Stripe payment success, but order stays Draft

Hi @gilmord,

Are you using the card element or the payment element gateway?

Does this occur for a previously stored payment method? Or a newly created payment method?

I use the "Stripe Payment Element"
I tried to check if the payment method was reused or new (it looks like new but I can not confirm) and I noticed a strange thing - for the broken orders (and currently I see like 6 of them for the past few weeks) there is no Payment Method in Drupal. I see the payment methods for the orders paid both in Stripe and Drupal.

I did not dig into it (yet) - maybe a payment method is created when order is paid and this is why no PM (as order stays unpaid in Drupal), but maybe this is part of the problem. Maybe PM is not created due to PHP error I mentioned in the issue.

Also I was thinking on 3d secure issue, as those orders mostly have 3d secure, but I can see two orders in stripe, both with 3d secure and exact same "Events and logs" in Stripe dashboard, one is Paid in Drupal with payment method and the other is not and no payment method

@TomTech I was able to reproduce this issue by accident

I was testing other functionality

So on credit card form I:
- filled card number and date using google chrome stored cards suggestions
- I did not check if CVV was entered, and I have dynamic CVV (updated every 30 minutes) configured on my credit card
- I clicked Pay
- I saw popup with spam check "are you human?" and clicked checkbox
- I see error page on this URL /checkout/XXXXXX/review/return?payment_intent=pi_XXXXXB&payment_intent_client_secret=pi_XXXXX&redirect_status=succeeded as a drupal user
- error is "Invalid credit card type "" in Drupal\commerce_payment\CreditCard::getType() (line 31 of /var/www/html/web/modules/contrib/commerce/modules/payment/src/CreditCard.php)."
- as a user I stay on error page with order being Draft and not paid/placed
- in stripe I see that all is good and paid
- in my banking app I see one error charge "wrong CVV" and one success charge right after it

Setting to "Active" from "Postponed (maintainer needs more info)", I think we have enough details now

Here is a Stripe doc saying it is ok if CVV fails and payment is successful, also the same is true for postal code verification

So on the Stripe side all is OK but Drupal module is not ready to handle this cases

What I am not sure is ok - why are there two payments in my banking account, one is failed with "CVV invalid" message and one is successful. Is it how Stripe and banking works or should I be concerned - not sure

@

So debugging this process I see the exception "Your card was declined" thrown in the stripe SDK:

{
"error": {
"code": "card_declined",
"decline_code": "generic_decline",
"doc_url": "https://stripe.com/docs/error-codes/card-declined",
"message": "Your card was declined.",
"param": "",
"request_log_url": "https://dashboard.stripe.com/logs/req_XXXXXX?t=XXXXXXX",
"type": "card_error"
}
}

After that the Card::buildLabel is invoked and tries to CreditCardHelper::getType but $payment_method->get('stripe_card_type')->getString() that is passed as param is empty, so no credit card type and exception Invalid credit card type ""

If I fix this manually for test, just commenting exception and returning in CreditCardHelper::getType something like $types['mastercard'] - there is no whitescreen error for the user instead he is redirected to checkout/XXXXX/order_information with the message "Payment failed at the payment server. Please review your information and try again."

@TomTech I am trying to find out more details on this issue in the Stripe Discord channel, here the link to the conversation, maybe support or other developers will give any advises:

https://discord.com/channels/841573134531821608/841573134531821616/12714...

@gilmord

I see no reason not to enable the "Block if CVC verification fails" and "Block if postal code verification fails" rules for the project. I just checked the Radar settings on our side for the projects and we have both options enabled, but not for all projects (it seems like it should be enabled for all) so we can catch errors in the iframe.

Can you send the credit cards you use and I'll run tests on my side with the Radar rules disabled.

@vmarchuk i contacted stripe support - there is no way to reproduce this in a test mode using test cards

I was able to reproduce it with a real card in a live mode only

I can not consider forcing cvv check as potentially we can loose clients
"User pays and order stays unpaid in drupal" is better for business then "user tries to pay, see validation error and leave the site instead of trying to pay again"

Also according to what Stripe support said there is something wrong on our side - there is one payment which fails and returns to drupal "card_declined" and after that is the next payment which triggers 3d secure and is success

Please check conversation in the discord support chanel

@gilmord,

Thanks for the additional info.

The payment intent that succeeded should have an associated payment_method that was created in stripe.

Can you provide the data from that payment_method? (Removing any PII, of course.)

You can get it by:
1. Looking up the payment_intent, and getting the Payment_method.
2. Go to: https://dashboard.stripe.com/test/logs and search for that payment_method POST.

It should be something like below.

Based on your additional information, it appears that the card information is not present in the payment method when it is queried, which is why the error occurs.

{
  "id": "pm_012345678901234567890123",
  "object": "payment_method",
  "allow_redisplay": "unspecified",
  "billing_details": {
    "address": {
      "city": null,
      "country": "UA",
      "line1": null,
      "line2": null,
      "postal_code": null,
      "state": null
    },
    "email": "customer@example.com",
    "name": null,
    "phone": null
  },
  "card": {
    "brand": "visa",
    "checks": {
      "address_line1_check": null,
      "address_postal_code_check": null,
      "cvc_check": "unchecked"
    },
    "country": "US",
    "display_brand": "visa",
    "exp_month": 1,
    "exp_year": 2026,
    "fingerprint": "ABCDEF1234567890",
    "funding": "credit",
    "generated_from": null,
    "last4": "1111",
    "networks": {
      "available": [
        "visa"
      ],
      "preferred": null
    },
    "three_d_secure_usage": {
      "supported": true
    },
    "wallet": null
  },
  "created": 1721979546,
  "customer": "cus_12345678901234",
  "livemode": false,
  "metadata": {
  },
  "type": "card"
}

@TomTech in the payment intent I see the payment method ID in the stripe dashboard, when I go to /logs and search by the payment method ID I only see one log from Stripe:

It says:

card_declined
The card returned a decline code of generic_decline and did not provide any additional details.

The customer may need to contact their card issuer for more information.

And body is:

{
  "error": {
    "code": "card_declined",
    "decline_code": "generic_decline",
    "doc_url": "https://stripe.com/docs/error-codes/card-declined",
    "message": "Your card was declined.",
    "param": "",
    "request_log_url": "https://dashboard.stripe.com/logs/req_XXXXXX",
    "type": "card_error"
  }
}

Let me tell again the entire flow, I will try to reproduce step by step what is happening to me:
- on checkout page I enter card details with wrong CVV code
- I click pay
- immediately in my banking application I see attempt to pay, which is canceled with "Wrong CVV message"
- right after that I see one more payment in my banking app, which is success
- in Drupal I receive request from Stripe with "card_declined" code
- as Card is declined - commerce tries to redirect me to order information step, but I see the error there InvalidArgumentException: Invalid credit card type ""
- this is because payment method was not created
- I fixed this error for myself - I just comment this lines so at least I do not see error
- now I am redirected to the order information step with "Card declined" (something like that) validation message
- order stays Draft for me
- in stripe logs I see the error I pasted at the top of this message
- in stripe transactions I see successful transaction for this order