legit or not - questioning kite shops is like talking about weather
If your 'friend' is really into it, here are 2 ways he could deal with his obsession:
The site (Indonesia) has PayPal as checkout. Contact PayPal about fraud protection and they can 'hold' your payment until both sides are satisfied. Me thinks that's up to two weeks. It's been a while that i've done that.
Same for some cc providers. They can put 'a virtual hold' on your payment until release. Call up your cc and talk your way through.
Anyway - it's a bit of a hassle but worth it dealing with dubious shops/sellers/outlets/off-the-truck. Never send money orders (nor accept Nigerian money orders for that matter
Good luck - peace