A user suggested using a transaction hash as a way to track user deposits (especially for ECR20 tokens):
The major issue arises when you start accepting erc-20 tokens as payment, in that case when you wish to transfer tokens from each user's address to your main account, each user account must have ethers (to pay for transaction fee), but users have only transferred tokens. This is the thing you should be worried about. One possible way is you ask users for tokens as well as few ethers (for transaction fee).
The other possible solution could be having a pool of fixed addresses and providing users with repeated addresses. In that case, you have to either ask the user for transaction hash or account from which they are willing to pay to identify user's payment.
What I don't understand is this: Isn't the transaction hash publicly visible on the blockchain? If so, how can this be used as proof the the person who has the hash is the true sender of the payment if anyone can look up the recent transaction hashes to a specific address? And if it is not publicly visible how would I use the transaction hash as proof that this person sent the payment he is claiming to have sent if I myself cannot verify it?
