Rogers: the bank outage that started at someone else’s carrier
When one Canadian carrier failed for most of a day, debit payments failed nationwide, including for banks that never bought a Rogers circuit. Telecom dependency hides in three places a bank’s dual-carrier policy does not reach: shared payment utilities, thinly connected channels, and customers’ phones.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 8, 2022, Rogers Communications, one of Canada’s largest telecommunications providers, suffered a nationwide outage of its wireless and wireline networks that lasted most of the day, with some customers affected longer. Rogers attributed it to a maintenance update in its core network that caused routing equipment to malfunction. The effects reached far beyond Rogers subscribers. Interac, which runs Canada’s domestic debit network and e-Transfer service, relied on Rogers for connectivity, and debit payments failed across the country, leaving merchants accepting only cash or credit. Some bank branches, ATMs and contact centers were affected, and some calls to emergency services could not connect. The federal regulator, the CRTC, ordered Rogers to explain the failure, and the government directed major carriers to agree on emergency roaming and mutual assistance.
Bank resilience programs have long listed telecommunications as a critical dependency. In practice that usually meant the bank’s own circuits, and the standard control was to buy them from two carriers. The Rogers outage showed the limit of that control. Customers of every Canadian bank lost debit card payments for much of a business day, including banks with no Rogers circuits at all, because a shared payment utility depended on one carrier. A second carrier on the bank’s data center would not have helped.
Telecom exposure hides in three places that the dual-carrier policy does not reach, and each has a different owner inside a bank. The first is the shared utilities the bank relies on but does not run. The second is the bank’s own lower-tier channels, which often have thinner connectivity than its data centers. The third is the customer’s phone, which modern banking treats as part of the authentication system.
Shared utilities two layers down
Banks depend on networks they do not operate: card schemes, domestic debit networks, clearing houses, real-time payment systems and the processors that connect to them. Each of those depends on carriers, cloud regions and data centers. A bank’s third-party risk program usually assesses its direct providers. It rarely asks which carrier a shared utility relies on, and it has little power to change the answer.
What a bank can do is plan for the utility’s failure as a scenario rather than a vendor finding. For a domestic debit outage lasting a full business day, the plan covers four things.
- Cash. Whether branches and ATMs can dispense more cash, and whether enough is on hand to meet a surge.
- Authorization. Whether card transactions can fall back to another network for cards that carry one.
- Customer relief. Whether fee waivers or overdraft relief apply automatically for customers caught out, and who approves them.
- Messaging. How the bank will tell customers what is happening through channels that do not share the failed dependency.
Industry bodies are the right venue for the upstream question. A shared utility’s carrier diversity is a collective concern, and members can ask for it to be assessed and reported. Interac’s decision after the outage to add a second network provider is the kind of change that collective pressure produces.
Operational resilience rules were already moving toward this view. The UK’s regime, in force from March 2022, asks firms to map important business services end to end and to stay within impact tolerances in severe but plausible scenarios. A shared utility failure is exactly such a scenario.
The bank’s own thinly connected channels
The second place is closer to home. Many banks had dual carriers for data centers but single carriers for smaller branches, ATM networks, back-office sites and contact center telephony. Some circuits that looked diverse on paper shared an upstream provider or a physical route. Remote staff depended on home broadband and mobile hotspots from whatever carrier they happened to use.
A carrier diversity review asks, channel by channel, which carriers carry the traffic, whether one carrier failure would take the channel down, and how quickly it could recover. The answers often reveal a few inexpensive fixes, such as cellular backup from a second carrier for branch routers and ATMs. They also reveal a few expensive ones that need a business decision, such as true route diversity for a large operations center.
Contact centers deserve particular care because they absorb the customer impact of every other failure. If debit is down and the contact center’s inbound lines run through the failed carrier, customers cannot reach the bank at the moment they most need to. Inbound numbers should be routable across carriers, and agents should be able to work from sites or homes on different networks.
The customer’s phone as an authentication device
The third place received the least attention. Banks had moved customers to mobile apps and to text message one-time passcodes for login and transaction approval. During the outage, Rogers customers could not receive codes, could not use mobile banking away from Wi-Fi, and in some cases could not call the bank. For those customers the bank’s digital channels were down, even though the bank’s own systems were working.
That argues for authentication methods that do not depend on a single carrier. App-based authenticators and passkeys work over any internet connection, including Wi-Fi. Hardware tokens suit some business customers. Fallback procedures in branches and contact centers should let staff verify a customer securely without a text message, using methods that resist social engineering, since fraudsters also exploit outages.
There is a trade-off. Every fallback path is also a potential bypass. Recovery procedures need the same fraud controls as primary ones, and staff need clear rules about when the fallback applies. The goal is a second path that is safe enough to use, rather than an emergency exception that becomes a standing weakness.
The three places come together in a single map. For each important business service, it shows every telecom dependency across shared utilities, the bank’s channels and the customer’s device, with an owner and a tested fallback for each.
With hindsight
In the months after the outage, Canada’s major carriers signed an agreement on emergency roaming, mutual assistance and public communication during major outages, and Interac said it would add a second network provider. The episode joined a growing list of shared-infrastructure failures. In July 2024, a faulty security software update crashed Windows systems at airlines, hospitals and banks worldwide, again harming organizations that had done nothing wrong themselves. Regulators continued to formalize operational resilience. The EU’s Digital Operational Resilience Act applied from January 2025, and UK firms faced a March 2025 deadline to show they could stay within impact tolerances. Passkeys spread across banking apps, reducing reliance on text message codes. By 2026, supervisors expect banks to understand critical dependencies end to end, including those inside shared utilities and on customers’ own devices.