We are currently wrapping up a free-to-play game on iOS in which you can purchase non-consumable products. We have been discussing this case internally and are not quite sure what the best practices are as this is our first title.

For example, if a user downloads our app, and makes some purchases. These can be restored should the app ever be deleted and reinstalled as long as the user uses the same Apple ID. What is to stop him from making a fake Apple account, purchasing items and then posting this account on the web allowing everyone to get the items for free?

That is obviously a worst case situation. But a smaller case would be a user unlocking items for his friends. We do not want this to be an always online game but have considered doing a check on startup if there is internet available. If the currently logged in account doesn't own the products do we lock them again? Probably not because people may simply sign into the device with different Game Center logins at which point we don't want to constantly lock and unlock items.

At some point we will be adding multiplayer at which point we can definately do a check with the currently logged in account. This is because A, they will be online when attempting multiplayer, and B, they will want to use their own account for multiplayer. Unfortunately we aren't quite ready for this yet.

Has anyone tackled this issue. Are we overthinking here?