Home / Knowledge hub / Price manipulation
Knowledge hub
Price manipulation
Changing a price, quantity or discount in a request so you pay less than you should.
What it means
Price manipulation is a business-logic flaw where a buyer changes a value in a request, such as the price, quantity, discount or currency, and the server accepts it. The page shows one price. The request that completes the order quietly carries another.
The cause is trust. The server believes the total sent by the browser or app instead of working it out for itself. Anything the client sends can be edited, so any number that decides what someone pays must be calculated on the server from data you control.
Why it matters
The loss is direct and immediate: goods sold at a fraction of the price, subscriptions upgraded for free, credit issued that was never paid for. Unlike many flaws, it turns straight into money, and it can be repeated at scale once someone shares the method.
It is also hard to see afterwards. The order looks complete, the payment provider reports a successful payment, and only a reconciliation of what was sold against what was received reveals the gap. This is a typical business-logic flaw: nothing technical breaks.
How it shows up
You meet it in checkout and cart requests that include price, amount, total or discount fields; in hidden form values; in mobile apps that send the final amount to a payment step; and in currency or plan identifiers that can be swapped for cheaper ones. Also check rounding, as in rounding abuse.
The fix is to send only identifiers and quantities, look up prices on the server, recalculate the total at the point of payment and compare it with what the payment provider actually charged. Test by editing each numeric field in the order flow, trying zero, tiny and negative values, and swapping the currency. See also parameter tampering.
Questions people ask
Price manipulation, answered
Is price manipulation the same as parameter tampering?
It is a common example. Parameter tampering means changing any value in a request. Price manipulation is when the value changed is money related.
The fix is the same: do not trust values the client sends.
Can a payment provider stop it?
Only if you tell it the right amount. The provider charges what your server asks. If your server asks for a wrong total because it trusted the client, the provider will charge that.
Compare the charged amount with the expected order value.
How do we detect it after the fact?
Reconcile orders against payments, flag unusually low totals, and review orders where the amount paid differs from the catalogue price.
Logging the price your server calculated alongside what was charged makes the gap visible.
Is hiding the field in the page enough?
No. Hidden fields are visible to anyone who looks at the request. Browsers and tools let anyone change the value before it is sent.
The only safe place for the calculation is the server.
How do we test for it?
Add items to a basket, then edit price, quantity, discount and currency fields in the request that completes the order. Try zero, negative and very large numbers.
Compare what you ordered with what was charged.
Sources
Where this comes from
Related
Terms that sit next to this one
Parameter tampering
Changing values in a request, such as a price or an id, to alter what happens.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Negative quantity
A numeric field accepting values below zero so balances move the wrong way.
Coupon abuse
Using a discount code more times, or in more ways, than you intended.
Rounding abuse
Exploiting how amounts are rounded to gain tiny sums repeated many times.
Whose number does the server believe?
We check business-logic flaws such as price, quantity and discount tampering in real checkout flows, and report what we actually exploited, with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.