Map every role and payment state
List each role and action: view balances, add a beneficiary, create a payment, approve it, change a limit, manage users, issue an API key, and export records. Test each action with the right role, the wrong role, an old role, and a user from another company.
Map payment states from draft to settled, rejected, expired, or reversed. The server decides which move is valid.
1. Maker-checker bypass testing
The maker-checker (dual control) workflow is the primary fraud prevention control for business payments. We test it systematically by attempting to approve a payment using the same account that created it, by directly calling the approval endpoint without going through the initiation flow, by escalating a view-only account to initiator through role manipulation, and by submitting a payment approval request with a modified payment amount that differs from the amount the approver reviewed.
The approval endpoint must validate all of the following independently: that the approver is a different user than the initiator, that the approver has the required approval role, that the payment details in the approval request match the payment details in the database record (not the client-submitted parameters), and that the payment has not already been approved or rejected.
2. Bulk payment file injection
Upload CSV and Excel files with duplicate rows, formula cells, extra columns, missing values, long text, mixed currencies, and changed totals. Approve a batch, then try to replace the file or beneficiary. The execution service must use the locked batch that the checker reviewed.
3. Sub-account and multi-entity access control
Create two companies and two entities under each. Change company, entity, account, beneficiary, and payment IDs in every request. Parent access needs an explicit grant. Child access must never rise through an ID change.
4. API key management for programmatic access
Issue separate test keys for read, payment, and admin work. Call operations outside each scope. Test expiry, rotation, revocation, source limits, replay, and key use after the issuing user loses access. Logs must name the key without storing its secret.
Maker-checker bypass via direct approval endpoint call
The maker calls the approval endpoint with the same session and the payment moves forward. Reject this at the service and database layers. The approver must be a different active user with the right role for that company and amount.
Evidence and pass rules
Keep the company, roles, payment state, locked batch hash, request, response, approval record, provider test result, and audit event. Use synthetic beneficiaries.
A test passes when the wrong user gets a clear rejection, the payment state and batch stay unchanged, no provider call starts, and the log records the failed action.
Running a business banking or B2B fintech platform in Nigeria? Test the full payment and approval path.
Book a Business Banking PentestFrequently asked questions
Why are business banking accounts higher-value targets than consumer accounts?
Business accounts can hold payroll, supplier, tax, and operating funds. They also support several users and bulk actions. One weak approval or role check can affect a full payment batch.
What is maker-checker authorization in business banking?
Maker-checker is a dual-control workflow where one user creates a payment instruction and a second, separate user must approve it before it executes. This is a standard fraud control in business banking. The security test question is: can the maker bypass the checker by manipulating the approval API directly, or can a single compromised account both create and approve its own payments?
Do enterprise clients demand security testing from their business banking providers?
Some clients ask for a current penetration test report, remediation records, architecture details, or a security questionnaire. Ask each buyer for its exact evidence and reporting window.
Related reading
Blog: Secure banking solutions in Nigeria · BOLA in financial APIs · Proving security to enterprise clients
Services: Penetration testing · API security