diff --git a/digital-avatar-app/backend/routers/tokens.py b/digital-avatar-app/backend/routers/tokens.py
index a4bc8aa..3a030b6 100644
--- a/digital-avatar-app/backend/routers/tokens.py
+++ b/digital-avatar-app/backend/routers/tokens.py
@@ -1087,12 +1087,12 @@ async def huihui_virtual_payment_notify(request: Request, db: Session = Depends(
         callback_env = int(payload.get("env"))
     except (TypeError, ValueError, WechatVirtualPaymentError):
         raise HTTPException(status_code=422, detail="invalid virtual payment details")
+    callback_open_id = str(payload.get("openId") or "").strip()
     if (
         isinstance(payload.get("amountCents"), bool)
         or isinstance(payload.get("env"), bool)
         or not user
-        or not user.wechat_mp_openid
-        or str(payload.get("openId") or "") != user.wechat_mp_openid
+        or (callback_open_id and callback_open_id != user.wechat_mp_openid)
         or not expected_product_id
         or str(payload.get("productId") or "") != expected_product_id
         or amount_cents != order.price_cents
diff --git a/digital-avatar-app/backend/tests/test_virtual_payment_flow.py b/digital-avatar-app/backend/tests/test_virtual_payment_flow.py
index 3bb7540..4c29ad7 100644
--- a/digital-avatar-app/backend/tests/test_virtual_payment_flow.py
+++ b/digital-avatar-app/backend/tests/test_virtual_payment_flow.py
@@ -55,7 +55,6 @@ def test_huihui_virtual_callback_requires_signature_and_exact_order_details(auth
             "status": "SUCCESS",
             "amountCents": 1000,
             "productId": "Basic",
-            "openId": "openid-huihui-callback",
             "env": 1,
         }
         path = "/api/token/payment/huihui/virtual/notify"
@@ -64,6 +63,8 @@ def test_huihui_virtual_callback_requires_signature_and_exact_order_details(auth
         assert client.post(path, content=body, headers={"X-Huihui-Timestamp": str(int(time.time())), "X-Huihui-Signature": "bad"}).status_code == 401
         wrong = json.dumps({**payload, "amountCents": 999}, separators=(",", ":")).encode()
         assert client.post(path, content=wrong, headers=_huihui_virtual_headers(secret, wrong)).status_code == 422
+        wrong_openid = json.dumps({**payload, "openId": "different-user"}, separators=(",", ":")).encode()
+        assert client.post(path, content=wrong_openid, headers=_huihui_virtual_headers(secret, wrong_openid)).status_code == 422
         first = client.post(path, content=body, headers=_huihui_virtual_headers(secret, body))
         second = client.post(path, content=body, headers=_huihui_virtual_headers(secret, body))