Root Cause

We knew sales tax in the U.S. varies by state and city, but there are a few special cases — military and diplomatic addresses, ships at sea, or economically disadvantaged states — that are tax-free. Looking through the order history, plenty of customers had figured out they could change their shipping address to avoid sales tax.

Originally, the payment processor would check whether the state and ZIP code matched and whether anything looked like fraud. Because we had insurance covering chargebacks, we ended up bypassing the processor's high-risk order checks — which is how this issue slipped in.

Impact

• The U.S. government can demand back taxes from the seller, and we'd have to chase customers to collect
• For shipped orders, we'd have to notify the customer to pay the tax owed
• For unshipped orders, we'd have to notify the customer to redo the payment

Fixes

• Before checkout, call the USPS API to verify that the ZIP code matches the state
• Before shipping, call the DHL API to verify the address — refuse shipment if it's invalid
• Sort tax-free states to the bottom of the dropdown, or hide them