Why "Approved" From a Payment Gateway Isn't Enough

When a payment gateway confirms a transaction as approved, it is crucial to verify that the approved amount matches the amount originally intended for the charge. We learned this lesson the hard way while developing DymCore, an invoicing platform for small businesses. PayPhone, a payment gateway used in Ecuador, was one of our payment integrations.

Initially, our code trusted the boolean response from PayPhone: if it indicated the transaction was approved, we marked the order as paid. However, this approach overlooked the fact that the boolean response did not guarantee the transaction occurred for the correct amount.

We resolved this issue by implementing an explicit check before confirming any order. This check involved comparing the amount approved by PayPhone against the amount we expected to charge. If the amounts did not match, the payment system raised a critical alert, and the order remained unconfirmed, preventing any further processing. This approach ensures that any discrepancies are caught and handled appropriately, rather than silently accepting potentially erroneous transactions.

We also added dedicated test coverage specifically for mismatch cases, recognizing that this is a critical aspect of payment processing that should never silently regress. It is essential to verify not just the success flag, but also the exact amount processed, as the "approved" field is a claim from the third-party system, not a receipt generated by our own system. This practice helps maintain the integrity and accuracy of payment transactions across various payment gateways.