Shoppers across Australia were scrambling for a way to pay for groceries, clothes, and petrol on Saturday after a “scheduled system update” caused a 90-minute outage of Mastercard payment services that affected card, smart watch, cash withdrawal, and other transactions.
Banks including the Commonwealth Bank, Macquarie Bank, NAB, and ANZ all reported issues with purchases using Mastercard credit cards, which account for over a third of all credit cards issued worldwide.
The outage – which also extended to digital payments made with services like Apple Watch and PayPal, which are back-ended by conventional credit cards – caused transactions to be declined from 2:25pm AEST to around 4pm on 15 August.
Mastercard attributed the outage to “a scheduled system update,” and told Information Age the update “caused Mastercard transactions to be declined for a period of time on Saturday”.
The company said “the situation was resolved in short order” and all systems were now “working as normal.”
Service availability tracking site Downdetector saw a surge in reports of problems with Mastercard, with 1,700 reports as of 3pm Saturday and anecdotal reports of problems in Singapore, Europe, and elsewhere confirming that the problem was a global issue.
Shoppers took to social media to complain, with reports of shopping trolleys left abandoned and customers resorting to paying with cash for essential products during the outage.
Australians made 939.6 million in-person credit card purchases and 365.9 million online card purchases in June – around 44 million purchases per day – suggesting that several million transactions were likely interrupted during the Mastercard outage.
Exposing soft spots in payment resilience
While Mastercard has not elaborated on the nature of the system update, the timing of the outage – which occurred in the early hours of Saturday morning, US time – is consistent with technology support teams’ practice of scheduling updates for relatively quiet times to minimise disruption.
Managing updates is a challenge for every business, but critical infrastructure operators face public fallout – as when an Optus software update caused a major outage, a CrowdStrike update failure caused global disruption, and Telstra’s recent outage stemmed from a software versioning oversight.
Years of payment system overhauls have ramped up reliance on fully digital systems that carry millions of transactions per day, with the Mastercard outage coming just days after payments industry overseer AusPayNet released its first investigation into payment system resilience.
Noting growing regulatory expectations and calling payments systems “a critical national service,” the report notes that “the speed, visibility and immediacy of modern payments mean that any disruption to them is experienced immediately by households, businesses and the government.”
Banks told customers experiencing issues during the Mastercard outage to pay with a savings account on EFTPOS, or with cash. Image: Mastercard / Supplied
Operators of payment systems are increasingly being expected to prepare for “severe but plausible disruptions” and to strengthen the resilience of increasingly complex payment networks that now span a global network of business partners, critical service providers, and more.
“Modern payments rely on complex, tightly integrated technology environments,” the report says, noting that “failures in software, infrastructure, or change processes can scale rapidly” and that even short disruptions can cause “a direct and immediate impact on trust.”
“The key risk is not only that technology can fail, but that failures can propagate quickly when shared platforms are embedded across multiple sectors,” it found.
“… Collectively, these developments are reshaping how payments resilience is understood and assessed.
“… It is an immediate and ongoing necessity.”
Left with few alternatives
Although it was limited to one credit card provider’s systems and did not bring down an entire payment network, Saturday’s Mastercard outage is a reminder of the ongoing vulnerability of digital systems that have come to dominate payments in Australia – even as alternatives are phased out.
Use of cash was already plummeting before the COVID-19 pandemic accelerated the push to contactless payments, with many retailers subsequently going cashless in a push to avoid the manual handling and security risks that come with accepting physical currency.
The change happened so quickly – with just 5 per cent of Australians now using cash on a regular basis – that the federal government last year intervened to force retailers of “essential items” to continue accepting cash, with the mandate taking effect at the beginning of this year.
During the Mastercard incident, banks advised customers to manually insert their cards to pay directly from a linked savings accounts, or to get cash from ATMs, which remained available throughout the outage in a vote of confidence for cash as a fallback method.
Adding additional complexity is the government’s ongoing Cheques Transition Plan, which by 2030 will wind down printed cheques that for decades served as a backup payment method when cash was unavailable.
Even as consumers lose access to backup methods, rapidly evolving payments infrastructure is adding new complexity – with Mastercard, for one, normalising cryptocurrency and launching an AI agent system to complete payments autonomously.
It’s all part of a “fascinating” time in payments in which – as Reserve Bank assistant governor Brad Jones told a recent industry conference – “there are big structural forces reshaping the operating environment” with change that “is amplifying both risks and opportunities.”
