Authorize.net Duplicate Transaction Error

-- HikaShop version -- : 3.1.1
-- Joomla version -- : 3.7.2
-- PHP version -- : 7.0.17

I am trying to solve an issue on several websites I manage, all of them running HikaShop, and all of them using Authorize.net for the payment gateway. I am hoping someone here might be able to help.

If a user puts items in their cart and proceeds through the checkout process, but made a typo in the billing address or the credit card, Authorize.net declines the payment. This is as it should be.

However, the issue is when they fix the issue, either fixing the issues in the billing address or fixing the typo in the credit card information, they submit the order again, and get this error:

There was an error while processing your transaction: 11 A duplicate transaction has been submitted.

Nothing will solve the problem at this point, except for them to empty the cart, re-add the items to the cart, and do the whole checkout process again.

Has anyone ever seen this issue before?

Authorize.net, of course, is saying it is an issue with HikaShop. So they are no help at all.

I'm not sure what else to try. Anyone have any ideas?

Well, it's not HikaShop. Not exactly.

Authorize.net by default will consider a transaction a duplicate if you attempt to put the same amount through against the same card within a window of 2 minutes. That's the default way they handle it.

But you can change this on the authorization call from HikaShop. We ran into this on one of our client sites, and had to code a fix in the Authorize.net plugin to allow you to set a time period of when Authorize.net treats things as duplicate. Nicolas agreed to bring that into the supported Authorize.net plugin that comes with HikaShop. (thanks!)

You should see a parameter setting called "Duplicate Window". This is a setting for how close the so-called duplicate must be before it's treated as a duplicate and rejected. We've found a value of "10" (as in 10 seconds) to work very well. Most customers can't read the error message and attempt again that quickly, so a re-attempt after 10 seconds is likely to be legit.

If the parameter is left blank in the plugin, then Authorize.net will use the default 2 minute setting, and that's probably what's happening.

I had never noticed that field before, and if I did see it I would not have known what it was for as it isn't documented.

I have made the change of adding a 10 in that field on a couple websites. Now we will see if that resolves the issue.

Thank you for the advice!