How would you test an integration with a third-party payment gateway that you do not control?

What the interviewer wants to hear

• Use the provider sandbox and test cards
• Test success, failure, timeout and pending states
• Test webhooks and callbacks, including duplicates and out-of-order delivery
• Use mocks or stubs to simulate rare errors
• Reconciliation and idempotency checks
• Monitoring after release

Model answer

I start with the provider's sandbox and documented test cards or UPI test handles to cover success, decline, insufficient funds and 3-D Secure or OTP flows. The tricky part is everything around the happy path. Payments can be pending, time out or succeed after our app gave up, so I test timeouts and what the user sees. Webhooks may arrive late, twice or out of order, so I replay them and check that order status is still correct and no double fulfilment happens. Since the sandbox cannot produce every error, I use a mock server, like WireMock, to simulate 500 errors, slow responses and malformed data. I check idempotency keys on retries, refunds and partial refunds, and that our records reconcile with the gateway's settlement report. Finally, I make sure there is monitoring in production for failure rates, because sandbox and live behaviour can differ.

More hard QA Engineer questions

• A critical bug reached production even though QA tested the release. How do you handle it and what do you change afterwards?
• Which quality metrics would you track for a product team, and which would you avoid?
• Your team finds most bugs late, just before release. How would you shift quality earlier in the process?
• How would you test a feature whose output is not fixed, such as an AI chatbot or a recommendation engine?
• You join a company with no automation. How would you design a UI and API test automation framework that will still be healthy in three years?
• A product is built from 15 microservices owned by different teams. The shared end-to-end environment is slow and often broken. How would you design the testing strategy?
• You are not a penetration tester, but you are the only QA on the team. How do you include security testing in your everyday work?
• The full regression suite takes six hours, so the team releases only once a week. How would you get feedback down to under 30 minutes without losing confidence?
• How would you design the test strategy for releasing a mobile banking app on iOS and Android every two weeks?