I have made an Android app where items can be purchased using in-app-billing. When an item is purchased the transaction can easily be synced between Android Market and the p
Transaction data is signed with a private key specific to your app. There is also a nonce to prevent replays (i.e, sending the same, valid, data multiple times). If you verify that the nonce is unique and the signature is valid at your server, you can be reasonably sure that it's not fake. Check the part about IAB of this Google IO presentation for a discussion.