Spain: RedSys Outages Bring Down Digital Payments
Ph.D. in U.S. History, Columbia University in the City of New York
Post-Doctoral Researcher in Global Correspondent Banking, 1870-2000 – Mexico and South America, University of Oxford
This post is also available in:
“🔴🔴🔴BEWARE. Bring cashMoney in physical form such as banknotes and coins. More if you leave your house. RedSys failed at 1:10 PM. ATMs, POSAbbreviation for “point of sale”. See Point-of-Sale terminal. More terminals, Bizum, and e-commerce payments are not working in most of Spain.” – @EnemigoAnonimo_.
RedSys, the Spanish paymentA transfer of funds which discharges an obligation on the part of a payer vis-à-vis a payee. More processor that operates card and ATM transactions and the mobile payments platform Bizum, experienced a massive crash in the early afternoon of November 18. The outage lasted a few hours and brought down point-of-sale (POS) terminals, ATMs, and Bizum payments, to the great dismay of customers and merchants across Spain.
- “Cards do not work, only cash payments. If you do not have any, please leave your shopping right there and leave,” a shop assistant told customers in a Madrid shop.
- “It was a little weird. I was buying a book for a friend at La Casa del Libro, and everyone in line started [complaining as the POS terminal showed] error, error, error. Someone said, ‘But this can’t be as I just paid for food.’ ‘Yes, well, it must be the card.’ And everybody wondered, ‘What’s going on?’ Nobody could pay for anything,” said Alejandro Rubio in Sevilla.
- “We had just had a vermouth, and when we were about to pay, the waiter told us that the POS terminal was not working. We realized that we didn’t have cash and couldn’t pay by mobile phone either, so she told us in good faith to come by in the afternoon or tomorrow to pay,” said Jesús Osés in Zaragoza.
- “Around 1 PM, the POS terminal showed a connection error, and contactless payments were unavailable. It only allowed to charge by inserting the card. I thought our terminal was failing,” said Lucía Rodríguez, a florist in A Coruña.
The only POS terminals and ATMs in operation were those connected to Cecabank, RedSys’s only rival, with 15% of the card processing market share. RedSys emerged in 2011 as an entity merging Servired, 4B, and EuroThe name of the European single currency adopted by the European Council at the meeting held in Madrid on 15-16 December 1995. See ECU. More 6000. More than 60 banking entities use RedSys as a payment processor with Visa, Mastercard, and American Express cards. Santander, BBVA, and CaixaBank are leading investors, each holding a 25% stake.
Internal System Failures
“Something is happening in Madrid with inoperative ATMs and POS terminals from @bancosantander, @bbva, and @CaixaForum. There might be serious problems with@Redsys_es, their common nexus. I have seen people leaving their shopping and protesting in ATMs. It’s a relief to know we are headed towards the digital euro.” – @SergioRios.
Bizum said it restarted operations by 2:42 PM after “a widespread crash in payment processing” disrupted service. At first, RedSys did not clarify whether human error, a system failure, or a cyberattack had caused the outage. Then, after regaining control over its platform, RedSys announced at 3:09 PM that “the payment service degradations of the last hour [were] exclusively linked to internal communication lines.”
RedSys Crashes Again Less than a Week After
“Both outages were punctual, fortuitous, and independent of each other. It is the first time that such an event has occurred in the more than 12 years that the company has been providing this service.” – RedSys.
Less than a week later, RedSys and Bizum crashed again on the evening of Thursday, November 23, hours before Black Friday. Unlike the prior outage, RedSys’s crash was partial and only brought down POS terminals and Bizum transfers.
- At 1:05 AM, November 24, RedSys announced, “A technical incident caused transitory instability in the payment transactions processing system.” At 10:26 AM, the company said it had “applied the vendor’s recommendations and reinforced operation and network monitoring teams.”
- At 10:02 PM, Bizum announced a “widespread payment processing incident” that brought down its platform and reestablished operations at 11:25 PM.
In a statement, RedSys said that the November 18 outage took down 2.5% of Spain’s digital payments transactions, while the November 23 incident impacted 1.5%. A source told El Economista that the outages were caused by two different bugs, the first in a Cisco protocol and the latest in a Stratus package.
Regulators Raise Questions
“We are aware that it was not a cyberattack, but rather, probably, although it is a bitIn computers, the basic unit of digital information; contraction of BInary digiT. More premature, a technological problem. [Operational] risks are genuine; they materialize.” –Pablo Hernández de Cos, governor of the Banco de España (BdE).
The Banco de España (BdE) is investigating why RedSys’s backup systems did not activate during the outages. Sources said the BdE had “requested detailed information from RedSys since the [first] incident, and it is closely monitoring Redsys’s responses. Logically, this monitoring also comprises the new incident.”
The office of Nadia Calviño, the First Vice-president of Spain and Minister of Economic Affairs and Digital Transformation, expressed concern about the outages and confirmed it is also investigating the incidents.
Digitalization may be perceived as more convenient, but it has also made the system vulnerable to cyberattacks and technical glitches. The RedSys outage highlights the need for a more resilient and inclusive payment infrastructure to withstand disruptions. Spanish authorities and payments-sector incumbents need to take steps in this direction. Preserving the public’s right to use and access cash is critical to increasing the overall resilience of the payment infrastructure.
This post is also available in: