Find the failure point
Check terminal power, local internet, mobile data, POS software, acquiring/payment-provider status and bank access separately. Record the outage start time.
BUSINESS PLAYBOOK 07 // PAYMENTS DOWN
PAYMENTS ARE DOWN.
KEEP RECORDS CLEAN.
Separate payment failure from the sale or service itself. Use only authorised fallback methods, preserve an accurate transaction trail and prevent duplicate charging when systems return.
ACTION ORDER // REDUCE CONFUSION
CONTROL THE FIRST HOUR.
Use the documented minimum operation rather than improvising under pressure. Record decisions, ownership and the next review point as the incident develops.
Move to an authorised fallback
Use only methods your business has approved in advance: provider-supported offline mode, alternate terminal/connection, invoice, bank transfer or another suitable route.
Reconcile before normalising
Maintain a clear sales/job log, tell customers what is and is not available, then reconcile delayed or offline transactions before full service resumes.
DECISION POINTS // WRITE THEM DOWN
DON'T WAIT FOR THE CRISIS.
Pre-agreed thresholds reduce hesitation and stop a degraded situation from drifting without ownership.
SCOPEIs the problem local, provider-wide or banking-related?
A second terminal on the same failed provider may not add resilience; identify the actual dependency.
OFFLINE MODEDoes the provider support it and what are the limits?
Test the official feature in advance and understand approval, value and connectivity constraints.
ALTERNATIVEWhat can the business legitimately accept instead?
Define approved alternatives, who may authorise deferred payment, and how customers are informed.
RECORDSHow will you prevent lost or duplicate transactions?
Use a non-sensitive transaction/job log with unique references and reconcile it when systems return.
RECOVERYWho checks the books before clearing the incident?
Confirm settlements, refunds, duplicates and outstanding invoices before declaring payment operations normal.
PAYMENT DATA // HARD RULE
Do not create an improvised paper-card system during an outage. Use only payment-provider-supported offline or alternate methods. Do not retain card verification values after authorisation, and avoid collecting card details through insecure notes, email or messaging.
OFFICIAL ROUTES
CHECK THE SOURCE.
Use current provider, regulator and official guidance during a real incident. GPN is the planning layer, not the authority controlling the incident.
PAYMENT SECURITYPCI SSC // SAFE PAYMENTSIndustry security guidance for small merchants; avoid unnecessary storage of card data and protect payment information.PAYMENT SECURITYPCI SSC // CARD VERIFICATION DATAPCI DSS prohibits storing card verification values after authorisation, even if encrypted.REGULATED FIRMSFCA // OPERATIONAL RESILIENCEOperational-resilience expectations for firms in scope; useful context for impact tolerances, mapping, testing and communications.