The Client
A payment processing platform commissioned an assessment of merchant, payment and settlement workflows.
The Challenge
The client had completed two automated security scans with well-known commercial tools prior to engaging VCG. Both scans returned clean results: zero critical findings, a handful of medium-severity items (missing headers, TLS configuration notes), and an overall “secure” rating.
With a major banking partnership on the horizon, the client’s CISO wanted independent validation before the compliance audit. The expectation was a routine confirmation of their security posture.
It was anything but routine.
Our Approach
We deployed our DEEP assessment package — 14 days of deep manual expert testing. The engagement covered the merchant dashboard, payment API, settlement engine, internal admin panel, and mobile SDK.
Reconnaissance & Surface Mapping
Within 48 hours, we mapped 218 API endpoints, identified 4 distinct authentication mechanisms, and documented the complete payment flow from initiation to settlement. Automated scanners had tested the public-facing API. They never reached the internal settlement logic, the WebSocket channels feeding real-time transaction data, or the legacy merchant onboarding endpoints still active behind an older subdomain.
Deep Manual Testing
This is where the gap between automated scanning and manual assessment became undeniable. Every endpoint was tested for business logic flaws, authentication bypasses, authorization failures, injection vectors, and race conditions — the classes of vulnerabilities that scanners cannot detect.
Chain Building & Impact Demonstration
Individual findings tell part of the story. We connected them into attack chains that demonstrated real-world impact — the kind of scenarios that resonate with boards and regulators, not just engineering teams.
Reporting & Remediation Guidance
Full technical report delivered with executive summary, prioritized remediation roadmap, and architectural recommendations.
Key Findings
Payment Bypass Chain
The payment confirmation endpoint accepted a merchant callback URL without proper signature verification. By manipulating the callback response, an attacker could mark any transaction as “completed” without actual fund transfer. Combined with a race condition in the settlement queue, this enabled duplicate credit — effectively creating money.
A three-step chain: forge callback → trigger settlement → repeat.
IDOR Across Merchant Accounts
The merchant dashboard API used sequential integer IDs for transaction lookups. Authorization checked whether the requester was a merchant — not whether they were the right merchant. Any authenticated merchant could access transaction records, settlement reports, and customer payment details of any other merchant. Over 100,000 merchant accounts exposed.
Race Condition in Fund Transfers
The internal transfer function between merchant sub-accounts lacked atomic locking. Sending 10 concurrent transfer requests for the same balance resulted in 8-9 successful transfers — multiplying funds.
We demonstrated this with a test account: a $100 balance produced $847 in transferred funds across sub-accounts.
Results at a Glance
| Metric | Automated Scans | VCG Assessment |
|---|---|---|
| Critical findings | 0 | 12 |
| High findings | 0 | 28 |
| Medium findings | 7 | 24 |
| Low / Info | 12 | 13 |
| Total | 19 | 77 |
| Attack chains identified | 0 | 6 |
| Business logic flaws | 0 | 14 |
Impact
The assessment identified payment logic and access-control weaknesses that required remediation. No financial-loss estimate is published here.
The client’s engineering team fixed all 12 critical findings within the first week. The banking partnership proceeded on schedule after a successful re-test confirmed remediation.
Client Feedback
“We were confident in our security posture. Two clean scans, an internal review, no incidents. VCG found 77 issues in two weeks — including payment logic flaws that could have cost us our banking license. The depth of analysis was unlike anything we’d seen.”
— VP of Engineering
The Takeaway
Automated scanners are valuable for catching known patterns at scale. They are not designed to understand business logic, chain vulnerabilities across authentication boundaries, or think like an attacker who reads your JavaScript, maps your payment flow, and finds the one callback that trusts the caller.
Security is not a scan result. It’s an understanding of how your system actually works — and how it breaks.
This case study has been anonymized. All identifying details have been changed. Findings described are representative of the engagement scope and methodology.