Shipping Fee Bypass: Free Delivery Through Logic Gaps
Shipping calculators look authoritative in the UI. Then checkout posts shipping_fee: 0 and the backend shrugs. Free delivery for a sofa is a logic bug with obvious loss.
You do not need to cheat carriers. You need the store to skip its own rate card.
Tamper the fee and the inputs that feed it
During checkout, inspect quotes and confirm requests. Try:
- Directly setting
shipping_price,shipping_fee, ordelivery_totalto0 - Choosing a cheap method ID while keeping an expensive address
- Swapping country/postal codes after the quote
- Digging into weight, dimensions, or
is_digitalflags - Applying free-shipping coupons that should not meet the threshold
Reorder the steps. Get a free-shipping quote for a light cart, then add heavy items without refreshing shipping. Some sessions keep the old fee until payment.
Digital-goods flags are a classic. Mark a physical SKU as digital in the request and watch shipping disappear. Bundle SKUs sometimes inherit the wrong fulfillment type from one child item.
Address games
Ship to a domestic address for rates, then change the address to an international one on the final confirm call without requoting. Or use territories that the rate table treats as free while fulfillment still goes overseas. PO boxes, military addresses, and pickup points often have separate rules—misclassification can zero the fee incorrectly.
Pickup-in-store selected in the API with a ship-to address in the order object can produce unpaid shipping if warehouse staff still mail the parcel. That is an operational hybrid; include evidence that the fulfillment path is delivery, not pickup.
Express upgrades are another angle. Select standard shipping, then patch only the method name to overnight while leaving the standard fee. If fulfillment SLAs change in the order object but money does not, you underpaid for speed.
Show the unpaid mile
Compare a legitimate quote with the tampered checkout. The payment capture should reflect missing shipping. If the merchant under-charges but still prints a paid shipping label, impact is clear. If they "eat" the label cost silently, say that.
Keep packages you actually trigger inside program guidance—many programs want you to stop at payment intent. A screenshot of shipping_amount: 0 on a cart that still lists a physical ship method is often enough.
Fixes: compute shipping only server-side from method + address + parcel contents at confirm time, sign quotes with expiry, and refuse client fee fields. Recalculate on every cart mutation.
Multi-parcel checkouts sometimes quote once and clone the fee. Add a second ship group after the quote and see whether only the first parcel is priced. Under-priced multi-shipment orders are still shipping bypass even when the fee is not literally zero.
Loyalty tiers that unlock free shipping should revalidate on confirm. Downgrade your loyalty mock—or remove the qualifying item—and confirm the fee returns. Sticky free shipping after eligibility loss is the same family of bug.
Shipping bypass reports read best when they are almost dull: honest quote, edited field, dishonest total. Dull ships.