Ticket query

I’ve just processed a test ticket to see how it all works – Paypal worked fine, got the e-mail, everything seems “ticket”yboo (arf).

However, am I right in thinking that the tickets don’t contain unique codes or anything like that? They’re just e-mails confirming the purchase with the buyers name? I exported a CSV of attendees and the Transaction ID listed next to my test attendee doesn’t match the one on my Paypal receipt either…

I’m concerned because it seems like an easy system for someone to fake or forge. Have I not entirely understood the system?

https://wordpress.org/plugins/camptix/