Iberia’s blackout put payment resilience back at the shop counter
When the Iberian grid failed in April 2025, bank systems largely held and customers still could not pay. Payment resilience is set at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Shortly after 12:30 local time on April 28, 2025, the electricity grid in mainland Spain and Portugal collapsed. Tens of millions of people lost power. Trains and metro lines stopped, traffic signals failed, and mobile and internet service degraded as backup batteries at network sites ran down. Card terminals in shops went dark, many cash machines stopped working, and businesses that stayed open often took cash only. Hospitals ran on generators. Power returned progressively through the evening and night, and most of the Spanish grid was back by the following morning. Authorities said early on that there was no evidence of a cyberattack. The Spanish and Portuguese governments and the European grid operators’ association, ENTSO-E, opened investigations into the cause.
Banks usually measure payment resilience inside their own walls: authorization platform uptime, failover between data centers, recovery time for core systems. On April 28 most of those systems in Spain and Portugal kept running. Customers with money in their accounts still could not buy food or fuel. To see where the failure sat, it helps to follow one card payment through the four links it needs: a powered terminal, a network path from that terminal, an authorization decision, and a fallback when all else fails. A bank operates only the third directly. Its choices shape all four.
The terminal: no power, no point of sale
A countertop card terminal needs electricity, and so does the cash register it is wired to. Most small merchants have no backup power at all. Larger stores often back up lighting, refrigeration and security, but not every till. Once the grid failed, the point of sale stopped, however resilient the acquiring bank’s platform was.
Battery-powered portable terminals and phone-based acceptance lasted longer, until batteries or mobile connections gave out. Acquirers and payment providers influence this layer more than they admit. They choose which devices to supply, rent and certify, and they write the onboarding checklist. Few onboarding processes ask a merchant what happens at the counter when the power fails. An acquirer could add one question to its merchant risk review: does the business have at least one battery-capable terminal, and does staff know how to use it in an outage? For pharmacies, grocers and fuel stations, that question has public value.
The network path: a dependency nobody owns
A powered terminal still has to reach the payment network. Many connect through the merchant’s broadband router, which died with the grid. Others use a mobile SIM, which worked only while nearby cell sites had battery power. That left an afternoon of patchy service across the peninsula. The dependency is shared by every bank and merchant in a region, and no single institution can fix it.
What a bank can do is measure it. Few institutions know what share of their acquiring estate connects by fixed line versus mobile. Fewer have asked carriers how long cell sites in their key markets run on backup power. Both facts belong in an operational resilience scenario, because together they set how long customers can transact after a regional power loss begins. European institutions had a direct reason to ask. The Digital Operational Resilience Act, applicable since January 2025, requires financial entities to test severe but plausible disruption scenarios, and a regional grid failure qualifies.
The authorization decision: rules set years ago
Card schemes and issuers have long supported approval without a live connection to the issuer. A chip card can approve some transactions offline within limits the issuer writes onto the card. A merchant system can store transactions and forward them later, at the merchant’s risk. When an issuer’s host is unreachable, network stand-in processing can approve within issuer-set parameters. Each mechanism needs something different. Offline chip approval needs a powered terminal but no connection. Stand-in needs a connection to the network but not to the issuer.
These settings are configured once and seldom revisited. Over the past decade many issuers tightened offline limits to curb fraud, and many merchants turned off store-and-forward to avoid chargebacks. Those were sound decisions under normal conditions. The blackout is a reason to review them deliberately. A modest offline limit on debit cards for essential merchant categories raises credit and fraud exposure slightly. It also lets customers buy food during a regional emergency. That trade-off should be a documented decision by the card product owner and the fraud team, not an inherited default.
The fallback: cash and the message about it
When cards failed, cash worked for those who had it. Many people did not, and many cash machines were down or emptied. The Bank of Spain later described ATMs with backup power running out of notes while others went offline with cash inside. Withdrawals jumped once power returned.
Banks shape this layer through their cash network, branch continuity plans and what they tell customers in advance. A branch with backup power and a manual procedure for limited withdrawals is a public service during a regional outage. Manual procedures need preparation: a way to verify identity without the core system, a per-customer limit, a paper log for later reconciliation, and staff authority to apply them.
Communication is part of the fallback, and it must happen before the outage. Once the mobile network degrades, the bank’s app and text alerts cannot reach anyone. A customer who already knows that small chip payments may still work, which branches have generators, and that keeping some cash at home is sensible, can act without guidance. Pre-written outage messages can go out through local radio and branch signage when digital channels are down.
The four links show why the bank’s own uptime figures said little about April 28. A useful test for any bank or payment provider is to run its resilience scenario from the customer’s position: a full-day regional power failure, weak mobile service, and the question of whether a customer can buy groceries.
With hindsight
The cause took almost a year to settle. A Spanish government report in June 2025 pointed to failures of voltage control on the grid rather than a cyberattack. ENTSO-E’s expert panel published its final report in March 2026. It described several interacting factors that ended in an overvoltage cascade, the first major European blackout attributed to overvoltage.
For payments, the cause mattered less than the cascade. In September 2025 an ECB paper titled “Keep calm and carry cash” used the blackout as one of its cases. It argued that households should keep enough cash for essentials for roughly 72 hours. In April 2026 the Bank of Spain wrote that cash remained an essential backup and described how banks restocked ATMs after power returned. What held up is the basic finding: core banking systems survived, and customers felt the failure at the terminal, the network link and the missing cash fallback.