System Design interview question · Classic system design problems · senior level
Your call to the payment provider times out. Did the customer pay? How do you design the payment state machine and reconciliation so no money is lost or charged twice?
Free to read in full. This is 1 of the 200 questions in the System Design and Distributed Systems interview pack, with 268 diagrams. Get the pack, ₹999 · $20
Why it is asked
Unknown outcomes are the hardest part of payments. Candidates who mark a timeout as failed cause double charges when the customer pays again.
The answer
You do not know, so record the payment as UNKNOWN, never as failed, and resolve it by asking the provider, retrying with the same idempotency key, waiting for the webhook, and finally reconciling against the provider's settlement report (the daily file of every payment it collected).
Why: the request may have failed before reaching the provider, or succeeded while the reply was lost. 'Failed' invites a second payment; 'succeeded' may ship unpaid goods.
State machine: CREATED -> AUTHORIZING -> SUCCEEDED or FAILED; AUTHORIZING -> UNKNOWN on a timeout; UNKNOWN -> SUCCEEDED or FAILED once resolved. Only forward moves are allowed, each as a conditional update such as 'set SUCCEEDED where status = UNKNOWN'. A success webhook for a payment already marked FAILED is an alarm for a human, not a silent overwrite.
Resolving UNKNOWN:
- A status job asks the provider about your payment ID at growing gaps (30 seconds, 2 minutes, 10 minutes, 1 hour).
- Retrying the charge with the same idempotency key is safe: the provider returns the original result.
- The webhook may settle it first; the conditional update makes the first answer win.
- The customer sees 'payment processing', not 'payment failed'.
Reconciliation: every day, match that file against your ledger by provider reference. Money the provider has but you do not show as paid: fix the state, then fulfill or refund. Payments you show as paid that the provider does not have: first allow for settlement lag (a capture, meaning money actually taken, often appears in the file a day or two later), confirm with the status API, then mark them failed. Alert on any unmatched money older than a day.
What the interviewer listens for
- Timeout means unknown, not failed
- Forward-only states with conditional updates
- Resolve with status checks, same-key retries and webhooks
- Daily reconciliation against the settlement file
Follow-ups the interviewer may ask
- What if the provider has no status API? Hint: rely on the same-key retry and the webhook, and keep the payment UNKNOWN until reconciliation.
- How do you stop the customer paying twice meanwhile? Hint: block a new attempt for the same order while one payment is UNKNOWN, and show its status.
Common mistakes
- Treating a timeout as a failure and letting the customer retry with a new key.
- Allowing any state to overwrite any other, so a late, wrong event can undo a success.
Written by Roni Das, who builds distributed systems and AI systems for a living.
Learn it properly
This is taught step by step in the course lesson Idempotency Keys.
One question is not enough for the interview.
This is 1 of the 200 questions in the System Design and Distributed Systems pack
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
More free questions from this pack
- A page calls 100 backend servers in parallel and waits for all of them. Each server is slow only 1% of the time. How often is the page slow, and what can you do about it? (mid)
- Design a URL shortener like bit.ly. What are the requirements and the API, what happens when a link is created and when it is clicked, and should the redirect be a 301 or a 302? (junior)
- Walk me through a UPI person-to-person payment. What do the payer's app, the PSP, the NPCI switch and the two banks each do? (mid)
- You must move a 600-million-row orders table from MySQL to DynamoDB, where data is modeled around access patterns instead of joins. How do you migrate with no downtime and prove the new model answers every query? (staff)
Free questions from the other packs
- What do temperature and top-p control, and what values would you use for data extraction versus brainstorming? (AI Engineering)
- What is hybrid search, and how do you merge keyword and vector results with Reciprocal Rank Fusion? (AI Engineering)
- Users ask "list all X" questions and RAG returns only five items. Why, and what do you do? (AI Engineering)
- How do you check that an LLM judge agrees with human reviewers? (AI Engineering)
- Cut the cost of an LLM feature serving 10 million requests a day by 60% without hurting quality. Walk through your plan. (AI Engineering)
- Why are LLMs bad at counting letters or reversing a word? (GenAI and LLM)
- Write out scaled dot-product attention with the shape of every tensor. (GenAI and LLM)
- How does speculative sampling keep exactly the target model's distribution? (GenAI and LLM)
- What is GRPO, and how do verifiable rewards train reasoning models? (GenAI and LLM)
- Design a system that answers questions from 300-page contracts accurately. (GenAI and LLM)
- Describe the basic agent loop. (Agentic AI)
- What are pass@k and pass^k, and why do they matter for agents? (Agentic AI)
- How does prompt injection become dangerous once the agent has tools? (Agentic AI)
- Design the security architecture for an agent that can read and send company email. (Agentic AI)
- Design a customer support agent for an e-commerce company. (Agentic AI)
- What happens, step by step, when an LLM server handles one request? (Inference Engineering)
- Derive the KV cache size formula and work it out for Llama 3 70B. (Inference Engineering)
- What is PagedAttention? (Inference Engineering)
- When does speculative decoding stop helping or make things worse? (Inference Engineering)
- Design a service to serve Llama 3 70B at 10 QPS with latency targets. (Inference Engineering)
- A model scores 95% accuracy offline but users say it is useless. What do you check first? (ML Engineering)
- How do you train on a dataset that does not fit in memory? (ML Engineering)
- A long distributed training job dies at hour 20. How do you make training fault tolerant? (ML Engineering)
- How does request batching on a GPU trade latency for throughput? (ML Engineering)
- An online model metric dropped 8% overnight. How do you debug it? (ML Engineering)
- You need to show delivery times for 20 cities. Would you use histograms, box plots, violin plots or ECDFs, and why? (Data Science)
- A test is 99% accurate and you test positive. What is the chance you have the disease? (Data Science)
- What share of first-time buyers make a second purchase within 30 days? Write the SQL. (Data Science)
- How would you forecast daily orders for the next four weeks, and how do you know the forecast is any good? (Data Science)
- A coupon A/B test shows a small average lift. How do you find which users the coupon actually works for, and who should get it next time? (Data Science)
- Compute the cosine similarity of a = (3, 4) and b = (4, 3) by hand. What does the result mean? (Maths for ML)
- A batch of 32 MNIST images goes into a dense layer with 128 units. What are the shapes, and what is the rule for when two matrices can be multiplied? (Maths for ML)
- A disease affects 1% of people. A test catches 90% of sick people (sensitivity) and wrongly flags 9% of healthy people (false positive rate). You test positive. What is the chance you are sick? (Maths for ML)
- Why do we not use mean squared error for classification with a sigmoid output? Compare the gradients numerically. (Maths for ML)
- Compute scaled dot-product attention by hand for two tokens with d_k = 2. (Maths for ML)
- A customer says: "We want AI for our support team." What do you do in the first meeting? (Forward Deployed Engineer)
- The customer's admin offers you a global admin account "to save time". What do you ask for instead, and why? (Forward Deployed Engineer)
- Your connector writes tickets into the customer's system. A request timed out, the connector retried, and now there are duplicate tickets. How do you make the writes safe to retry? (Forward Deployed Engineer)
- The customer wants RAG over 10 million documents, all behind their firewall. Size it for me on the whiteboard. (Forward Deployed Engineer)
- One deployment of your AI platform must serve 50 business units of the same enterprise. How do you design multi-tenancy? (Forward Deployed Engineer)