Payment verification after the callback should not be considered recommended but rather mandatory, since you don't know who is actually making the callback request. Furthermore, the verification URL needs to use HTTPS, otherwise a man-in-the-middle attack can be used to tell the merchant the payment was a success even when it wasn't.