Why is it checking for GA at all? A critical function like accepting payment should be bullet proof. It's critical code and should be treated that way.