Practical QA Series · Volume One

The Checkout & Payment QA Playbook

The edge cases that cost real money.

A customer says they paid. Your dashboard says they did. The gateway has no charge. Which one is lying?

18defects you can arm, one at a time
18checks that gate a release
96more behind them
45minutes to run the gate
Every defect is verified. All 18 were confirmed by running them — each one fires when armed and passes when disarmed. That check is the expensive part, and it is the part a generated case list does not have.

Who this is for

Anyone shipping a checkout — e-commerce, SaaS billing, marketplace, or a local payment rail like bKash or Nagad.

What it covers

Declines

Not an error — a normal outcome that needs designed behaviour. Cart preservation, stock release, and what the customer is actually told.

3D Secure & SCA

Challenge, completion, and the abandonment case that leaves an authorised-but-uncaptured charge behind.

Duplicates & races

Double-click, refresh, back button, network drop. The defect a real customer finds by accident on a slow connection.

Webhooks

Replay, ordering, signature verification. An unsigned webhook that marks an order paid is free goods.

Refunds, tax & rounding

Partial refunds ignoring discounts, tax computed before the discount, per-line versus per-order rounding.

Reconciliation

Cart, order, charge, ledger. Four records that must agree — and the variance that appears when they do not.

What you get

The practice sandbox

A working application with 18 deliberate defects, each switchable on and off individually. Run a case, watch it fail, disarm the defect, run it again.

That second run is the point. Most testers have seen software fail. Very few have deliberately observed what a genuine pass looks like for a specific control — which is why juniors report defects that are not there.

Python, no installation beyond the interpreter.

The playbook — 52 pages

The reasoning behind the cases. Why this domain fails differently, which checks matter most, how to report a finding so it gets fixed rather than filed, and the sign-off that turns a test run into a deliverable.

The case bank — 114 cases

A filterable spreadsheet with preconditions, steps, expected result and severity for every case. Plus a bug report template, a client sign-off sheet, and:

  • Test card reference
  • Decline message map

The free smoke test

The eighteen checks worth running before every release. Included in the kit, and free to anyone — take it without buying.

Three cases from the bank

In full, so you can judge the rest. These are the kind that come from handling the incident rather than reading the documentation.

An abandoned 3D Secure challenge leaves a live authorisation

The customer opens the bank's page and closes the tab. No order exists, but the hold on their card does. They see money gone and no purchase, and they call support angry.

Nobody writes this case from a feature list. It comes from having handled the support ticket.

The server accepts the price the browser sent

Intercept the checkout request, change the amount, submit. If it goes through, every product in that store is free to anyone who can open developer tools.

Sixty seconds to test. It has ended businesses.

Tax is calculated before the discount

Arithmetically self-consistent, correctly formatted, and wrong on every invoice by a fixed amount that scales with every customer you add.

The invoice looks right, which is why it survives review.

Get the Checkout & Payment kit

One download. The playbook, the case bank as a spreadsheet, and the practice sandbox. No subscription, no account.

Buy — $49International · card, PayPal কিনুন — ৳2,900Bangladesh · bKash, Nagad, card
Paying from Bangladesh? Use the second button — it accepts local methods at local pricing. International orders are handled by Lemon Squeezy, who act as merchant of record and take care of your local tax.

Try it before you decide

The live demo runs five of the checks against a simulated system, in your browser. Nothing to install and nothing to sign up for. Watch a defect fire, then switch it off and watch the same check pass.

Open the payment demo

Mohammad Ashik Elahi · ashik.elahi.cse@gmail.com · All four volumes