PayPal highly recommends three checks before setting the new status to prevent fraud:
-  "txn_id" is not a duplicate
- "receiver_email" is an email address registered in your PayPal account
- transaction details such as the price has not been changed

Details can be found here: https://www.paypal.com/cgi-bin/webscr?cmd=p/acc/ipn-info-outside