On the Paypal Basic Integration tutorial it is possible to capture an order client-side which essentially submits the payment to paypal. Once the order is captured, the tutorials shows you how to verify the transaction which would ensure you do not provide a service or product unless the paypal order is verified. However, someone could maliciously capture a payment using the client id and while verification would fail paypal would withdraw the funds from the customer. How can you prevent this? Is this secure?
[UPDATE]
This questions comes mostly out of curiosity and lack of experience with paypal. To put more context into this and hopefully help others; the Paypal basic integration is simply an HTML form and so it doesn't stop anyone from modifying the HTML form and send a different amount for authorization/capture; lets say that the original amount for an order is 100, it is possible that someone changes that amount and submit the authorization with the different amount; at the minimum it would initiate an authorization/capture of this different amount that perhaps is higher. Good practice dictates that the amount and orders should be verified before finalizing the transaction on the backend, but even if the transaction is found to be invalid the funds would have already been put on a "hold" by paypal and possibly on the customers credit card.
This is probably not an issue since, like mentioned, transactions should be verified on the backend; it is also not too obvious( maybe with some social engineering) how someone would benefit from this and most likely would just be an inconvenience.