diff --git a/src/Tests/WhatsAppModelTests.cs b/src/Tests/WhatsAppModelTests.cs
index cecb6c5..e485c1c 100644
--- a/src/Tests/WhatsAppModelTests.cs
+++ b/src/Tests/WhatsAppModelTests.cs
@@ -1,4 +1,5 @@
 using System.Text.Json;
+using Moq;
 
 namespace Devlooped.WhatsApp;
 
@@ -196,16 +197,20 @@ public async Task DeserializeReaction()
     }
 
     [Fact]
-    public void SerializeAnonymous()
+    public async Task SerializeAnonymous()
     {
-        var response = Response.Create("123456789012345", "987654321098765", (client, cancellation) => Task.FromResult<string?>(null));
+        var response = Response.Create("123456789012345", "987654321098765", (client, cancellation) => Task.FromResult<string?>("asdf"));
 
         var json = JsonSerializer.Serialize(response, JsonContext.DefaultOptions);
 
         var message = JsonSerializer.Deserialize(json, JsonContext.Default.AnonymousResponse);
 
         Assert.NotNull(message);
-        Assert.Null(message.Sender);
+
+        // the value is either null due to not being deserialized, or it's a dummy function that returns null
+        // since that's the default impl. in the [JsonConstructor]
+        if (message.Sender != null)
+            Assert.Null(await message.Sender.Invoke(Mock.Of<IWhatsAppClient>(), default));
     }
 
     [Fact]
diff --git a/src/WhatsApp/AzureFunctionsWebhook.cs b/src/WhatsApp/AzureFunctionsWebhook.cs
index 8f5bd22..01bf547 100644
--- a/src/WhatsApp/AzureFunctionsWebhook.cs
+++ b/src/WhatsApp/AzureFunctionsWebhook.cs
@@ -35,7 +35,7 @@ public async Task<IActionResult> Message([HttpTrigger(AuthorizationLevel.Anonymo
         logger.LogDebug("Received WhatsApp message: {Message}.", json);
 
         // Detect encrypted flow request setup for flows endpoints
-        if (JsonSerializer.Deserialize<EncryptedFlowData>(json) is { } encrypted)
+        if (JsonSerializer.Deserialize<EncryptedFlowData>(json) is { Data.Length: > 0, IV.Length: > 0, Key.Length: > 0 } encrypted)
         {
             if (string.IsNullOrEmpty(metaOptions.Value.PrivateKey))
                 return new StatusCodeResult(421);