Is this a suitable usage of lock in ASP.NET MVC

Question

I have an ASP.NET MVC project that takes payments via SagePay (Using Jeremy Skinnners SagePayMVC solution). The solutions also using Entity Framework with the UnitOfWork pattern.

When a SagePay payment has completed SagePay calls back on a notification URL. This is an action on my SagePay controller which looks something like so:

[HttpPost]
public virtual ActionResult Notify(SagePayResponse response)
{
        using (UnitOfWork unitOfWork = new UnitOfWork())
        {
            if (ResponseLegit(response,unitOfWork))
            {
                SavePaymentToDatabase(response,unitOfWork);      
            }
            unitOfWork.SaveChanges();
        }
}

On the whole this seemed to work - but every now and then we'd end up with multiple payments in the database. It seemed that if the server was particularly busy it could take slightly too long to respond and so SagePay would send out a second notification (or sometimes even several).

So my first attempt to prevent this happening was to add a check to see if a payment already existed that matched the transaction number for the payment.

    Order order =GetRelatedOrderFromSagePayResponse(unitOfWork,response);
    bool paymentAlreadyExists = PaymentExistsForOrder(order, response);
    if (!paymentAlreadyExists)
    {    
       SavePaymentToDatabase(response,unitOfWork);    
    }

However that didn't work. Multiple payments continue to show up now and then.

So what I think is happening is that the server is busy on some other unknown task, the notifications from SagePay start queuing up, IIS then catches up and hands a thread to each of the requests - such that they are handled in parallel. As such the check is negated as entity framework has populated the objects from the database at the same time and there's no payments at the time it checks them.

So I'm thinking a solution would be to use the Lock method as in this question here: how to lock an asp.net mvc action?

   private static object NotifyLock= new object();

   [HttpPost]
    public virtual ActionResult Notify(SagePayResponse response)
    {
          lock (NotifyLock)
          {
            using (UnitOfWork unitOfWork = new UnitOfWork())
            {
                if (ResponseLegit(response,unitOfWork))
                {
                    Order order=GetRelatedOrderFromSagePayResponse(unitOfWork,response);
                    bool paymentAlreadyExists = PaymentExistsForOrder(order, response);
                    if (!paymentAlreadyExists)
                    {    
                         SavePaymentToDatabase(response,unitOfWork);    
                    }
                }
                unitOfWork.SaveChanges();
            }
         }
    }

Is this a legitimate usage of Lock and will it stop multiple notifications entering the Notify action at the same time, and thus allow my multiple payments check to work?