title: PayPal Express Checkout API - User does not confirm amount?
body: <p>I am implementing the Express Checkout API for a web application, and everything works fine. Still, I am left with a doubt about the flow of the operation.</p>
  
  <p>If I understand well, the user experience is as follows:</p>
  
  <ol>
  <li>User orders some items on the merchant sites</li>
  <li>Before paying, the user is sent to the PayPal site</li>
  <li>After authentication, the user can confirm some details about the transaction, such as the shipping order, but <strong>NOT</strong> the total amount</li>
  <li>The user is redirected to the merchant site, where he can confirm other information, and in particular the total amount of the order</li>
  <li>The payment is done and the user gets a confirmation page from the merchant.</li>
  </ol>
  
  <p>The <code>SetExpressCheckout</code> call happens between 1 and 2, <code>GetExpressCheckoutDetails</code> between 3 and 4, and finally <code>DoExpressCheckoutPayment</code>between 4 and 5.</p>
  
  <p>The fact that the user is not given the opportunity to confirm the total amount in step 3 is because at this point the merchant may not have the information about the shipping cost. Indeed the documentation <a href="https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&amp;content_ID=developer/e_howto_api_ECSimpleIntegration#id0832BE080HS" rel="nofollow">says explicitly</a> that the amount can change between the call to <code>SetExpressCheckout</code> and the one to <code>DoExpressCheckoutPayment</code>.</p>
  
  <blockquote>
    <p>So, what if the merchant lies to the user? I may say that you are confirming a payment for 20EUR and charge you 2000EUR. Now, that is a fraud and I may be prosecuted, but it should not be allowed anyway.</p>
  </blockquote>
  
  <p>Note that the documentation also <a href="https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&amp;content_ID=developer/e_howto_api_ECSimpleIntegration#id0832BC00JY4" rel="nofollow">claims</a> that obtaining the details about the transaction with a call to <code>GetExpressCheckoutDetails</code> is optional. Similarly, step 4, where the user reviews the payment details, may be skipped altogether, and in this case the user will not confirm any amount!</p>
  
  <blockquote>
    <p>Am I getting something wrong, or is there a rationale behind this working?</p>
  </blockquote>