Change to PayPal Subscriptions January 2018

[jharries]

Good Morning,

Seems like it’s the season for scary messages from PayPal!

I just received the one attached below from paypal. I’m guessing it’s not a problem with WP ES and WP EM, but thought I should at least check in with you on it.

Please confirm that the changes shown won’t cause us problems.

Thanks

John

Notification of Upcoming Change to PayPal Subscriptions.

John Harries,

PAYPAL NOTICE FOLLOWS:

We’re writing to notify you of some upcoming changes to the way PayPal creates, manages, and displays subscriptions. During 2018, we will launch a number of changes which will bring the following benefits and improvements:

• An improved experience for your customers

• The ability to suspend and reactivate subscriptions

• An easier way to manage subscriptions from your account.

• The ability to collect an outstanding amount if a scheduled payment fails

How will this affect my integration?

Beginning February 22, 2018, all new subscriptions will be created with a subscription ID beginning with the characters I- (e.g. I-5APLHGTHC2N4). Prior to this change, subscriptions were created with IDs beginning with the characters S- (e.g. S-5APLHGTHC2N4).

In the vast majority of cases, no integration changes will be required. However, if your integration relies on subscription IDs beginning with the characters S-, you will need to update your integration to also accept subscription IDs beginning with I-.

If you use Instant Payment Notifications (IPNs), please note that the subscription IDs received in IPNs will also be changing to the new I- format.

Will my existing subscriptions be affected?

There will be no changes to existing subscriptions with subscription IDs beginning with S- in February 2018. We will send a follow-up communication in January 2018 with details on next steps for the migration of existing S- subscriptions to I- subscriptions.

Where can I find more information?

Please see the FAQ page for further details about the upcoming changes.

[wzp]

The described changes are “aesthetic only,” and do not affect the plugins. We do not validate IPN based upon the characters used in the Subscription ID.

[jharries]

Hi Wzp,

Thanks very much for the reassurance.

John

[jharries]

Good Morning,

It seems like we are now seeing a a problem with this.

Recently, Paypal have started sending IPN messages such as those for some cancelations, with the new numbers starting with “I”, even though the subscription was set up with the old number starting with “S”. The result is that WP eMember does not update the member’s status to expired or inactive.

Of course this is not T&T’s fault or responsibility. In fact I’m not sure how you would even fix it since how could you be sure a cancelation is for a given subscription without matching the Subscriber ID.

I’m beating on Paypal about this, but we all know what a futile business that is.

Anyway, I thought you would like to know.

As far as I can see, this problem is limited to memberships that we cancel by the member themselves in their PayPal account. Cancelations due to credit card fails are still working.

The work around is to keep an eye out for the cancelation notice email from PayPal which ironically contains both the old “S” number and the new “I”number and manual cancel the member.

The only other thought I had, is that I have been traveling all summer and so am still at WPEM 10.0.7, so maybe Paypal are sending both numbers and T&T has updated to reflect that. Anyway, as soon as I clear my desk, I will update to the latest version of WPEM.

Thanks

John

[admin]

This is a little weird. They subscriber ID is something that they store with the paypal subscription. That same value is sent for any sub-subsequent IPN communication for that subscription. If they are changing that its totally fine as that should only affect the NEW subscriptions.

I feel this could be a temporary bug with PayPal. I am going to ask the partner channel a question about this.

[jharries]

Hi Admin,

I agree, a bug at PayPal. I have also reported it to Merchant Support and will revert here when I get an answer.

The nasty thing about this is that many WPEM users will be inadvertently giving their canceled members free access and probably won’t notice. We only came across the problem by chance.

Thanks for following up too.

John

[jharries]

Hi Again,

OK, I have got to the bottom of this. What they have done is they are now sending both the old and new profile numbers in the IPN. Below is an IPN for a subscription profile I just canceled myself at paypal. (I have xxxxx out user-sensitive information.)

So I guess there’s nothing for it but to update the IPN/API handling in WP eMember to handle this new behaviour.

Bummer! The joys of doing business with PayPal.

Please advise

John

amount3=19.99&address_status=confirmed&subscr_date=06:20:52 Oct 28, 2018 PDT&payer_id=SSADFCZCLBACQXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXsubscr_id=I-3FDD900PEUHY&custom=ip=72.0.170.120&subsc_ref=2&payer_status=verified&business=info@morganscloud.com&address_country=United States&old_subscr_id=S-84U22277TD2214514&address_city=xxxx&verify_sign=Aicup8xSELK2A7DEGC9CICwUe3RQAFLGrYE0HU77EPTw1yLwjOWD9Axs&payer_email=xxxxxxxxxxxx&payer_business_name=xxxxxLLC&last_name=xxxxxxemail=info@morganscloud.com&recurring=1&txn_type=subscr_cancel&item_name=Member One Year, Auto Renewal&mc_currency=USD&item_number=1&residence_country=US&period3=1 Y&ipn_track_id=f40b67bc69317

[jharries]

Hi Again,

Just realized that in my configuration it’s WP estore that handles Paypal cancels. Here’s the relavant log entries showing the fail:

As you can see eStore is not picking up the old_subscr_id=S-84U22277TD2214514 (why would it) that paypal is now sending.

Hope that helps.

Best

John

[10/28/2018 1:20 PM] – SUCCESS :Subscription cancellation notification check for eMember – check if a member account needs to be deactivated… subscr ID: I-3FDD900PEUHY

[10/28/2018 1:20 PM] – SUCCESS :Retrieving member account from the database…

[10/28/2018 1:20 PM] – FAILURE :No member found for the given subscriber ID:I-3FDD900PEUHY

[10/28/2018 1:57 PM] – SUCCESS :Subscription cancellation notification check for eMember – check if a member account needs to be deactivated… subscr ID: I-SBAMVHR3BW0X

[10/28/2018 1:57 PM] – SUCCESS :Retrieving member account from the database…

[10/28/2018 1:57 PM] – FAILURE :No member found for the given subscriber ID:I-SBAMVHR3BW0X

[admin]

How old are these subscriptions? I just checked some subscriptions that I had about 5 years ago and those start with “I-…”

I am not seeing this to be a widespread issue. So I am trying to understand what maybe contributing to this for your particular PayPal account.

[jharries]

Hi Admin,

The examples I’m showing above are only a year or so old.

I think you are checking you numbers on PayPal? If so, you are being misled because all paypal screens have suddenly been changed to only show the “I” number even if the subscription was originally set up with an S number. That said, they are keeping the S number on their database and not displaying it.

I know this for two reasons:

1 Paypal only started using I numbers at all in early 2018. See this quote from the original PayPal email:

Beginning February 22, 2018, all new subscriptions will be created with a subscription ID beginning with the characters I- (e.g. I-5APLHGTHC2N4). Prior to this change, subscriptions were created with IDs beginning with the characters S- (e.g. S-5APLHGTHC2N4).

What they didn’t tell us is that they were going to give all old subscriptions an I number too, and they did that some time in the last couple of months.

2. If we look at the example notifications I copied in my comment above we see that now there are two variables:

subscr_id=I-3FDD900PEUHY

old_subscr_id=S-84U22277TD2214514

So the problem is that the WPEM and WPES IPN handlers are not recognizing the old_subscr_id=S-84U22277TD2214514 variable.

We can see this from the log:

FAILURE :No member found for the given subscriber ID:I-3FDD900PEUHY

Bottom line, this is a general problem, but hard to catch since it will only affect member cancelations in cases where we or the member cancel at PayPal.

We only found it by chance.

The bad thing is that many WPEM customers will be giving free memberships to those who have canceled and never know.

Thanks

John

[admin]

The subscriptions that I am talking about definitely uses “I” as the start of the subscriber ID and those were setup like that a few years ago. It is likely there is another factor. Something like there were probably a group of paypal accounts that were using the “S” character and PayPal is moving them to “I” now. I don’t know what the exact details are but I have also seen a lot of my customers site where the subscriber ID uses the “I” character.

But anyway, I want to apply some kind of an update to the plugin so it can gracefully catch this. I think if I add a check in estore’s IPN handling script that checks to see if a value for “old_subscr_id” exists, then it uses that value (if one is found). That should be able to handle it. What do you think?

[jharries]

Hi Admin,

Yup, that will definitely fix it. The key point being that we have manually verified that every time PayPal has sent both numbers the “S” number has been the one that corresponds with the number in WP eMember.

And by the way, I went back and checked in a Google spreadsheet we update with every IPN, using Zapier and WPES’s excellent IPN passthrough feature, and there was no hint of “I” numbers in any of our IPNs prior to June 11th 2018. I think what was happening was that they were using I numbers for what they then called “advanced subscriptions” (credit card with no paypal account required), which we did not use (prefer Stripe). (That’s why you are seeing I numbers prior to June on your clients that used Advanced Subscriptions.

Then from June 11th they changed to giving all new Subscriptions (advanced or standard, an I number) but still sent S numbers for IPNs that related to subscriptions set up prior to June and I numbers for those set up afterward.

The trouble started on October 25 when they started sending all IPNs with I numbers and added the old_subscr_id variable. Would have been fine if they told us, but I have checked their IPN docs and there is, as yet, no mention of the old_subscr_id. I reported this to them yesterday.

One other issue to be aware of. These IPN changes seemed to have partially broken the IPN passthrough feature on eStore too, since some notifications that I have verified were sent from PayPal are not coming through out of eStore. I need to do more work to accurately define which passthrough and which don’t.

Let’s fix the first issue of recognizing the old_subscr_id variable and then I will work more on defining the pass through issue.

Thanks for the help, as always.

John

[admin]

I found a way to just update this in the emember plugin. That should cover both the estore and the standard emember paypal integration. I have sent you an updated copy of the plugin to try.

[Author]

Posts