Hi there! I have this situation here where someone subscribed to my download area on my website using a pending eCheck, and that payment failed to clear. By the meantime, the person logged on my site using the username / password Paypal delivered, and downloaded pretty much everything that's possible before the payment gets rejected. This sounds a lot like a fraud to me, as I ended up with hundreds of stolen files. This problem is obviously that the Paypal system issued a username / password before the payment cleared, so my question is: Is it possible to have the system to wait for a payment to clear before issuing a username / password to a customer and my htaccess file? Right now, for the time being, I turned off the 'accept eCheck payment' in my selling preferences, to prevent other frauds. Thanks! -sv