The fingerprint ledger
Each M-Pesa callback is stored with a keyed hash of exactly what Safaricom sent. Change a stored record and it stops matching.
| Time | Entry | Fingerprint |
|---|---|---|
| 10:42 | Customer payment confirmed | 9f3a·c1e0 |
| 10:42 | Commission held in escrow | 41d7·08b2 |
| 16:05 | Payment settled, cleared | e6b0·5a9c |
| 16:06 | Sent to agent’s M-Pesa | 2c58·f71d |