To ensure purchases are authentic and not forged or replayed, Google recommends using the purchase token (obtained from the getPurchaseToken() method in the Purchase object) along with the Google Play Developer APIs to verify purchases are authentic. For more information, see Fight fraud and abuse. Purchase attribution