Separation of duties in a money system

Any system that moves money accumulates a category of operation that is necessary and dangerous: the manual adjustment. A fare refunded, a wallet corrected, a payout amended.

These exist because reality is messy. They are also exactly where fraud lives, in every organisation, without exception.

The rule

The person who requests an adjustment cannot be the person who approves it. This is enforced in the system rather than left to convention: an attempt to approve one's own request is rejected.

Conventions are only as strong as the busiest afternoon of the year. A rule in code holds on that afternoon too.

Why enforcement matters more than policy

A policy document that says two people must be involved is only ever tested when someone decides not to comply. The control that matters is the one that makes non-compliance impossible rather than discouraged.

It also protects the people doing the work. A finance officer who cannot approve their own adjustment cannot be suspected of having done so.

Idempotency on writes

A related discipline. Financial operations carry keys so that a retried request does not double-apply. A network timeout on a payment should never be able to charge twice, and the way to guarantee that is to make the second attempt recognise itself rather than to hope it does not happen.

Consistency checks

Wallet balances are checked against their ledgers rather than trusted. A balance is a derived figure, and any derived figure that is not periodically reconciled against its source will eventually drift.

Running that check regularly means a discrepancy is found while it is small and while the surrounding records still explain it.

Why write about this

Because it is the least visible part of a platform and among the most consequential. Riders and drivers never see any of it, and would notice immediately if it were absent.