Isn’t there a possibility someone (or more likely some bot) visits the link before your friend does, and therefore steals the sats? I realize the timing of this is unlikely, but something to consider.