The most common mistake is trusting the amount sent from the browser. Always calculate the amount on your server and create the Razorpay order there.
The second is skipping signature verification. After checkout, compute an HMAC-SHA256 of order_id|payment_id with your key secret and compare it to razorpay_signature.
The third is relying only on the browser callback. If the user closes the tab after paying, the callback never runs. A webhook for payment.captured makes sure the order is still marked as paid.