diff --git a/src/lib/exchange_api_withdraw.c b/src/lib/exchange_api_withdraw.c
index aa1468247..85b7e7dbf 100644
--- a/src/lib/exchange_api_withdraw.c
+++ b/src/lib/exchange_api_withdraw.c
@@ -1,6 +1,6 @@
 /*
   This file is part of TALER
-  Copyright (C) 2014-2020 Taler Systems SA
+  Copyright (C) 2014-2021 Taler Systems SA
 
   TALER is free software; you can redistribute it and/or modify it under the
   terms of the GNU General Public License as published by the Free Software
@@ -117,7 +117,24 @@ handle_reserve_withdraw_finished (
       break;
     }
   case MHD_HTTP_ACCEPTED:
-    wr.details.accepted.payment_target_uuid; // FIXME
+    {
+      struct GNUNET_JSON_Specification spec[] = {
+        GNUNET_JSON_spec_uint64 ("payment_target_uuid",
+                                 &wr.details.accepted.payment_target_uuid),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (hr->reply,
+                             spec,
+                             NULL, NULL))
+      {
+        GNUNET_break_op (0);
+        wr.hr.http_status = 0;
+        wr.hr.ec = TALER_EC_GENERIC_REPLY_MALFORMED;
+        break;
+      }
+    }
     break;
   default:
     break;
diff --git a/src/lib/exchange_api_withdraw2.c b/src/lib/exchange_api_withdraw2.c
index c8a959688..330f93d74 100644
--- a/src/lib/exchange_api_withdraw2.c
+++ b/src/lib/exchange_api_withdraw2.c
@@ -95,7 +95,7 @@ struct TALER_EXCHANGE_Withdraw2Handle
  * @param json reply from the exchange
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on errors
  */
-static int
+static enum GNUNET_GenericReturnValue
 reserve_withdraw_ok (struct TALER_EXCHANGE_Withdraw2Handle *wh,
                      const json_t *json)
 {
@@ -142,7 +142,7 @@ reserve_withdraw_ok (struct TALER_EXCHANGE_Withdraw2Handle *wh,
  * @param json reply from the exchange
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on errors
  */
-static int
+static enum GNUNET_GenericReturnValue
 reserve_withdraw_payment_required (
   struct TALER_EXCHANGE_Withdraw2Handle *wh,
   const json_t *json)
@@ -269,6 +269,28 @@ handle_reserve_withdraw_finished (void *cls,
     GNUNET_assert (NULL == wh->cb);
     TALER_EXCHANGE_withdraw2_cancel (wh);
     return;
+  case MHD_HTTP_ACCEPTED:
+    /* only validate reply is well-formed */
+    {
+      uint64_t ptu;
+      struct GNUNET_JSON_Specification spec[] = {
+        GNUNET_JSON_spec_uint64 ("payment_target_uuid",
+                                 &ptu),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (j,
+                             spec,
+                             NULL, NULL))
+      {
+        GNUNET_break_op (0);
+        hr.http_status = 0;
+        hr.ec = TALER_EC_GENERIC_REPLY_MALFORMED;
+        break;
+      }
+    }
+    break;
   case MHD_HTTP_BAD_REQUEST:
     /* This should never happen, either us or the exchange is buggy
        (or API version conflict); just pass JSON reply to the application */