Force customer to use email address associated with draft order?

Highlighted
Excursionist
19 1 5

While testing draft orders, I determined that if I send a draft order to a particular customer, anybody can follow the "complete your purchase" link to claim that order.

In other words, if I send a draft invoice to customer1@domain.com, and the customer clicks the "complete your purchase" link while logged into my store as customer2@domain.com, then the completed invoice goes onto customer2's account instead of customer1's. 

They can also log in during checkout and create a new account during checkout. This happens whether or not the originally invoiced customer already has an account in my store.

Is there any way to prevent this from happening, i.e. require that the draft order is purchased using an account associated with the email address to which the draft order was sent?

(Accounts are required to place orders on my store)

1 Like