Why Fintech Backends Fail at Encryption and Webhook Idempotency

A payment infrastructure engineer highlights two critical but underexplored problems in fintech backends: improper encryption of sensitive fields and non-idempotent webhook handlers. Unlike password hashing, data such as bank account numbers and national IDs must be reversibly encrypted, making key management and algorithm choice crucial. AES-256-GCM is recommended over CBC mode because it provides authenticated encryption, preventing attackers from exploiting decryption oracles to recover plaintext. On the webhook side, payment providers intentionally retry failed or timed-out requests, meaning handlers that are not truly idempotent can process the same event multiple times. The author argues that a database constraint alone is insufficient to guarantee safe deduplication and that both issues are frequently overlooked until a production incident occurs.