[ryanbertrand]

On iOS you can verify receipts with your server. This will also prevent jail broken devices from faking purchases.

[leowoo91]

I just checked the mechanism, not bad after all since app itself directly communicates with the server I can provide. So, my concern converged into if evil cooperation modifies my app in order to replace purchase button action with an internal buy strategy then call my purchaseDone function inside. I think that is still possible :)