Xendit, Paysafe and Visa outages
Payment disruptions across November 1–2, 2026, affected merchants using Xendit, Paysafe and Worldpay, with problems ranging from failed QR transactions to interrupted merchant notifications and Visa-network authorization failures. In the Philippines, Xendit warned that customers could have been debited even when payments appeared incomplete. Paysafe restored its PagoEfectivo services after a prolonged incident requiring API credential replacements, only to report further disruptions on consecutive days. Worldpay separately identified a Visa-network problem that lasted into November 2 before its third-party provider restored service.
Xendit QRPh outage creates duplicate-payment risk
Xendit reported a major disruption affecting QRPh payments in the Philippines on November 1, leaving merchants unable to confirm completed transactions and eventually preventing the creation of new payment QR codes.
The incident initially involved delayed payment-completion notifications. At 11:08 a.m. Philippine time, Xendit escalated the disruption to a major outage after confirming that QRPh payments were failing to complete.
Merchants could still generate QR codes during the initial phase, but customers attempting to pay against them were unable to complete transactions normally. An update issued at 12:17 p.m. Philippine time established that QR-code creation itself was also failing.
The problem was no longer limited to confirming existing payments. New QR transactions were failing before customers could even reach the payment stage.
Xendit instructed merchants to temporarily disable QRPh at checkout and direct customers toward alternative payment methods. It also issued a more specific warning concerning customers who reported being debited despite their payments remaining unconfirmed.
Merchants were told to check transaction records through the Xendit Dashboard or API before requesting another payment. One customer could have money deducted, an order still showing unpaid, and a merchant trying to collect again. That was the awkward part of the disruption.
The warning identifies a potential duplicate-charge scenario, although Xendit has not disclosed evidence that duplicate debits actually occurred or provided a count of affected transactions.
Transactions initiated during the incident required subsequent reconciliation. The seperation between payment execution and confirmation left merchants dependent on transaction-status checks rather than immediate checkout responses.
Xendit marked the incident resolved at 4:50 p.m. Western Indonesian Time on November 1, equivalent to 5:50 p.m. in the Philippines. That placed the restoration approximately six hours and 42 minutes after the reported 11:08 a.m. Philippine start time.
The disruption followed earlier Xendit payment and payout failures across three Asian markets on October 28–29. Those incidents included delayed Philippine QRPh notifications, with some payment-completion callbacks taking more than an hour to reach merchants.
QRPh is the Philippines’ national interoperable QR-payment standard. The Bangko Sentral ng Pilipinas’ QRPh implementation memorandum requires participating payment service providers to use the national standard and provide appropriate training to merchants accepting QR payments.
Xendit has not published the number or value of transactions requiring reconciliation following the November 1 incident. Its official notice also does not establish whether any transactions that appeared unsuccessful ultimately resulted in duplicate collections.
Paysafe restores PagoEfectivo after credential deactivation
Paysafe formally declared its PagoEfectivo services restored on November 1 at 10:31 UTC, following an incident that began on October 29 and required cybersecurity remediation and permanent deactivation of certain merchant API credentials.
The original disruption started at 21:01 UTC on October 29, affecting a broad set of PagoEfectivo functions, including CIP Generation, merchant notifications, QR payments, wallet services and connections involving several Peruvian banking and payment partners.
On October 31, Paysafe disclosed that its technical teams, supported by external cybersecurity specialists, had completed a detailed review of the affected environment, remediated an identified issue and strengthened logging and monitoring capabilities.
It also confirmed that some existing API credentials had been permanently disabled as a protective measure. Those credentials could no longer process transactions, requiring affected merchants to arrange replacements through nominated technical contacts.
Services were back, but merchants with deactivated credentials still had another job to do before reconnecting. A platform-wide restoration notice, in this case, did not mean every merchant integration had returned to its previous state.
The restoration announcement directed merchants who had not completed the process to contact Paysafe and identify the appropriate technical representative for secure credential replacement.
The incident had previously left multiple PagoEfectivo components unavailable for an extended period. Earlier coverage of the prolonged PagoEfectivo outage documented the suspension of services while Paysafe worked through technical remediation and recovery checks.
The cybersecurity measures introduce an additonal operational issue for affected merchants: service availability depends partly on whether their own integrations have been updated to use valid replacement credentials.
Paysafe has not disclosed the number of merchants required to rotate credentials, how many had completed the process by November 2 or the financial value of transactions interrupted during the recovery.
Its public statements identify an incident affecting some systems and subsequent protective measures. They do not establish that customer funds were stolen, nor do they provide sufficient technical details to classify the incident as a confirmed external cyberattack.
PagoEfectivo suffers two more merchant-notification failures
Paysafe’s November 1 restoration announcement was followed by two additional PagoEfectivo merchant-notification disruptions, raising a narrower question about the stability of the service after recovery.
The first new incident, reference INC0328115, began at 16:25 UTC on November 1, less than six hours after Paysafe formally closed the earlier incident.
Paysafe initially reported that it was investigating a potential service issue. At 17:52 UTC, it announced that a solution had been implemented and that activity on the affected component was being monitored.
Further improvements were implemented during the evening, with the company reporting at 21:08 UTC that the fix had been successfully deployed. The incident was formally resolved at 22:47 UTC, approximately six hours and 22 minutes after its initial report.
Then came November 2. At 14:53 UTC, Paysafe opened another incident, reference INC0328223, again affecting PagoEfectivo’s Merchant Notification component.
A solution was implemented by 15:57 UTC, and the company declared the incident resolved at 17:21 UTC. The second disruption lasted approximately two hours and 28 minutes.
Both incidents therefore affected the same merchant-notification function, although Paysafe has not established whether they shared a technical cause.
Merchant notifications are used to communicate transaction-status updates to integrated businesses. Failures in this component can leave payment records awaiting confirmation even when other parts of a payment platform remain operational, depending on the precise nature of the interruption.
The public incident reports do not establish how many notifications failed, whether confirmed payments were delayed or whether merchants experienced settlement discrepancies. They also do not connect either disruption to the previous API credential deactivation.
For NYSE-listed Paysafe, the documented sequence provides a specific operational concern rather than a quantified financial loss: an extended PagoEfectivo recovery was followed by two further interruptions affecting the same merchant-facing function within roughly 24 hours.
Worldpay flags Visa authorization failures overnight
Worldpay reported a separate payment-network disruption that began late on November 1 and continued into November 2, potentially affecting transaction authorization through Visa.
At 21:38 UTC on November 1, Worldpay opened incident INC0713314, identifying a technical issue involving the Visa network that could be causing transaction authorization failures.
The incident was classified under Authorization & Payments, with Worldpay’s technical teams monitoring developments while awaiting updates from the third party.
At 00:53 UTC on November 2, Worldpay confirmed that the third party had resolved its internal issue and restored service. The incident remained publicly acknowledged for approximately three hours and 15 minutes.
Worldpay reported that its own systems had remained operational throughout the disruption.
The processor was functioning, then, but some authorizations potentially were not. Worldpay’s statement located the reported problem outside its systems, without identifying the precise Visa infrastructure involved.
That differs from Worldpay’s earlier payment-processing disruption on October 29–30, when an internal database problem following scheduled maintenance affected card payouts, refunds and order-management functions.
The November 1–2 incident involved a reported third-party card-network issue rather than a disclosed failure in Worldpay’s own processing infrastructure.
Worldpay has not disclosed the countries, merchant categories or acquiring relationships affected by the Visa authorization problem. The company also provided no transaction-failure totals, financial-loss estimates or information about whether individual merchants used alternative processing arrangements.
Its statement should not be interpreted as confirmation of a global Visa outage. The available record establishes that Worldpay observed potential authorization failures associated with a Visa-network issue and subsequently received confirmation that the third party had resolved its internal problem.
Across the three payment providers, the November 1–2 incidents ended with official restoration notices, but their remaning operational questions differ. Xendit’s merchants were instructed to reconcile transactions potentially debited without confirmation. Paysafe’s affected merchants needed replacement API credentials, even as merchant-notification disruptions returned. Worldpay reported restored authorization processing without disclosing the scale of unsuccessful transactions.
No provider has published sufficient transaction-level evidence to quantify customer losses or merchant financial exposure from these particular incidents. For payment-dependent businesses, the unresolved figures are the number of Xendit transactions requiring reconciliation, Paysafe integrations still awaiting credential replacement, and Visa authorizations that failed during Worldpay’s reported incident.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574