HSBC Communication Failure

[JISE]

I wanted to let everyone know about a conversation between us and HSBC about a reproducible problem we (and maybe others on another thread) have been experiencing.

Can any of you from Actinic confirm this situation. And possibly when a solution will be found?

Email to HSBC:

We are using HSBC Secure ePayments on our site www.canalcargo.co.uk. We
have used Actinic Catalog to produce the site and provide the integration
with your payment system.

We have found that a number of customers are getting a Communication
Failure but have been successful in creating an order and making a payment through your system. They then re-order (sometimes reproducing the problem) and we are left with two or more orders in our system.

We have been able to reproduce a Communication Failure issue which has
also created an order. This situation occurs when the Customer has
completed filling in the details on your ePayments system and has reached
the receipt page. At this point they check that everything is okay and
print the receipt. Whilst they are doing this, their dial-up connection is
dropped. This will often be because they are using a short e.g. 1min
inactivity timeout. When the Customer clicks to continue (at which point
they would normally be redirected back to our site) their browser does not
prompt to reconnect as would be expected but they are given a
Communication Failure message.

This problem causes us to have to check with clients on their actual
requirements. In one case we found that the Customer had in the end used
another site to make the order and we lost the sale.

I would be grateful to hear what is being done to address this issue.

James Scott-Evans
Canal Cargo


HSBC Reply:

James,

I am sorry it has taken some time to get back to you regarding these
issues.

We have been working closely with Actinic and have found that it is an
issue with Actinic's servers. They have been making some changes which
have affected the service.

They are aware of the problem that is occuring and working towards a
resolution.

Regards,

Secure ePayments

[cbarling]

I can confirm that this is being looked at urgently.

Chris
Actinic

[JoshSpeed]

HSBC Problems

We have been working with HSBC and fixed some problems. I am not sure that what we have done has solved this problem.
I suspect it has not, but it is worth checking.

Are you still able to reproduce it now?


If you can reproduce it, tell us the steps in detail so we can try to reproduce it in our environment. Once we can reproduce the problem, we will nail it.

Thanks
Josh Speed
Actinc

[JoshSpeed]

I have reproduced the problem here at Actinic.

It looks like the problem is to do with security.

If you disconnect your browser on any page on the HSBC site you get the communication failure problem.

I tried it on the HSBC welcome page, then pressed continue and I got the problem. (Actinic is not involved on those two page so I think this is probably something that HSBC will need to sort out)

I'll have a talk with HSBC when their support team come back on line on Monday morning to see if this can be resolved and post the conclusion of that call here.

Josh Speed
Actinic Development

[JoshSpeed]

I have talked to HSBC and they have told me that there are some known problems with the general HSBC service in this area and they are looking into it. (it is not specific to Actinic)

The problems are mainly around customers who take a long time to enter their details.

So It looks like customers whose broswer remains connected to the internet may experience the communication problem (particulalry if they take a lot of time to enter their details)

For customers who physically disconnect from the internet during the secure connection, the communication failure may be a feature of the security.

For more details on these problems, I think it is best for you to talk to HSBC directly.


We have been working on another problem at Actinic that was reported by HSBC. That has now been fixed. The problem we fixed did not relate to the commmunication error described above.


Regards
Josh Speed
Actinic Developent

[JISE]

Could you tell me what the problem was that you fixed?

I'm also confused as to how they (HSBC) can post back the payment confirmation, but then show the user "Communication Failure"?

[cdicken]

Josh is away at the moment. I've been trying to get my head around the issues in order to give you a response - but it is all fantasitcally complicated.

I'll leave a message with Josh to post here on his return.

[JISE]

A correction is needed from me.
Actinic shows orders as pending payment not as confirmed (Pre-Authorised).

I wonder whether you can confirm how WorldPay or other PSPs would handle the dial-up being dropped at a similar stage and whether the auto dial function would kick in.

[JoshSpeed]

Having talked to HSBC, they confirmed my understanding of what is going on here. HSBC have a high level of security built into their solution, with several different methods of security being employed to protect the card user from fraud.

One of these measures is the use of a secure connection. So when you intiate the transaction onto the HSBC site, a secure connection is made between your browser and their server.

If the connectivity is dropped between your browser and the server (eg because the internet connection is dropped), the security software detects this as it could be an attempt to hack into the transaction. The secure connection is severed. When you reconnect to the internet and attempt to move forward to the next page, the HSBC systems recognises that there has been a "security breach" and you get " the communication failure message.

From HSBC'c perspective they feel this is a realistic security precaution and I tend to agree with them (but I am not a security expert, so if there any security experts out there who would like to comment please feel free).

I cant comment on Paypal etc as I have not discussed their security measures with them in detail so I could not comment as definitively as I have about HSBC. Sorry.


I appreciate this is annoying, and this is not solving your problem. I hope at least you now understand the background to the problem for HSBC.

Regards
Josh

Actinic Development

[JoshSpeed]

In reply to your comment about what did we fix:

Once you enter you credit card details and confirm payment, HSBC calls the merchant server to say that payment has been made. It then waits for a reply from the merchant server.

Our reply to HSBC had a bug in it. We returned data, but we had formatted the header wrong, which raises an error in the server logs.

Initially we thought this was creating a significant problem, but once we found out what was happening, it proved to be a minor issue. We dont believe this should have had any significant effect on the process from the merchant's or shopper's perspective (If it worked once, then it should work all the time). The only problem was that it made error tracking difficult as the logs were full of errors.

Originally we believed that this error was causing 75% of transactions to fail so we did the fix in a hurry. This led to a mistake being made during release. A bug was introduced causing the flag for pre authorise/authorise to be switched. We fixed this bug on the same day as it was introduced.

I hope this answers your question.


Regards
Josh Speed
Actinic Development

[JISE]

Thanks Josh for looking at this for me.
Thanks also for going into the detail, I'm not sure HSBC have got it right, but anyway decision made...

I think I will need to put some info/warning on the page shown as the user is transferred over to HSBC.

So I need to edit the Act_OCCHSBCTemplate.html file, but I think it would be useful to remove the onLoad function and make the user click Next. This function isn't on the above template, where do I go to remove it?

[cdicken]

remove the onLoad function

The culprit is NETQUOTEVAR:ONLOAD in <body> tag of the overall layout template (normally Act_Primary.html).

Remove this variable and then save the template as Act_CheckoutPrimary.html (or something). You can then use this template JUST for the checkout phase by specifying it in 'Design | Options | Layouts'.