Authorize.Net

Authorize.Net Hosted Payment Form Outages Lessons from August 2026 CAPTCHA Failures

E-commerce 4 Internet Marketers Editorial

Frustrated merchant facing a CAPTCHA on a hosted payment form while a phone shows a payment-processing incident banner
Illustration of a merchant stuck on checkout CAPTCHA during a payment-form incident.

By E-commerce 4 Internet Marketers Editorial

Analysis. This article separates documented Authorize.net status-page facts about Hosted Payment Form CAPTCHA disruption INC26757168 from editorial interpretation for website owners and developers who sell regulated or high-risk products and rely on hosted checkout. Facts below are attributed to Authorize.net's public status page (including Statuspage incident records mirrored at status.authorize.net), Accept Hosted developer documentation, and Authorize.net Support Center articles on Hosted Payment Form Security Code (CAPTCHA) settings. The public Post Incident Report link requires Support Center login and is not quoted here. This is not legal, PCI, or underwriting advice.

Facts. What INC26757168 reported

Authorize.net published a major-impact incident titled "API Connection/Endpoint Service Disruption" on its status page (Statuspage shortlink stspg.io/ggrpf0t7cg61), tagged to the Accept Suite component, under Incident #: INC26757168.

The investigating update (posted 14 August 2026, 20:42 UTC) stated that Authorize.net was aware of an issue affecting the Hosted Payment Form service, that merchants may experience issues completing payments through hosted payment forms due to a CAPTCHA issue, and listed Reported Start Time as 13 August 2026.

The resolved update (posted 15 August 2026, 04:37 UTC) stated that the Hosted Payment Form Service issue had been fully resolved, that Authorize.net was conducting an internal review to mitigate future occurrences, and listed Reported Start Time as 12 August 2026, 3:00 PM GMT and Reported End Time as 15 August 2026, 3:15 AM GMT. Impact wording in that update said customers were again able to use the Hosted Payment Form Service as normal.

A companion sandbox incident under the same Incident #: INC26757168 (Statuspage shortlink stspg.io/4781zsrcfsr1) stated that merchants may experience issues completing payments through Sandbox hosted payment forms due to a CAPTCHA issue. Its resolved update listed Reported Start Time as 12 August 2026, 3:00 PM GMT and Reported End Time as 15 August 2026, 6:45 AM GMT.

A later postmortem update on the production incident (17 August 2026) stated that clients and merchants can access a Post Incident Report with Support Center login credentials. This article does not invent root-cause detail beyond the CAPTCHA impact language Authorize.net published on the public status page.

Facts. Related August 2026 incidents (do not conflate)

Authorize.net's status history for the same period includes other disruptions that are not the Hosted Payment Form CAPTCHA event. Simple Checkout Processing Service Disruption INC26672537 listed Reported Start Time 03 August 2026, 21:14 GMT, with a 20 August 2026 monitoring update saying the issue had been mitigated and listing Reported End Time 20 August 2026, 19:00 GMT. A separate NAB EPX Processing Service Disruption on 13 August 2026 and a later Server Integration Method (SIM) Relay Response issue are distinct incidents. Merchants diagnosing checkout failures in mid-August needed to match symptoms (hosted-form CAPTCHA completion versus Simple Checkout versus processor-specific declines) to the correct incident record.

Facts. How CAPTCHA appears on Authorize.net hosted checkout

Authorize.net's Accept Hosted documentation describes Accept Hosted as a mobile-optimized payment form hosted by Authorize.net that supports redirect or embed while targeting SAQ-A level PCI compliance. Form behavior is controlled through `getHostedPaymentPageRequest` settings. The documented `hostedPaymentSecurityOptions` parameter uses a JSON value such as `{"captcha": false}` to enable or disable CAPTCHA on the Accept Hosted form, and the docs state that the field defaults to `false`.

For Server Integration Method (SIM) Hosted Payment Form settings, Authorize.net Support Center article KA-09169 (New Experience 2.0) documents a Payment Form Security Code (Captcha) control. Merchants can check or uncheck "Require the Security Code feature on the Payment Form" under Payment Form, Form Fields. The same article states that when using Simple Checkout, customers must always verify a Security Code, even if the code is hidden on the payment form. Classic Experience steps are documented in KA-04455.

Authorize.net's common error codes article states that Error 312 (Invalid Security Code) and Error 313 (customer requested a new Security Code) relate to the Hosted Payment Form Security Code/CAPTCHA used by SIM and Simple Checkout, and that Simple Checkout still requires verification even when the payment-form Security Code option is disabled. KA-09169 also notes that AIM, SIM, and DPM are obsolete and being phased out in favor of modern connection methods.

Authorize.net planned-maintenance documentation (support article 000003207) lists the hosted payment form, Simple Checkout, and CAPTCHA verification among services that can be intermittently unavailable during planned system maintenance windows. That article describes scheduled maintenance behavior. It is not a substitute for the August CAPTCHA incident narrative above.

Facts. Status monitoring surfaces Authorize.net publishes

Authorize.net's status page states that it provides real-time updates on service availability and operational status, and that merchants can subscribe to alerts via email or SMS through Manage My Subscription.

Component groups include Accept Suite, API Connection/Endpoints (including Server Integration Method), Payment Services (including Simple Checkout), Payment Gateway Processing, and related portal and settlement surfaces. Incident records publish Investigating, Monitoring, Resolved, and Postmortem-style updates with Reported Start Time, Reported End Time, Impact, and Incident # fields when Authorize.net includes them.

Interpretation. Why hosted-form CAPTCHA outages hit high-risk checkouts hard

The following points are editorial interpretation grounded in the documented behaviors above, not additional Authorize.net claims.

Hosted payment forms shrink PCI scope by keeping card data on Authorize.net pages. Interpretation. That same design concentrates a checkout dependency on Authorize.net-hosted assets, including CAPTCHA or Security Code verification when enabled or when Simple Checkout forces it. A CAPTCHA-path failure does not need a full gateway processing outage to stop revenue. INC26757168's published impact language was about completing payments through hosted payment forms due to a CAPTCHA issue, while gateway processing components can remain separately labeled on the status page.

High-risk and regulated sellers (CBD, supplements, telehealth, nicotine, tactical, and similar catalogs) often already operate with thinner processor tolerance for abandoned checkouts, delayed fulfillment, and customer-service spikes. Interpretation. Multi-hour hosted-form blocks create chargeback and support risk even when the eventual capture path is healthy, because buyers retry cards, open duplicate carts, or abandon after Security Code failures that look like buyer error rather than a provider incident.

Accept Hosted's documented default of `captcha: false` and SIM's optional Security Code checkbox mean not every hosted integration was equally exposed. Interpretation. Merchants who still require Security Code for bot defense, or who use Simple Checkout where CAPTCHA remains mandatory per Authorize.net docs, carry a different failure mode than Accept Hosted carts that leave CAPTCHA off. Failover design should map which checkout path each storefront actually uses, not assume "Authorize.net" is one binary.

Interpretation. Failover and monitoring design that fits the August pattern

Interpretation. Treat status.authorize.net subscription as a first-class ops control, not a bookmark. Email or SMS alerts on Accept Suite, hosted payment form, Simple Checkout, and API Connection/Endpoint components shorten the gap between buyer complaints and a confirmed INC number. Pair that with synthetic checkout probes that attempt a sandbox or low-value production path through the same integration the storefront uses (Accept Hosted token flow versus SIM versus Simple Checkout).

Interpretation. Document a failover ladder before the next CAPTCHA-class incident. Practical options drawn from Authorize.net's own published surfaces include temporarily routing new checkouts to Accept.js or direct API `createTransactionRequest` flows where the merchant already has a compliant card-collection design and SAQ posture, using Virtual Terminal for phone or chat recovery of stuck orders, and pausing automated fulfillment until webhook or settlement reconciliation confirms which hosted attempts succeeded. SIM and DPM remain documented as obsolete; building new long-term failover on those methods conflicts with Authorize.net's upgrade guidance in KA-09169.

Interpretation. Do not treat "disable CAPTCHA" as an emergency cure without a fraud plan. Authorize.net documents how to turn Security Code off for SIM Hosted Payment Form and how to set Accept Hosted `hostedPaymentSecurityOptions`, but Simple Checkout still requires Security Code per KA-09169 and KA-04306. Turning CAPTCHA off can also raise card-testing exposure for high-risk MIDs. Any temporary change during an incident should be time-boxed, logged, and paired with Advanced Fraud Detection Suite or equivalent velocity controls the merchant already runs.

Interpretation. Separate overlapping incidents in runbooks. August 2026 also carried Simple Checkout INC26672537 and processor-specific events. A support script that only says "Authorize.net is down" will mis-route engineering work. Match symptom (CAPTCHA/Security Code cannot complete on hosted form, Simple Checkout order page, blank SIM relay page, processor RTC codes) to the open Incident # on the status page.

What remains unknown (verified gap list)

Authorize.net has not published, on the public status page updates reviewed for this article, a non-login Post Incident Report detailing the CAPTCHA subsystem root cause, exact affected merchant count, or a minute-level customer-impact curve. The investigating update's Reported Start Time (13 August 2026) differs from the resolved update's Reported Start Time (12 August 2026, 3:00 PM GMT). This article reports both as published rather than inventing a single unofficial start clock. No public Authorize.net statement reviewed here claims that disabling CAPTCHA would have prevented INC26757168 for every integration type.

Sources