Opayo Integration Penetration Testing
Opayo returns a payment result as an encrypted field, a signed notification or an API response. We test whether your code checks each one properly before it marks an order paid. CREST-certified testers, fixed price from £2,960 for a 2-day single-integration scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Opayo confirms a payment through a returned field, a server notification or an API response, depending on which integration method you used. Each one can be replayed, forged or misread if your code does not check it against Opayo directly.
Why Opayo’s payment result needs checking, not just reading
Opayo’s older integrations do not let your application ask whether a payment succeeded, they tell it, and the risk sits in how that answer is checked. A Form integration encrypts the outcome into a Crypt field appended to your success or failure URL, built with the encryption password issued to your account, as set out in the Form integration and protocol guidelines. A Server integration instead POSTs the result to your NotificationURL and signs it with a VPSSignature, an MD5 hash of the posted fields and a SecurityKey shared only between your server and Opayo, described in the Server integration and protocol guidelines.
Opayo’s Pi integration works the other way: your server calls a REST API, authenticated with an Integration Key and Password sent as HTTP Basic credentials, and reads the transaction result back directly. Opayo’s own Pi API reference sets a Merchant Session Key to expire after 400 seconds and allows it one successful use, so the design assumes short-lived, single-use tokens rather than credentials your application holds indefinitely. Whichever method you use, we test how your code actually checks the result, the Crypt field, the VPSSignature or the API response, rather than assuming a redirect or a callback alone means a payment happened.
The rest of the risk sits in the detail around the result rather than the result itself. Every transaction needs a unique VendorTxCode, since Opayo rejects a repeated one, and that code is what ties your order record back to the VPSTxId and amount Opayo actually processed. Refunds and REPEAT transactions are checked against the original transaction’s value and Opayo will reject a refund that exceeds it, but your application still needs to enforce who is allowed to trigger one. Opayo also publishes a public sandbox environment and warns against using real card details there, which is where we run as much of this testing as the engagement allows. None of this requires attacking Opayo’s gateway, in the same way we test the code built around Worldpay. It is entirely about what your team built on top of it.
SCOPE
What we pen test on an Opayo integration
Form integration result verification
Whether your success and failure pages decrypt and check the Crypt field appended to the SuccessURL and FailureURL rather than trusting an unauthenticated redirect, and what a forged or replayed outcome achieves if your fulfilment logic reads it directly.
Server notification signature checks
Whether your NotificationURL script recomputes the VPSSignature MD5 hash from the posted fields and your SecurityKey before acting on a Status, and whether a mismatched, missing or replayed signature is correctly declined rather than treated as OK.
Pi API transaction and session handling
Whether your server uses the Integration Key and Password to create Merchant Session Keys and confirm transaction status directly from the API, rather than a client-side script telling your application a payment completed.
VendorTxCode and order reconciliation
Whether every transaction registration uses a genuinely unique VendorTxCode and your order records are matched against the VPSTxId and amount Opayo actually returns, rather than an order value your application already believed. We test this the same way we test it for a Worldpay integration.
Callback and redirect URL handling
How SuccessURL, FailureURL, NotificationURL and RedirectURL values are validated, and whether a customer can substitute another transaction’s reference in the redirect back to your site to view or claim someone else’s order.
Encryption password and integration credentials
Where the Form encryption password or the Pi Integration Key and Password are stored and whether either ever reaches browser-side code, plus what an exposed credential alone would let an attacker register or query.
Refund and repeat authorisation
Who can trigger a refund or a REPEAT transaction against a stored reference, whether the amount is checked against what the original transaction actually settled for, and whether one customer’s session can act on another customer’s VendorTxCode.
Test and live environment separation
Whether test encryption passwords, test Integration Key and Password pairs, or test VendorTxCode ranges can reach the live gateway or vice versa, and what your integration does if a test-environment notification arrives on the endpoint that expects live traffic.
3D Secure and authentication result handling
Whether your code checks the 3DSecureStatus and CAVV values Opayo returns before treating a transaction as authenticated, and how an AUTHENTICATED, REGISTERED or NOTCHECKED outcome changes what your application does next.
Amount and currency integrity
Whether the amount and currency sent to Opayo are recalculated server-side from your own order data immediately before registration, rather than trusted from a client-supplied value, and how rounding or a currency change between registration and completion is handled.
OUR PROCESS
Opayo Integration Penetration Testing: From Scope to Attestation
Scope the integration
We list every Opayo touchpoint in your application: Form, Server or Pi calls, the notification or callback endpoints, and any refund or repeat logic, then confirm which credentials belong to test and which belong to live.
Test against your test environment first
Crypt field handling, notification signatures, reconciliation and refund logic are tested against Opayo’s test credentials and sandbox wherever the check allows; anything that genuinely needs live Opayo is agreed with you first and run read-only.
Exploit the business logic
CREST-certified testers chain findings across the payment-result, reconciliation and refund flow, covering forged callbacks, replayed notifications, VendorTxCode reuse and amount tampering rather than relying on scanner output alone.
Report and retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, free retest after remediation, and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Opayo pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Opayo Integration Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Opayo For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Opayo Integration Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need?
Test credentials for whichever method you use: the test encryption password for Form, a test Integration Key and Password for Pi, or a test Vendor account and SecurityKey for Server. We do not need your live Opayo credentials or MyOpayo login, and only need scoped, read-only production access where a specific check requires it.
Does this touch live Opayo transactions or real card data?
No, wherever the check allows. Opayo publishes a sandbox environment built for testing integrations end to end, and explicitly warns against using real card details there. Anything that must run against live Opayo is agreed with you in advance and scoped tightly.
How long does an Opayo integration test take?
A single integration, Form, Server or Pi, is a 2-day scope. Multiple integration methods in the same application, or Opayo running alongside a second payment provider, add testing days, which we agree before the engagement starts.
We use Form integration and barely touch the Crypt field ourselves, is there still anything to test?
Yes. Even a mostly-hosted Form integration decrypts and reads the response Crypt field on your success and failure pages, and that is exactly where a forged or replayed outcome would be trusted or rejected. Your VendorTxCode generation and order-matching logic sit outside Opayo’s hosted pages too.
What is out of scope?
Opayo’s own gateway, card-issuing banks and the 3D Secure directory infrastructure. We test the integration your team built: Crypt handling, notification scripts, VendorTxCode generation, refund authorisation and credential storage, never Opayo’s platform itself.
Is Opayo the same gateway I might know under an older name?
Yes. The product was called Sage Pay until Elavon completed its acquisition of the UK and Ireland business from Sage Group in March 2020, and it was renamed Opayo in July 2020. Elavon, a subsidiary of U.S. Bancorp, has run the gateway since, and the Form, Server and Pi protocols work the same way regardless of which name appears on your account or your documentation.
Does Opayo have a policy on this kind of testing?
Opayo’s sandbox environment is built specifically for testing an integration without real card data, which is where we run as much of this engagement as possible. Beyond that, we confirm Opayo and Elavon’s current terms with you during scoping and treat any live-environment check as a separate, pre-agreed exception.
Do you test REPEAT and DEFERRED transactions as well as PAYMENT?
If your integration uses them, yes, they are scoped in alongside the core payment flow. Tell us at quoting stage which transaction types your application sends, PAYMENT, DEFERRED, REPEAT or AUTHENTICATE and AUTHORISE, so the scope and day count reflect what is actually integrated.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Opayo integration
Opayo returns a payment result as an encrypted field, a signed notification or an API response. We test whether your code checks each one properly before it marks an order paid. CREST-certified testers, fixed price from £2,960 for a 2-day single-integration scope, quoted within 24 hours.
