#API security

Make both payment references vouch for each other

A verified transaction proves that someone paid. It does not prove they paid for the thing you are about to mark as paid.