This has been going on for at least a year, probably longer. It only works on apps that don't check the receipt with Apple's servers. The fix for developers is

This has been going on for at least a year, probably longer. It only works on apps that don't check the receipt with Apple's servers. The fix for developers is to have your server check the receipt of the transaction with Apple. If Apple doesn't recognize the receipt, don't save the transaction. Don't have the client do it, because client code can be easily hacked. Someone could intercept the app's communication with your server but it's not likely to be in a common format, so automated hacks won't work. They'd have to crack your app on a case-by-case basis.