Sorry for long wait time, we discussed the question in team, but then didn't reply immediately and it went down.

What is the expected behavior and how strong against false information and against tricks should the enforcement be ?

It is not directly supported yet.

Only way i see for now is either:
1) to install CBSubs Taxes plugin and then remove the countries that you don't want to ship to from the countries list, so they don't appear in the drop-down list at all.
2) to enforce that at CB level at registration in field validations by asking country and server-side validation in the field params.

However that won't stop someone from indicating a false country...

Some gateways such as Ogone (supported by CBSubs) have methods using the card home country and IP address geolocation to reject the payment, which is a bit harder to work around. Maybe that would suit your needs ?

EDIT:
There are also geoIP plugins on the JED that allow redirections depending on IP country:
extensions.joomla.org/search?q=geoip&sa.x=0&sa.y=0

JontyPTraveler wrote: Do you know if the invoice address is validated as a real address? I can forsee somebody entering the correct address, but just changing the country code so they can purchase the document.

Correct.

What do you propose to validate invoicing address as real address ? Very interested, as most acquirers do not offer this service, specially outside the US.

A good solution would be to hook the geoIP onto a cbsubs plugin that checks the IP in the purchasing process, though there are random IP generator applications out there that may work around that...

Correct.

Most online embargo solutions (IP based or address based) can be worked-around or frauded.

The only a bit more reliable solution is to send by normal post, although you need to be aware that there are official and innoficial "relaying post-box" offices.

One way that I see to implement that with current CBSubs is to rely on Paypal's postal address verification service and to set Paypal to only accept payments from verified-addresses paypal accounts. In that case you will only get payments from buyers to which paypal sent a letter and that entered a code that they got on that letter. Or to do that postal verification yourself.

Which of course restricts drastically your sales in non-embargoed countries.

So the real question is: What level of police/detective activity your customer is expected to do to enforce your country's embargo ? And then: is it viable for your customer and for his customers ?

If CBSubs were to develop such a plugin, what would the timeline be and possible developement cost. I realize you may have to make some changes to the purchasing process in CBSubs to develop such a plugin. Just see what the options are to present to the client...

Thank you for the quick reply!

I don't think a development is required in CBSubs to implement IP-based embargo at payment time, if you can set or add a setting to those redirect plugins to only redirect on specific URLs. This can be done to actual CBSubs release or any URL for that matter.