Duplicate charges during a payment promotion

The first priority is to stop further harm: disable the faulty rule path, confirm that duplicate charging has ceased, and identify all affected transactions by reconciliation rather than by waiting for customer complaints. The 312 duplicate charges should be reversed promptly, with a clear customer message and a direct channel for disputed cases. I would preserve logs, deployment records, approval trails and the exact WAF rule version before any clean-up, because the incident may become a regulatory or contractual matter. I would separate three workstreams: customer remediation, technical containment, and notification assessment. The CEO's argument that no personal data was exfiltrated does not settle the notification question, because this is an availability and financial-correctness incident affecting a stored-value facility. I would ask legal and compliance to assess the licence obligations and supervisory expectations, and I would not let the funding round determine the timing. A short factual holding statement may be better than silence if customers are already posting complaints. The professional duty is to give the CEO a documented risk assessment, not to accept an instruction to stay quiet.

The immediate cause is a WAF rule that blocked legitimate callbacks, but the systemic causes are more important: no canary stage, change approval bypassed twice, and payment processing that is not idempotent. I would examine the deployment pipeline, the emergency change process, test coverage for payment callbacks, and whether the WAF rule was reviewed by someone who understood the payment flow. Corrective actions should include: mandatory canary or blue-green deployment for edge rules; automated rollback triggered by callback failure rates; idempotency keys so a retried callback cannot create a second charge; reconciliation alerts that compare authorisations, captures and settlements in near real time; and a change advisory process with real consequences for bypasses. I would also test the monitoring: 47 minutes is long for a payment system, so the detection and escalation path needs review. The fix is not merely a new WAF rule. If the pipeline still allows bypass, the same class of incident will recur.

I would separate legal obligation, customer fairness and reputational judgement. First, establish the facts: how many customers were affected, whether any account balances remain wrong, and whether the incident meets the organisation's materiality threshold or any licence notification requirement. Second, put the decision in writing, including the advice received and the reasons for the timing. Third, communicate to affected customers directly and promptly, because they need to know about duplicate charges even if no data was lost. A public statement may not be required in every case, but a deliberate decision to delay until after a funding round is not a legitimate reason. If the CEO instructs me to suppress information that customers or a regulator are entitled to receive, I would escalate to the board or compliance function and document my objection. The professional assessment is likely to reward judgement that protects customers and the integrity of the incident process, not loyalty to the fundraising timetable.