MFS Auto-Pay Studio

bKash • Nagad • Rocket • uPay SMS Auto-Gateway Simulator

Gateway Online Get Code

MFS Broadcaster

Listening SMS...

ID: companion_031A V1.2-STABLE

Receiver Settings Auto-configured

Target Webhook URL

Secret Passphrase

Simulated Delay

Active MFS Listeners Checks Broadcast Action

bKash

Nagad

Rocket

uPay

Broadcast Stream Logs

// Broadcaster initialized...

// Awaiting android.provider.Telephony.SMS_RECEIVED

Trigger Simulated Payment SMS Acts as SMS sender

Or type custom MFS incoming SMS message:

Live Server Endpoint Monitor

Incoming JSON Request

Awaiting webhook callback...

Simulated DB Table

TrxID	Amount	MFS	Status
No transactions registered yet.

Store Checkout Simulator Order ID: #ORD-99827

Item Summary

1x premium subscription Tk 500.00

Processing Fees Tk 0.00

Total Payable: Tk 500.00

Send money manually to recipient number, then insert transaction ID below to test the instant auto-verification check.

Customer Sender Phone Number

Transaction ID (TrxID)

Amount Submitted

Implementation Blueprint & Developer Code Hub

Deploy this automated system inside your production environment with absolute confidence.

This Android BroadcastReceiver triggers on incoming SMS. It evaluates Regex matches to extract critical transaction details and initiates an HTTP POST command dispatch to your central merchant servers.

SMSReceiver.kt

package com.mfs.autoverify

import android.content.BroadcastReceiver
import android.content.Context
import android.content.Intent
import android.telephony.SmsMessage
import android.util.Log
import okhttp3.*
import okhttp3.MediaType.Companion.toMediaType
import okhttp3.RequestBody.Companion.toRequestBody
import org.json.JSONObject
import java.io.IOException
import java.util.regex.Pattern

class SMSReceiver : BroadcastReceiver() {
    private val client = OkHttpClient()

    override fun onReceive(context: Context, intent: Intent) {
        if (intent.action == "android.provider.Telephony.SMS_RECEIVED") {
            val bundle = intent.extras
            if (bundle != null) {
                val pdus = bundle["pdus"] as Array<*>?
                if (pdus != null) {
                    for (pdu in pdus) {
                        val message = SmsMessage.createFromPdu(pdu as ByteArray)
                        val sender = message.originatingAddress ?: ""
                        val body = message.messageBody ?: ""
                        
                        // Parse matching messages from bKash, Nagad, Rocket, uPay
                        if (isMFSMessage(sender, body)) {
                            parseAndSendPayload(body, sender)
                        }
                    }
                }
            }
        }
    }

    private fun isMFSMessage(sender: String, body: String): Boolean {
        val upperSender = sender.uppercase()
        return upperSender.contains("BKASH") || upperSender.contains("NAGAD") || 
               upperSender.contains("ROCKET") || upperSender.contains("UPAY") || 
               body.contains("TrxID") || body.contains("TxnID")
    }

    private fun parseAndSendPayload(body: String, mfsGateway: String) {
        var amount = "0.0"
        var trxId = ""
        var senderPhone = ""
        var balance = "0.0"
        var method = "UNKNOWN"

        if (body.contains("bkash", ignoreCase = true) || mfsGateway.uppercase().contains("BKASH")) {
            method = "bKash"
            val amtPattern = Pattern.compile("received Tk ([\\d,.]+)")
            val trxPattern = Pattern.compile("TrxID ([A-Z0-9]+)")
            val senderPattern = Pattern.compile("from ([\\d]+)")
            val balPattern = Pattern.compile("Balance Tk ([\\d,.]+)")

            val amtMatcher = amtPattern.matcher(body)
            val trxMatcher = trxPattern.matcher(body)
            val senderMatcher = senderPattern.matcher(body)
            val balMatcher = balPattern.matcher(body)

            if (amtMatcher.find()) amount = amtMatcher.group(1) ?: "0.0"
            if (trxMatcher.find()) trxId = trxMatcher.group(1) ?: ""
            if (senderMatcher.find()) senderPhone = senderMatcher.group(1) ?: ""
            if (balMatcher.find()) balance = balMatcher.group(1) ?: "0.0"
        } else if (body.contains("nagad", ignoreCase = true) || mfsGateway.uppercase().contains("NAGAD")) {
            method = "Nagad"
            val amtPattern = Pattern.compile("(?:Received Tk\\.|Received Tk|Tk\\.)\\s*([\\d,.]+)")
            val trxPattern = Pattern.compile("(?:TxnID|TxID|Txn ID):\\s*([A-Z0-9]+)")
            val senderPattern = Pattern.compile("from\\s*([\\d]+)")
            val balPattern = Pattern.compile("Balance:\\s*Tk\\.\\s*([\\d,.]+)")

            val amtMatcher = amtPattern.matcher(body)
            val trxMatcher = trxPattern.matcher(body)
            val senderMatcher = senderPattern.matcher(body)
            val balMatcher = balPattern.matcher(body)

            if (amtMatcher.find()) amount = amtMatcher.group(1) ?: "0.0"
            if (trxMatcher.find()) trxId = trxMatcher.group(1) ?: ""
            if (senderMatcher.find()) senderPhone = senderMatcher.group(1) ?: ""
            if (balMatcher.find()) balance = balMatcher.group(1) ?: "0.0"
        }

        if (trxId.isNotEmpty()) {
            sendWebhook(method, amount, trxId, senderPhone, balance, body)
        }
    }

    private fun sendWebhook(method: String, amount: String, trxId: String, sender: String, balance: String, rawBody: String) {
        val url = "https://api.yourserver.com/v1/payment-webhook"
        val passphrase = "mfs_secure_hash_8891"

        val json = JSONObject()
        json.put("method", method)
        json.put("amount", amount.replace(",", "").toDoubleOrNull() ?: 0.0)
        json.put("trxID", trxId)
        json.put("sender", sender)
        json.put("balance", balance.replace(",", "").toDoubleOrNull() ?: 0.0)
        json.put("raw_sms", rawBody)
        json.put("timestamp", System.currentTimeMillis())

        val mediaType = "application/json; charset=utf-8".toMediaType()
        val requestBody = json.toString().toRequestBody(mediaType)

        val request = Request.Builder()
            .url(url)
            .post(requestBody)
            .addHeader("Content-Type", "application/json")
            .addHeader("X-Passphrase-Signature", passphrase)
            .build()

        client.newCall(request).enqueue(object : Callback {
            override fun onFailure(call: Call, e: IOException) {
                Log.e("MFS_RECEIVER", "Webhook transmission failed", e)
            }

            override fun onResponse(call: Call, response: Response) {
                Log.i("MFS_RECEIVER", "Webhook sent successfully. Code: ${response.code}")
                response.close()
            }
        })
    }
}

This PHP endpoint handles Webhook payloads, matches the API secret key safely, and writes details into an orders/payment database to activate purchase status instantly.

webhook.php

<?php
// Protect endpoint with pre-shared passphrase
$headers = getallheaders();
$passphraseHeader = isset($headers['X-Passphrase-Signature']) ? $headers['X-Passphrase-Signature'] : '';
$expectedPassphrase = 'mfs_secure_hash_8891';

if ($passphraseHeader !== $expectedPassphrase) {
    http_response_code(401);
    echo json_encode(["status" => "error", "message" => "Unauthorized access request signature invalid."]);
    exit;
}

// Read raw body input
$inputJSON = file_get_contents('php://input');
$data = json_decode($inputJSON, true);

if (!$data || !isset($data['trxID']) || !isset($data['amount'])) {
    http_response_code(400);
    echo json_encode(["status" => "error", "message" => "Incomplete request body. Missing trxID or amount."]);
    exit;
}

$method = filter_var($data['method'], FILTER_SANITIZE_STRING);
$trxID  = strtoupper(filter_var($data['trxID'], FILTER_SANITIZE_STRING));
$amount = floatval($data['amount']);
$sender = filter_var($data['sender'], FILTER_SANITIZE_STRING);
$balance = floatval($data['balance']);

// Database PDO connection implementation
try {
    $db = new PDO('mysql:host=localhost;dbname=payment_system;charset=utf8mb4', 'db_user', 'db_password', [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);

    // Check if TrxID already registered to prevent double verification abuse (replay attacks)
    $stmt = $db->prepare("SELECT id FROM payments WHERE trx_id = ?");
    $stmt->execute([$trxID]);
    if ($stmt->fetch()) {
        http_response_code(409);
        echo json_encode(["status" => "error", "message" => "Duplicate payment. Transaction ID already processed."]);
        exit;
    }

    // Insert to DB
    $stmt = $db->prepare("INSERT INTO payments (method, trx_id, amount, sender_phone, wallet_balance, created_at) VALUES (?, ?, ?, ?, ?, NOW())");
    $stmt->execute([$method, $trxID, $amount, $sender, $balance]);

    // OPTIONAL: Automatically match any pending orders awaiting this specific amount & TrxID
    $stmt = $db->prepare("UPDATE orders SET order_status = 'PAID' WHERE customer_phone = ? AND submitted_trx_id = ? AND total_payable = ? AND order_status = 'PENDING'");
    $stmt->execute([$sender, $trxID, $amount]);

    echo json_encode(["status" => "success", "message" => "Transaction parsed and committed successfully."]);

} catch (PDOException $e) {
    error_log("Database Error: " . $e->getMessage());
    http_response_code(500);
    echo json_encode(["status" => "error", "message" => "Internal database transaction failed."]);
}
?>

This Express endpoint allows low-overhead integration to catch payments, serialize transaction hashes into memory or Redis clusters, and authorize client verify queries instantly.

server.js

const express = require('express');
const app = express();
const PORT = process.env.PORT || 3000;

app.use(express.json());

// In-Memory or Redis matching map for fast verifications
const PASSPHRASE = 'mfs_secure_hash_8891';

// Webhook listener from Android app
app.post('/v1/payment-webhook', async (req, res) => {
    const signature = req.headers['x-passphrase-signature'];
    
    if (signature !== PASSPHRASE) {
        return res.status(401).json({ status: 'error', message: 'Signature unauthorized.' });
    }

    const { method, amount, trxID, sender, balance, timestamp } = req.body;

    if (!trxID || !amount) {
        return res.status(400).json({ status: 'error', message: 'Incomplete parameters.' });
    }

    try {
        // DB insert logic using your preferred ORM (e.g., Prisma, Mongoose, Sequelize)
        // await db.payment.create({ data: { method, trxId: trxID.toUpperCase(), amount: parseFloat(amount), sender } });

        console.log(`Payment Webhook Log: Verified ${method} Transfer of Tk ${amount} | TrxID: ${trxID}`);
        return res.status(200).json({ status: 'success', message: 'Payload received and verified.' });
    } catch (err) {
        console.error('Error committing webhook payment:', err);
        return res.status(500).json({ status: 'error', message: 'Server core execution failed.' });
    }
});

// Endpoint called by checkout client to verify a transaction
app.post('/api/verify-checkout', async (req, res) => {
    const { trxID, amount } = req.body;

    if (!trxID || !amount) {
        return res.status(400).json({ status: 'error', message: 'Please provide TrxID and Amount.' });
    }

    // Query Database to find match
    // const payment = await db.payment.findUnique({ where: { trxId: trxID.toUpperCase() } });
    // if (payment && payment.amount === parseFloat(amount)) { ... approve ... }

    res.status(200).json({ status: 'success', matched: true });
});

app.listen(PORT, () => console.log(`Server listening on port ${PORT}`));

This Python FastAPI implementation features asynchronous processing pipelines and rigorous static validation schemas, making it perfect for scaling businesses.

main.py

from fastapi import FastAPI, Header, HTTPException, status
from pydantic import BaseModel
from typing import Optional

app = FastAPI(title="MFS Auto-Verification Webhook Interface")

PASSPHRASE = "mfs_secure_hash_8891"

class PaymentPayload(BaseModel):
    method: str
    amount: float
    trxID: str
    sender: str
    balance: float
    raw_sms: Optional[str] = None
    timestamp: int

@app.post("/v1/payment-webhook")
async def verify_webhook_event(
    payload: PaymentPayload, 
    x_passphrase_signature: Optional[str] = Header(None)
):
    # Verify the matching key passphrase signature header
    if x_passphrase_signature != PASSPHRASE:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Signature validation failed. Secret passphrase mismatch."
        )
    
    # Process the verified payment payload here (e.g. Save transaction logs)
    print(f"Verified {payload.method} Transaction {payload.trxID} worth Tk {payload.amount}")
    
    return {"status": "success", "message": "Transaction committed to persistent database."}