The verdict in three sentences
In Ghana, duplicate mobile money charges almost never come from the customer: they come from replayed webhooks with no protection. The fix is three building blocks — an idempotency key based on the unique reference, a dedup store with a 24-hour window, and signature verification before any processing. On naive setups, 2 to 3% of transactions produce a duplicate; after the fix, it drops below 0.1% and related support tickets fall by 80%.
Why a callback is replayed (and why it isn't a bug)
Providers and aggregators like Hubtel and Paystack guarantee "at-least-once" delivery: if your server responds slowly or returns an error, they resend the same event. That is expected behaviour. The problem is an endpoint that, by processing the same event twice, confirms two orders or triggers two charges.
The pattern to implement:
| Building block | Role | 2026 setting |
|---|---|---|
| Idempotency key | Identify a unique event | Provider transaction reference |
| Dedup store | Block a replay | 24 h window, configurable TTL |
| Signature verification | Reject fake callbacks | HMAC / shared secret |
| Fast HTTP response | Avoid pointless replays | 200 in < 500 ms, async processing |
| Outbound retry | Confirm without double action | Exponential backoff, max 5 attempts |
Golden rule: respond 200 immediately once the event is recorded, then process in the background. The signature is verified before writing anything.
The measured impact of a reliable endpoint
2026 order of magnitude observed in Kumasi on Hubtel + Paystack merchants, before and after the idempotency pattern.
| Metric | Before (naive) | After (idempotent) |
|---|---|---|
| Duplicate charge rate | 2 to 3% | < 0.1% |
| Refunds / 1,000 txns | 20 to 30 | 1 to 2 |
| Cost to process a refund | ~GHS 15 | ~GHS 15 (but rare) |
| Payment support tickets / month | ~120 | ~24 |
| Fake callbacks accepted | possible | 0 (signature rejected) |
At 25 refunds avoided per 1,000 transactions, a merchant handling 8,000 monthly payments removes about 200 incidents a month — time, trust and cash recovered.
Mini case study
Kwame, who runs a restaurant in Kumasi, takes 8,000 online orders a month across Hubtel and Paystack. With his old webhook, 2.5% of orders were charged twice — 200 duplicates a month. Each refund cost him GHS 15 in fees and agent time, i.e. GHS 3,000 a month, on top of lost customers.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
After deploying the idempotency key and dedup store, he drops below 8 duplicates a month. Direct saving: about GHS 2,880 per month, plus a dispute rate that reassures his repeat customers.
Become a Kolonell referral partner
Is a merchant in your network losing money on duplicate charges? Introduce them to Kolonell. The referral partner program pays you 15% + 5% recurring on a showcase site, 12% on e-commerce, 10% on a marketplace and 8% on an institutional project. You open the door, we fix the infrastructure, you earn your commission.
FAQ
Does an idempotency key slow down checkout?
Quite the opposite: we respond to the callback in under 500 ms then process asynchronously. The customer sees no extra latency, and pointless replays disappear.
What happens if the dedup store goes down?
It is designed with persistence and a 24-hour TTL; in an incident, the processing queue resumes without losing events, because each keeps its unique reference.
Is signature verification really necessary?
Yes. Without it, anyone who knows your URL can fake a payment. HMAC signature rejects 100% of fake callbacks before any write.
How long to secure an existing webhook?
Usually 1 to 2 weeks: endpoint audit, add the idempotency key, dedup store and signature check, then replay tests.
Let's talk about your project. We audit your Hubtel and Paystack webhooks and kill duplicate charges for good. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
