Duplicate-charge protection

Duplicate-charge protection is a control system, not a single database check. It connects the business instruction, authorization, idempotency identity, provider object, ledger posting, webhook events, and reconciliation result so the same intended charge cannot be applied twice through retries or parallel workflows.

A useful duplicate-protection artifact is a correlation record: one approved action ID, one property and tenant or vendor scope, one amount and currency, one provider identity, all delivery attempts, all received events, and the ledger transaction produced. It should distinguish a legitimate recurring charge from an accidental repeat.

A landlord approves a $95 lock replacement charge. A slow response causes the app to retry while a webhook from the first request also arrives. If the API request, webhook consumer, and ledger writer use unrelated identities, two $95 lines can appear. A safe design recognizes the first provider object, ignores or links the duplicate event, and reconciles one ledger effect.

Ask vendors to demonstrate double-clicks, concurrent workers, response timeouts, webhook redelivery, and a manual retry from support. Also ask how a suspected duplicate is reversed without deleting the original record. A unique invoice number alone may not protect the processor charge or the downstream ledger entry.