If your payment gateway responds with approved: true, do you also check that the approved amount matches what you asked it to charge?
We didn't, until this week.
We're building DymCore, an invoicing platform for small businesses, and one of its payment integrations is PayPhone, a payment gateway used in Ecuador. Like most integrations, our code trusted the boolean the gateway returned: if PayPhone said the transaction was approved, we marked the order as paid.
The boolean told us the transaction went through. It never told us it went through for the right amount.
This week we added an explicit check before confirming any order: compare the amount PayPhone approved against the amount we expected to charge. If they don't match, the payment isn't silently accepted. It raises a critical alert and the order stays unconfirmed instead of moving forward.
We also added dedicated test coverage for the mismatch case specifically, because this is exactly the kind of check you want to be sure never regresses silently.
The lesson generalizes past this one gateway: when a third-party system tells you "this succeeded," the amount is usually the part worth re-verifying server-side, not just the success flag. A field saying "approved" is a claim from someone else's system, not a receipt you generated yourself.
Have you run into a payment or billing integration that approved a different amount than what was requested? Curious how other teams guard against this.
We write about things like this while building DymCore.