Stay tuned with CashEssentials news ! - beyond payments
By subscribing, you accept our Privacy Policy.

Spain: RedSys Outages Bring Down Digital Payments

Categories : Cash does not require a technology infrastructure, Cash is a contingency and fall-back solution, Costs of cash versus costs of electronic payment instruments
December 13, 2023
Tags : Card payments, Digital payments, Mobile Payments, outages, Spain
Outages in the RedSys platform brought down digital payments in much of Spain on November 18 and 23, raising questions about the vulnerability and resilience of the digital payments infrastructure.
Manuel A. Bautista-González

Ph.D. in U.S. History, Columbia University in the City of New York

Post-Doctoral Researcher in Global Correspondent Banking, 1870-2000 – Mexico and South America, University of Oxford

This post is also available in: Spanish

“🔴🔴🔴BEWARE. Bring cash if you leave your house. RedSys failed at 1:10 PM. ATMs, POS terminals, Bizum, and e-commerce payments are not working in most of Spain.” – @EnemigoAnonimo_.

RedSys, the Spanish payment processor that operates card and ATM transactions and the mobile payments platform Bizum, experienced a massive crash in the early afternoon of November 18. The outage lasted a few hours and brought down point-of-sale (POS) terminals, ATMs, and Bizum payments, to the great dismay of customers and merchants across Spain.

The only POS terminals and ATMs in operation were those connected to Cecabank, RedSys’s only rival, with 15% of the card processing market share. RedSys emerged in 2011 as an entity merging Servired, 4B, and Euro 6000. More than 60 banking entities use RedSys as a payment processor with Visa, Mastercard, and American Express cards. Santander, BBVA, and CaixaBank are leading investors, each holding a 25% stake.

Internal System Failures

“Something is happening in Madrid with inoperative ATMs and POS terminals from @bancosantander, @bbva, and @CaixaForum.  There might be serious problems with@Redsys_es, their common nexus. I have seen people leaving their shopping and protesting in ATMs. It’s a relief to know we are headed towards the digital euro.” – @SergioRios.

Bizum said it restarted operations by 2:42 PM after “a widespread crash in payment processing” disrupted service. At first, RedSys did not clarify whether human error, a system failure, or a cyberattack had caused the outage. Then, after regaining control over its platform, RedSys announced at 3:09 PM that “the payment service degradations of the last hour [were] exclusively linked to internal communication lines.”

RedSys Crashes Again Less than a Week After

“Both outages were punctual, fortuitous, and independent of each other. It is the first time that such an event has occurred in the more than 12 years that the company has been providing this service.” – RedSys.

Less than a week later, RedSys and Bizum crashed again on the evening of Thursday, November 23, hours before Black Friday. Unlike the prior outage, RedSys’s crash was partial and only brought down POS terminals and Bizum transfers.

In a statement, RedSys said that the November 18 outage took down 2.5% of Spain’s digital payments transactions, while the November 23 incident impacted 1.5%. A source told El Economista that the outages were caused by two different bugs, the first in a Cisco protocol and the latest in a Stratus package.

Regulators Raise Questions

“We are aware that it was not a cyberattack, but rather, probably, although it is a bit premature, a technological problem. [Operational] risks are genuine; they materialize.” –Pablo Hernández de Cos, governor of the Banco de España (BdE).

The Banco de España (BdE) is investigating why RedSys’s backup systems did not activate during the outages. Sources said the BdE had “requested detailed information from RedSys since the [first] incident, and it is closely monitoring Redsys’s responses. Logically, this monitoring also comprises the new incident.”

The office of Nadia Calviño, the First Vice-president of Spain and Minister of Economic Affairs and Digital Transformation, expressed concern about the outages and confirmed it is also investigating the incidents.

Digitalization may be perceived as more convenient, but it has also made the system vulnerable to cyberattacks and technical glitches. The RedSys outage highlights the need for a more resilient and inclusive payment infrastructure to withstand disruptions. Spanish authorities and payments-sector incumbents need to take steps in this direction. Preserving the public’s right to use and access cash is critical to increasing the overall resilience of the payment infrastructure.

This post is also available in: Spanish