The verdict in three sentences
A double charge is almost never fraud: it is a double-click, a network retry or a webhook replayed by the operator. The defense is an idempotency key that guarantees a single payment intent produces exactly one transaction, no matter how many times the request arrives. Wired properly, it drops the double-credit rate from 0.4 % to 0 % — measured on a load test of 5,000 requests per minute.
Where double charges come from
Understanding the cause lets you pick the right guard. Here are the most common 2026 scenarios and their fix.
| Cause | Estimated frequency | Fix |
|---|---|---|
| Double-click on pay button | ~40 % of cases | Client-side idempotency key |
| Automatic network retry | ~30 % | Server-side idempotency |
| Webhook replayed by operator | ~20 % | Deduplication by event ID |
| Timeout then new attempt | ~10 % | DB lock + idempotent status |
Each cause is neutralized by the same principle: one request = one unique key, and the server refuses to replay a key already processed.
The three layers of protection
Robust idempotency rests on three complementary guardrails, not one.
| Layer | Role | Measured effect |
|---|---|---|
| Idempotency key | One intent = one key | Blocks replays |
| Row lock (DB) | One concurrent write only | Prevents the race condition |
| Webhook queue | Ordered, single processing | 0 double credit |
| SQL unique constraint | Final safety net | Rejects the duplicate at the DB |
The 2026 pattern: the client sends an idempotency key, the server locks the order, processes the payment, then inbound webhooks are deduplicated by their event ID before writing. The database unique constraint is the last net if everything else fails.
Mini case study
Halima runs a ticketing platform in Accra selling 12,000 tickets a month at 5,000 FCFA. Before idempotency, 0.4 % of transactions were charged twice — 48 double charges a month — each needing a 30-minute manual refund and an unhappy customer. Hidden cost: 24 support hours a month plus brand damage. After wiring the idempotency key and webhook queue, the 5,000 req/min load test shows 0 double credit. Ticketing support reclaims 24 hours a month.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
What is an idempotency key exactly?
It is a unique identifier generated for each payment intent (for example a UUID). The server remembers the key: if the same key returns, it replays the stored result instead of charging again.
Can a double-click really charge twice?
Yes, without a guard. Two requests fire in parallel, each creating a transaction. It is the number-one cause of double charges, estimated at 40 % of cases.
Why deduplicate webhooks?
Operators sometimes replay a webhook several times to guarantee delivery. Without deduplication by event ID, each replay can create a phantom credit.
What does an untreated double charge cost?
Beyond the refund, count about 30 minutes of support per case plus dispute risk. Over 48 monthly cases that is 24 hours of lost work.
Does idempotency slow the payment down?
No: the lock and key check add a few milliseconds. Our 5,000 req/min test stays smooth with 0 double credit and no perceptible degradation.
Let's talk about your project. We wire idempotency, locks and the webhook queue to eliminate double charges. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
