Why Fintech Companies Are Hiring More QA Testers in 2026

from decimal import Decimal, ROUND_HALF_UP

# Never use float for money: binary rounding errors appear
print(0.1 + 0.2)          # 0.30000000000000004

def fee(amount: Decimal, rate: Decimal) -> Decimal:
    return (amount * rate).quantize(Decimal("0.01"), rounding=ROUND_HALF_UP)

amount = Decimal("1999.99")
print(fee(amount, Decimal("0.018")))   # 36.00

# Tester's check: fee + net must equal the original amount
net = amount - fee(amount, Decimal("0.018"))
assert net + fee(amount, Decimal("0.018")) == amount

-- Transfers that left the sender but never reached the receiver
SELECT d.txn_id, d.amount, d.created_at
FROM ledger_debits d
LEFT JOIN ledger_credits c
  ON c.txn_id = d.txn_id
WHERE c.txn_id IS NULL
  AND d.created_at < NOW() - INTERVAL '15 minutes';

-- Daily check: total debits should equal total credits plus fees
SELECT
  (SELECT SUM(amount) FROM ledger_debits  WHERE created_at::date = CURRENT_DATE) AS debits,
  (SELECT SUM(amount) FROM ledger_credits WHERE created_at::date = CURRENT_DATE) AS credits,
  (SELECT SUM(amount) FROM fees           WHERE created_at::date = CURRENT_DATE) AS fees;

# pytest example against a test/sandbox payments API
import uuid
import requests

BASE = "https://sandbox.example.test/api"

def test_duplicate_request_creates_one_payment():
    key = str(uuid.uuid4())
    body = {"to": "ACC-002", "amount": "500.00"}
    headers = {"Idempotency-Key": key}

    r1 = requests.post(f"{BASE}/payments", json=body, headers=headers, timeout=10)
    r2 = requests.post(f"{BASE}/payments", json=body, headers=headers, timeout=10)

    assert r1.status_code in (200, 201)
    assert r2.json()["payment_id"] == r1.json()["payment_id"]

Daily transfer limit: Rs 1,00,000 (example rule)

TC01  Transfer 99,999 -> success
TC02  Transfer 1,00,000 -> success (boundary)
TC03  Transfer 1,00,001 -> blocked, clear message
TC04  Two transfers 60,000 + 50,000 same day -> second blocked
TC05  Limit resets at midnight -> next-day transfer allowed
TC06  Failed transfer does not count towards limit
TC07  Reversed transfer restores available limit
TC08  Limit message does not reveal other users' data

# A user must never read another user's account
import requests

BASE = "https://sandbox.example.test/api"

def test_cannot_view_other_users_account(user_a_token):
    # user_a_token is a pytest fixture that logs in as test user A
    r = requests.get(f"{BASE}/accounts/ACC-USER-B",
                     headers={"Authorization": f"Bearer {user_a_token}"},
                     timeout=10)
    assert r.status_code in (403, 404)

def test_no_token_is_rejected():
    r = requests.get(f"{BASE}/accounts/ACC-USER-A", timeout=10)
    assert r.status_code == 401

Fintech security test checklist (test environments only)

[ ] Login locks or slows after repeated wrong attempts
[ ] OTP expires and cannot be reused
[ ] Sessions expire after inactivity
[ ] Users cannot access other users' data by changing IDs
[ ] Sensitive data masked in UI, logs and emails
[ ] Error messages do not reveal internal details
[ ] All traffic uses HTTPS

Feature: Wallet-to-bank transfer

In scope: amount entry, limits, OTP, success, failure,
          reversal, statement entry, notifications
Out of scope: partner bank internal systems

Risks:
- Money debited but not credited
- Duplicate transfers on retry
- Limit bypass

Test types: functional, API, negative, security basics,
            reconciliation with SQL
Exit criteria: no open critical bugs; ledger balances

Failure scenario list

- Partner bank times out after debit
- App closed during payment
- Network switches from Wi-Fi to mobile data
- OTP delivered late
- Same request sent twice
- Server restarts mid-transaction
- Insufficient balance after fee added

For each: expected final state of money and message to user

Portfolio project: 'Mini wallet' QA

1. Use a public demo payments sandbox or build a tiny
   mock API with Flask
2. Write 30 test cases incl. limits and failures
3. API tests with pytest (incl. idempotency)
4. SQL reconciliation queries on sample data
5. Security checklist results
6. README explaining risks and coverage