Is it possible to fake prv_name in QIWI REST?

Question

Qiwi

It's about the QIWI REST protocol. The store issues an invoice, the user pays the invoice, the QIWI server makes a request to the store server, reporting information about the payment. When invoicing, the store can specify the prv_name field, this field is transmitted by the QIWI server along with payment information. The question is, can the user generate an invoice by specifying his prv_name value? I ask because QIWI has a whole zoo of billing protocols and methods. For example, a user can generate an invoice with any order number using the HTTP protocol. And it is important for me to know that it was the store server that generated the data. Perhaps the prv_name field is suitable for this.