Some time ago I developed a custom shopping cart for a simple website which sell mainly digital goods. I integrated ExpressCheckout on it, and after the DoExpressCheckout operation, if the response contains ACK equal to Success or SuccessWithWarning (just as the sample code at that time says) then I immediately set access to the content for the user.
I see this is a great mistake, since yesterday a transaction did not appear at the owner's account, but appears in the site since user had access. After contacting PayPal we checked this particular transaction was denied. To late, since access was already granted to the user.
So what should I do? Is it because of the SucessWithWarning not reviewed, or never I should grant access to a user just by finishing DoExpressCheckout? Shall I use IPN to receive information about the transaction to only after grant the user access to the content?
Yes, you'll want to use IPN for post-transaction processing, and you'll only want to grant access once the payment status is completed.
In the case of an e-check you'll get an IPN with a status of pending, and then you'll get another IPN with updated status once that e-check clears (or fails).
Of course, this happens in real-time so you can automate the process accordingly based on the data sent.