The company I work for processes donations for non-profit clients. We recently ran through a patch of problems which caused us to lose donations due to bugs either from our system or the vendor actually charging the money.
In the past, this just meant the donor saw an error page and we hoped they would resubmit the form when things were working. My team was moved off of that project and new engineers have since been enhancing it, but I remain on our support team for payment processing.
Since I stopped actively developing the product, the company is working with TokenEx to tokenize a donor's payment information "as a layer of resiliency", as is described on our client-facing documentation. Someone recently explained to me that this means that when we have a bug or one of our vendors has a bug, we now have the ability to "replay" the transaction when we know the issue is cleared up so that our clients don't miss out on money they should have made. This doesn't sit right with me and is where my first ethical concern is:
Is it okay to replay a transaction at a later time on behalf of a donor when things go wrong the first time on the grounds that "they intended to donate that money"?
To make this feature even more sticky, I heard of an emergency switch we implemented called "success only mode" which doesn't even attempt to process the transaction. Instead it tokenizes the payment information and shows the donor a message saying "we are processing your payment". When we know things are good, we pump all of the stored tokens into our processor in hopes of having the highest possible success rate. This is my second ethical concern:
Is it okay to store a donor's payment information knowing full well that you plan on waiting to process the transaction until everything is working, to the best of your knowledge?
It is important for me to hear objective opinions on this because I'm on the support team for this app and, while it hasn't happened yet, I am worried that I will be asked to carry out one of these two processes in support of the app and I don't know if I feel comfortable doing either of them.
I believe that, as a payment processor, it is my job to attempt to process a payment at the moment that the donor intended to make the payment and, if I am unable to successful complete the transaction, neither I nor my clients are "entitled" to the funds despite the donors initial intentions.
Here's a contrived example of why I think my opinion holds up. Suppose your mother wanted to give you $20 for "being a good kid". She drives to your house and knocks on your door, but you're not home. So she goes to the market and buys some groceries with that $20.
Now imagine that you had a security camera installed and you knew she came with the intent to give you that $20. Would you go to your mother's house, knock on the door, and say "I'm here to collect that $20 you stopped by to give me earlier" and when she says, "Well, I spent it already because you weren't home" would you feel like you have the right to say "You originally intended to give that money to me so I am here to collect what is mine"? I wouldn't, and for that same reason I can't justify hiding our failures behind TokenEx and "success only mode".