“They caught a retry path that posted twice to settlement after our gateway had already marked the call complete. The report named the owner — that mattered more than the severity label.”
Client stories
What teams noticed after the walkthrough
Comments below reference specific engagements. Names and firms are shared with permission; some titles are generalized.
“The pre-release memo was blunt about two blockers on our reversal routes. We delayed the ship by four days. Annoying at the time; the acquirer questionnaire the next month was quieter because of it.”
“Diligence support helped us stop answering ‘we monitor continuously’ with a paragraph that meant nothing. We still had gaps — they made us say so in plain language, which our bank contact preferred.”
“Workshop facilitation was steady, though I wished we had pulled a larger ticket sample beforehand. The playbook we left with is shorter than our old wiki and people actually open it.”
“Sampling across value bands showed our micro top-ups looked clean while high-value partner payouts had thin approval evidence. That split changed how we schedule reconciliations.”
Extended story: reversing a silent double post
A regional wallet provider engaged ScalableAPI ahead of an acquirer renewal. The flagship audit sampled three weeks of credit, debit, and reversal traffic across twelve money-moving endpoints.
On day nine of trail collection, the analyst lined up gateway request IDs with settlement batch lines and found fourteen same-amount posts where the idempotency key had expired before the ledger worker ran. Ops had closed the customer tickets as “delayed,” not duplicate.
The challenge session put gateway and ledger owners in the same call. Severity was agreed as high for partner payouts and medium for consumer top-ups. Remediation assigned a single idempotency contract owner and a reconciliation rule for same-account duplicates within a two-hour window.
Six weeks later the client reported the duplicate class of tickets had dropped; they still reconcile manually for edge cases, which the final report had predicted.