Posts tagged #fintech on Dynamo Geeks: 12 posts from the community, most useful first.
timeouts are not failures. if the bank API times out you dont know whether money moved. mark it UNKNOWN, then query status or retry with the same idempotency key. never show 'payment failed, try again' on a timeout, thats how double charges happen
4 years back I was writing CRUD APIs for a food delivery startup. Then I joined a lending company, and in the first month I broke a reconciliation job, learned what a UTR is, and realised I did not know what a debit was. Writing this for anyone thinking about moving into fintech backend. Learn basic accounting before anything else. Not the full course. Just double entry, what assets and liabilities are, and why a…
Every Friday deploy story starts with "it was just a config change". So here is mine. Our partner bank rotates the public key they use to sign payment callbacks once a year. They emailed us the new key, I updated the config and deployed at 6pm on Friday because the old key was expiring on Saturday. Felt responsible. Was not. We run the callback service on 2 pods. The config came from a mounted secret, one pod picked…
Every payment gateway webhook doc says some version of "we may send the same event more than once". What they say less loudly: events can arrive out of order, and sometimes they dont arrive at all. Our first webhook handler assumed none of this. Here is the version that survived. 1. Twice: store the event id Every event has an id. Insert it into a processed_events table with a unique constraint before doing anything…
If you move money, at some point finance will ask "does our ledger match the bank". The honest answer at most startups is "mostly". This post is how we went from "mostly" to a daily report that finance actually trusts. It took us around 4 months, so dont feel bad if yours is still a spreadsheet. Three sources, not two For card and UPI payments you have three views of the same money: Your ledger: what you think…
small story that cost us almost two weeks, maybe it saves someone we submitted an update for a client's fintech app and google play rejected it for using QUERY_ALL_PACKAGES without a valid reason. problem: we never added that permission. i searched the whole codebase, not there. resubmitted with an explanation, rejected again. the client is calling me every morning at this point turns out android builds your final…
Partner bank sends us a settlement file every morning. We compare it with our ledger and the totals should match to the paisa. One Monday it was off by ₹410.37. Not a lot of money. But a mismatch is a mismatch and finance will not close the day with it. First day we checked the obvious things. Missing transactions, duplicates, refunds settled on a different day. Everything matched row by row on the transaction…
Threat modelling has a reputation for being a heavy process with special tools and a 40 page document nobody reads. It does not have to be. For most features, a 45 minute session with the people who built it finds the important problems. This is the format I use with product teams at the bank. Before the session (10 minutes, one person) Draw the data flow on one page. Boxes for components, arrows for data, and…
Every fintech I have worked at started with a balance column on the users table. And every one of them later spent months moving away from it. If you are building anything where money moves between parties, wallets, marketplaces, lending, start with a ledger. It is less work than it sounds and Postgres gives you almost everything you need. This is the design we run in production now. Nothing fancy. Boring is the…
Last year we had a customer charged twice for the same EMI. Not a big amount, but the customer was right to be angry and our support team spent one full day itself on it. The root cause was not the bank, not the gateway. It was us, and the way we did idempotency keys. Sharing what we got wrong, because since then I have seen the same mistakes in two other codebases. What an idempotency key is supposed to do The…
