Eric Kuvykin

Reviewed October 17, 2026. This practical guide replaces an earlier general overview; the original publication date and URL are retained.

When payments are embedded in business software, a checkout incident may involve the platform, gateway, processor and merchant staff. An incident responsibility matrix identifies who investigates each layer and who updates the business. It should be agreed while service works, not assembled during the first major outage.

Map symptoms to responsible teams

List common failures: an order not reaching checkout, an unknown payment result, missing funding and a refund that does not appear in the order system. Identify the first contact for each symptom and the evidence that team requires. Do not assume the software vendor controls settlement merely because its logo appears on the dashboard.

Assign a merchant incident owner

Choose one person to maintain the case references, customer impact and pending decisions. That person should know when to involve finance, customer service and security. Multiple staff opening disconnected cases can make a cross-vendor problem harder to trace, particularly when each provider sees only part of the transaction.

Set safe temporary operating rules

Agree which alternative workflows are approved and how unresolved payments will be checked before retry. Define who can authorize a configuration change. Avoid collecting payment information through an improvised channel because the normal software is unavailable. Document limitations of the temporary process and the point at which it must stop.

Close the incident across all records

Reconcile orders, payment status, refunds and deposits before declaring recovery complete. Record which vendor confirmed each result and any follow-up fix. Review whether the contract and support arrangement match the responsibilities observed during the incident. A restored web page does not by itself establish that the financial backlog is resolved.

Sources and related reading

PCI SSC merchant resources provide a security reference for vendor-related payment workflows. Ask each provider to confirm its support responsibilities in writing. Read PCI SSC merchant security resources.

Continue with Embedded Payments: Map the Support and Exit Responsibilities and Simpler Small-Business Payments: Reduce the Number of Unresolved Handoffs.

Use the AMS New Jersey merchant reading path for the regional operating checklist. Explore related analysis in Eric Kuvykin’s topic guides.