A forged notification cannot move money
Mollie deliberately sends only a payment id and no status at all. The CRM answers by fetching that payment with your API key and trusting nothing else — so a fake notification can name an id but can never claim it was paid.