Students have access to course without paying for it

I had a student enroll in a course with paying today. I deleted the student and then went thru the registration process in an incognito window with a completely different email address and was able to join the class. This was not happening before the last update. Access has been granted.