The payment pages (credit card details capture or 3DSecure) can timeout if the customer does not respond in a specified time.
This is handled by the payment gateway with notifications to the customer and to the merchant.
The Session Expiry service will expire all abandoned session every 15 min.
An abandoned session can result from the following actions, which will result in the payment session never being deleted:
When a payment is about to expire on payment gateway (1 minute before), a notification is sent to the payment page alerting the customer.
The customer has the option to extend the session by a further 15 minutes, or not.
If the customer does not extend the session or the session expiration timer reaches 0, it will then automatically expire the session.
Payment events will be logged and a failure webhook (with a 1003 error code a.k.a. Session Expired - see 4.5 Appendix E: Vodacom Payment Gateway Response Codes) is sent back to the merchant.