# Card Webhook Storm Runbook

Owner: Cards operations
Severity: SEV1 if authorizations, holds, clearing or reversals may be duplicated or delayed.

## Triggers

- `BankingCardWebhookStorm`
- issuer duplicate delivery notices
- webhook signature or idempotency error spikes
- authorization hold backlog

## First 15 Minutes

1. Confirm whether the storm is duplicate replay, issuer backlog flush or malicious traffic.
2. Verify webhook signature, idempotency keys and event ordering behavior.
3. Rate limit or isolate webhook ingress only if issuer retry behavior is understood.
4. Page card issuer support with trace IDs, event IDs and sample timestamps.

## Diagnosis

- Check cards panel, API webhook route, ledger holds and card authorization status transitions.
- Identify duplicated event IDs and out-of-order events.
- Verify no PAN/CVV appears in logs or stored raw payloads.

## Recovery

- Let idempotent duplicates drain when safe.
- Reprocess failed events in original order.
- Expire or reverse stale holds through approved workflow.
- Run ledger hold/clearing/reversal checks before closing.

## Communications

- Customer support receives card-specific impact and expected resolution time.
- Notify issuer/acquirer according to contract when availability or authorization outcomes are affected.