Turn the contract into a test list
Start with the signed agency contract, data map, integration guide, incident plan, and current legal advice. List every promised control. Common items include user roles, approval steps, payment matching, audit logs, data location, retention, backup, recovery, and incident notice.
Give each control an owner and evidence record. A policy cannot verify a payment check. Keep the API result, database rule, log event, and failed test that show the control works.
1. Payment reference validation
Store the expected amount, currency, agency, service, payer, and reference before payment. After the provider reports success, fetch the payment result through the approved server channel. Compare every stored field. Reject a paid reference tied to another obligation.
Test a smaller amount, another service, another payer, another agency, a cancelled payment, a test reference in production, and the same reference twice. Keep both provider responses and the local obligation record.
2. Revenue collection mandate manipulation
Change one mandate field at a time: amount, fee type, payer, due date, account, and agency. Send the same paid mandate twice. Send steps out of order. The server must load trusted values from its database and record one final result for each obligation.
3. Government employee salary data access control
Create users from two agencies and several roles. Change agency, employee, and batch IDs in every request. Test exports, search, reports, and direct file links. A user must see only the records granted by the server-side role and agency scope.
4. GIFMIS integration authorization testing
For any finance-system integration, map every credential, operation, callback, queue, and stored field. Confirm the credential has the smallest scope, rotates safely, stays out of client code, and creates an audit event when used. Test expired credentials and a request outside the approved operation.
5. E-receipt and payment confirmation forgery
Try to create a receipt before payment, change its visible fields, reuse its verification code, and open another payer's receipt. The verification page must load trusted server data and show the current payment state. A PDF or QR code must never prove payment by itself.
A paid reference satisfies the wrong obligation
The platform checks only the word “paid.” It does not compare the amount, agency, service, or payer with the stored mandate. A valid low-value payment can satisfy a different obligation. Fix this with full server-side matching and one-time use.
Evidence and pass rules
Keep the test account, role, obligation ID, reference, expected fields, provider response, local record, audit event, and final receipt state. Redact citizen and payment data.
A test passes when every changed field returns a clear rejection, no receipt is issued, no balance changes, and the failed attempt appears in the audit log. Repeat the same request after the fix.
Operating a government payment, revenue collection, or Remita-integrated platform in Nigeria? Book a security assessment that satisfies government MDA contract security requirements.
Book a Government Fintech Security AuditFrequently asked questions
Do government-facing fintechs face different regulatory obligations than consumer fintechs?
The exact duties depend on the service, licence, data, agency contract, and role of each party. Build a control list from the signed contract and current rules. Assign an owner and evidence record to every control.
What makes Remita integration a specific security target?
A payment reference links an obligation to a payment result. Weak validation can accept a paid reference with the wrong amount, currency, agency, payer, or purpose. The platform must compare every required field with its own stored mandate.
What security certification do government-facing fintechs need in Nigeria?
There is no single certificate for every government payment platform. The agency contract and current rules define the required audits, reports, standards, and licences. Ask the agency and legal counsel for the written list before promising a certification.
Related reading
Blog: Webhook security in payment platforms · CBN PSP licence requirements · Interswitch and GT Pay security
Services: Penetration testing · API security