Keep your own totals, fed by webhooks
Subscribe to the payment events, add each one to a figure you hold, and check that figure against the summary report.
Your answers so far
Choose one
What to build
Register a webhook destination, subscribe to the transaction events, and accumulate the amounts as they arrive. Then reconcile against the merchant summary report on a schedule, because a running total assembled from a stream is the one number nothing else in your system can check.
What this means for PCI
This is guidance rather than a compliance determination. Which questionnaire you are eligible for depends on your full environment, so confirm it with your QSA or your acquirer before you rely on it.
Worth knowing
- Delivery is at least once. Record the event id you have already handled and ignore a repeat, because a retry after a slow acknowledgement is an ordinary event rather than a fault.
- Acknowledge within five seconds. Put the raw body on a queue and process it after you have answered, because slow handling is retried and a retry is a duplicate you then have to discard.
- Reconcile at least daily. A total that has drifted is still a number, and it keeps being displayed until something compares it with the report.