best practice for wallet charge in laravel for booking flights system

Assume that we want to create a booking flights system that use an external API we have these steps to get ticket

1. search flights
2. select flights
3. send passenger data
4. if we have enough charge in our wallet can book ticket
5. if we don't have ticket go to bank gateway and in callback if successful payment charge wallet and then send to api to book ticket
6. If failed payment we show the error and nothing more need to do

For step 5 i use ATlpay API as a bank gateway , they working with GET Callback

I create a database transactions with these fields

Id             |             api_id     |   amount  |             status                         | user_id
AUto Increment | atlpay transaction id |  double   |  Enum('start' , 'failed' , 'success'  )    |  AUth::user()->id

Its the scenario off sending user to bank Gateway

1.create transaction with price and user_id and return a transaction with id 7
    1.A and set **callback url** for bank like my_site.com/transaction/callback/7

2.post request to bank to get a url 
2.in successful request bank get us an url and atlpay_id like u3873873873873 that is unique
    2.A we save this id to transaction $transaction->api_id  = u3873873873873 ; $transaction->save();

3.redirect user to bank url like ( atlpay.com/transaction/u3873873873873)

4.after bank payment is complete bank redirect to our **callback url**  that set in step 1.A

after bank redirect to my_site.com/transaction/callback/7 , I get the $transaction for this user and this transaction id ( in this example is 7) if the transaction status is 'start'

And after then i change the status to failed to other request can't get to this transaction ( But i know that it's not guaranteed this requirement! I want to find best practice to only one request can achieve this line and other line after that //ONLY ONE REQUEST MUST achieve this ++++

 $transaction= Auth::user()->transactions()
        ->where('status' , 'start')
        ->where('id' , $id)
        ->first();

    if(!$transaction)
        dd("You are not The owner");

//ONLY ONE REQUEST MUST achieve this ++++

    $transaction->status = 'failed';
    $transaction->save();

    $api_url = 'transactions/'.$transaction->api_id;
    $payment_data  = $this->get_transaction_payment_data($api_url);

    if(is_success_payment($payment_data )
       $this->charge_wallet($payment_data->price);

via Chebli Mohamed