Stopping tampering with transactions.
WHAT ATTACKERS ATTEMPT
Changing the amount Changing the currency Changing the recipient Replaying a successful payment Claiming a payment that did not occur Using a token belonging to another account
WHAT ENABLES THOSE
Trusting values from the client Not verifying with the provider Missing ownership checks Notifications accepted without verification
WHAT TO DO ABOUT AMOUNTS
Store the expected amount server-side against the reference, and verify on confirmation.
WHAT TO DO ABOUT REPLAY
Record every processed reference, and reject repeats.
WHAT TO DO ABOUT CURRENCY
Fix it server-side per order.
WHY
Currency substitution with an unchanged number is a known attack.
WHAT TO VERIFY BEFORE FULFILLING
That the transaction exists at the provider That its status is successful That the amount and currency match That it belongs to this order That it has not already been used
WHAT TO ENFORCE AT THE DATABASE
Uniqueness of the provider reference.
WHY
It is the only defence against concurrent duplicate processing.
WHAT TO TEST
Each of these attacks, deliberately.
