_payment_baskets, and _cbs8bs_payments and don't have any entries that match that invoice number.

In the Authorize.net payment config we have :
Enable Authorize.net : Yes: AIM+ABR: Single payments or Automated REcurring Billing at uer's choice for autorecurring plans

However, we presently don't have any plans active that are recurring.

Can you tell me how this might have happened - both the triple billing and billing without having a subscription recorded?

Was double-charging protection setting at authorize.net disabled? This should be on by default. We send x_duplicate_window to authorize.net with its maximum value to prevent duplicates, but I believe this can be turned off at authorize.net it self. This prevents page refresh or pressing the pay button multiple times from charging more than once.

I'm not sure why the basket doesn't exist though. Only thing I can think of is the user cancelled the basket before the IPN to pay the basket came through. You should be able to see the cancelled basket in CBSubs > History. The log message for a basket cancel is "Payment basket deleted because the subscriptions and payment got cancelled".

I'm checking on the double-charging protection.

However, in the log, the only entries for this user (in id order) are:

* Change log - User subscription record created with status: R
* Change log - User subscription record created with status: R
* Change log - Store payment basket

All of the entries in the Change column are 'insert'

And on that last entry the details indicate:
payment_status: NotInitiated

In the Payment Baskets view there are no items listed for this time period (only one older one from last year) for this user.

Any other ideas what might be going on?

Could the double-charging protection setting cause a failure in the process to create a basket?

Any other ideas what might be going on?

I've no idea. What is the basket timeout set to within CBSubs > Settings > Display > Baskets? Even timed out baskets are logged. Do you allow multiple subscriptions to the same plan (see "Multiple subscriptions per user" under Workflows tab of your plan)?

Could the double-charging protection setting cause a failure in the process to create a basket?

No, authorize.net doesn't create the basket. It is created by CBSubs and is done so before they even reach a payment gateway.

The timeouts are the standard (3 for front-end, 24 for admin).

All of the subscriptions are set to "Only one subscription at a time".

And it appears to be working for everyone else (and has been working for a couple years without any changes.

I don't know what to suggest then. Maybe get in touch with the user and have them explain their exact process as it seams like this may of been user error somehow. Mashing a pay button for example is bad no matter where you purchase as it sends multiple API calls and unless the payment gateway is designed to handle blocking duplicates it's going to charge multiple times. Authorize.net in this case has a setting for that and we send x_duplicate_window with its maximum value as recommended by their API.