What happens to your marketplace if the payment provider is unavailable for two hours during peak?

What the interviewer is testing

Whether a degraded mode was designed, and whether you recognise the decision as a business one.

The default outcome

Without design: checkout fails, orders stop, revenue is zero for two hours. And if timeouts are long, the failing calls exhaust connection pools and take down unrelated functionality too.

The options, which are business decisions

Fail closed. No orders. Appropriate where the risk of unpaid fulfilment is unacceptable.

Authorise later. Accept the order, capture payment when the provider returns, and fulfil only after successful capture. Revenue is preserved; the risk is orders that later fail payment, which needs a cancellation and communication path.

Accept with risk-based limits. Accept orders below a value threshold from established customers, reject others. Bounds the exposure quantitatively, and requires the risk appetite to be agreed in advance.

Failover to a secondary provider. The strongest option and the most work — a second integration, built and periodically exercised, because a fallback that has never run does not work when needed.

The critical point: the failure is not choosing. If no decision was made, the code's default behaviour decides, and it will be "fail closed" by accident rather than by policy.

The technical requirements regardless

Short timeouts and a circuit breaker, so the provider's slowness does not exhaust pools and take down browsing and search along with checkout.

Idempotency keys on every payment operation, generated per order rather than per attempt, so the recovery — retrying the backlog when the provider returns — does not double-charge.

A durable queue of pending payment operations, so nothing is lost and the backlog drains in a controlled way rather than as a thundering herd against a recovering provider.

What a strong answer adds

The distinction between vendor risk management, which assesses whether the vendor is well run, and resilience design, which assumes the vendor fails. Most organisations do the first and skip the second, and the questionnaire does not make your system survive their outage.

And the review question worth asking of every third-party integration: what precisely happens to us at 09:00 on a Monday if they are down for six hours?

Common weak answers

A second provider proposed without addressing the degraded mode, which is cheaper and faster. Retrying until the provider returns, which does not bound the queue or protect the pools.