Your ledger and your PSP disagree. Somewhere.
I audit payment systems for the bugs that quietly lose money: retried charges, duplicate webhooks, ledgers that drift from settlement. Fixed price, two weeks, written findings.
| Payment | Your ledger | PSP settled |
|---|---|---|
| pay_8F21 | 1,250.00 | 1,250.00 |
| pay_8F22 | 89.90 | 89.90 |
| pay_8F23 | 420.00 | 840.00 |
| pay_8F24 | 15.00 | 15.00 |
| Unexplained difference | 420.00 | |
What the audit checks
I read your payment code, data model and logs, and trace real transactions end to end. The goal is a short list of places where money can be lost, duplicated or left unaccounted for, ranked by impact.
Idempotency
Every money-moving call can be safely retried without charging, paying out or crediting twice.
Retries and timeouts
What happens when the PSP answers late, not at all, or after you have already given up.
Webhooks and events
Duplicate, late and out-of-order notifications, and whether your state machine survives them.
Ledger design
Double-entry correctness, immutable history, balances you can rebuild from entries.
Reconciliation
Matching against PSP and bank settlement files, and how quickly a mismatch reaches a human.
Concurrency and money math
Race conditions on balances, rounding, currency precision and FX conversions.
How it works
Two weeks from kickoff to report. You need one engineer available for questions, read-only access, and sample settlement files.
Scope call
We agree which flows matter most: pay-ins, payouts, refunds, card issuing, crypto on- and off-ramps.
Day 1Review and tracing
Code and schema review, plus tracing real transactions through logs and settlement data.
Days 2 to 8Report and walkthrough
Written findings ranked by money at risk, each with a concrete fix. A live session with your team.
Days 9 to 10
What you get
- A findings report: each issue with the scenario that triggers it, money at risk and a fix you can hand to an engineer.
- A reconciliation gap map showing which money movements are checked against settlement, and which are not.
- A prioritised fix plan for the next 90 days.
- A 90-minute walkthrough with your engineers and one follow-up call a month later.
Fixed price
Final price depends on the number of payment flows in scope. Agreed before we start.
- Two weeks, remote
- NDA as standard
- Fix implementation available as a follow-up
Who does the audit
I'm Serhii Horobets, a fullstack engineer and tech lead with 20 years in banking and payments. I've built and run core banking, corporate banking and payment platforms, KYC/AML flows and bank integrations for crypto exchanges, and tuned high-load systems that could not afford to be slow.
Every audit is done by me personally, not passed on to a junior team.
- Experience20 years in IT
- DomainsCore banking, payments, KYC/AML, PCI DSS
- Stack.NET, Node.js/NestJS, SQL Server, PostgreSQL, Oracle
- CloudAzure, AWS, GCP, Kubernetes
- Based inWrocław, Poland
Check your own system first
The 30 payment failure modes I look for, as a checklist your team can run through in an afternoon. Free, no sign-up.
Talk to me
Tell me what you process (card, account-to-account, crypto) and roughly how many transactions a month. I reply within one working day.