Where the seam was
The form took money before it took identity. That order is good for conversion and terrible for records: by the time we knew who had paid, we had already created the account they paid into.
What went wrong
Phone numbers turned out to be a household field, not a personal one. Two siblings sharing one number arrived as one learner with two payments, and a single transposed digit could drop a stranger into somebody else's history.
The fix
Identity moved to a verified channel before the account was written, and the payment reference became the thing we reconciled against rather than the thing we identified by. Merges are now proposed, reviewed and reversible instead of silent.