I've noticed this kind of architecture in hub payment systems(system where you can pay to multiple merchants at one place-thus called hub).
payment app-->payment mediator-->bank server
- Bank server deducts money
- Bank server responds that it deducted money to payment mediator
- Now payment mediator requests for verification by sending a hmacsha512 hash.
- Bank server responds sucess or failure
I don't understand why are we checking integrity and authenticity after deducting the bank server says it has deducted the balance?
IMO it should be done atomically.