Beforehand, I take a picture of the CD key and either place it in a folder or upload it to the server.
Customer adds a CD Key to their cart or basket.
Customer views basket and hits "checkout".
If they already have an account, login. If they don't insert contact details (Name, Email, Phone #, Address) They can make a new account if they want to (new accounts get instant deliver next time, woo!) I need the IP address to be snagged at this point. Did they already make over 3 purchases today? If so, stop them from making another.
They continue to paypal payment login page / pay without a paypal account (credit card). I might use another payment company because paypal sucks.
This is where a verification script is needed. Does the IP address location match their verified paypal address? Does the provided phone number's area code match their paypal address? Does their paypal address match the address they signed up with on our site?
Is this purchase above xx amount of dollars? If so, human verify it.
This is where human or automated phone verification is needed. If the user's account already completed this step during a previous purchase, snag one of the .jpgs and email the cd key to the buyer. If not, I manually call them and ask them a series of questions. If it sounds legit, verify them for automatic delivery on future purchases and send the .jpg through email.
You do not need to do this from scratch. I am looking to use a popular store cart cms such as oscommerce, zencart, or cubecart.