Cellular Failover for Payment Terminals

A site appears offline in the dashboard, a customer is waiting at the charger or the gate, and the nearest technician is 40 minutes away. Most guides on cellular failover for payment terminals were written for staffed retail, where a manager is on hand, and they end with the advice to add a backup connection. At an unattended site, a backup line counts only if the card is approved during the failure, and that requires the second path to be live and carrying traffic before the first one fails. This guide examines why common backup designs fall short of that standard, what a design that meets the standard looks like, and what else an unstaffed site requires. It offers a design and a checklist, not an uptime promise.

In brief

The standard for an unattended site is simple: the card is approved during the failure. A backup line that comes online after the terminal has timed out does not meet that standard.

The most damaging outage is "connected but not working," in which the SIM is attached and showing signal while no data moves. A single-modem SIM switch does not detect that condition.

Failover moves traffic to a second path after the first one fails, and the switch itself can cost a sale. Bonding keeps every path live, turning a failure into a reweighting rather than a reconnect.

Two SIMs in one modem provide one carrier at a time, and two carriers on the same tower fail together. Carrier diversity requires verification at each site, not a higher SIM count.

Offline mode is a liability decision, not a fallback. The merchant carries the risk of a later decline, debit is excluded, and no one is on site to collect.

Key insight

A dashboard considers a site online when the router has a signal; a customer considers the site online when the card is approved. A backup line serves its purpose only if it closes that gap, and it can do that only by carrying traffic before the primary fails.

What Happens at the Terminal When the Connection Drops

Every card-present payment is a round trip. The terminal reads the card, sends an authorization request to the acquirer, and starts the session or opens the gate once the approval returns. Any break in that round trip ends the sale, and each of the three common failure modes presents differently to the operations center.

What the Dashboard Shows	What Is Happening	What the Customer Sees
Offline	The primary line is down, and the router has not connected to an alternate path.	A terminal that does not respond, or a prompt to pay through the app.
Online, full bars	The SIM is attached and the signal is strong, but the tower has lost backhaul or is congested, and no data is moving.	A tap that spins and then declines. The customer may try once more before leaving.
Online, then offline, then online	The router is switching from the primary path to the backup.	A decline during the switch, followed by a working terminal a minute later, with no one present to retry.

Connected but Not Working

The second scenario does the most damage, because standard monitoring does not detect the condition. A federal laboratory study of EV charging payment reliability found that poor network connectivity was a significant cause of failed payments and that ping time predicted transaction success more accurately than upload or download speed. A site can report strong signal and a healthy data rate while every authorization times out, because the problem lies on the far side of the tower.

A router with one modem and two SIMs does not address this failure. The switch from one SIM to the other triggers only when the modem cannot attach to the network or when a data cap is reached, and a SIM that remains attached while passing no traffic meets neither condition. The router stays on the failed path with full signal bars, and the site continues to decline cards until someone intervenes.

The Switch Itself Costs a Sale

Even when the switch does trigger, it takes time, and the terminal applies its own timeout. One processor's terminal documentation places the fallback window between 15 seconds and two minutes, depending on signal strength, and notes that payments may fail during that window. Another processor's documentation states that its terminal waits 36 seconds without a connection before failing over to cellular. Any card tapped within that window is declined. In a staffed store, a cashier can ask the customer to try again. At a charger, the driver is likely to read the decline as a broken station and continue to the next location, while the dashboard records nothing because the site was back online a minute later.

Failover, Bonding, and Load Balancing Are Not the Same Thing

The three terms are often used interchangeably, yet they describe three distinct behaviors, and only one of them closes the switch window rather than merely shortening the gap. The definitions below are the router vendor's own.

Approach	What It Does	During the Switch	Fit for an Unattended Site
Hot failover	Moves traffic to a healthy link when the active link fails. One path carries the tunnel at a time.	A gap while the system detects the failure and brings the new path online. The authorization in flight is lost.	An improvement over a single path, but the window remains, and any tap during the window is declined.
Bandwidth bonding	Aggregates two or more links into one tunnel. Every path is live and carrying traffic at all times.	No reconnect. Traffic is reweighted to the paths still standing, and packets lost on one path are recovered from another.	The design that holds. The second path is already authenticated and proven before the first one fails.
WAN smoothing	Sends duplicate packets across links to fill gaps, trading bandwidth for resilience.	A brief drop on one path is covered by another.	Useful on top of bonding for small, latency-sensitive traffic such as an authorization.
Load balancing	Splits sessions across links by rule. Each session still rides one link.	A session on the failed link is lost, with no mechanism to reroute the session.	Not a resilience feature for a single authorization.

That distinction is the central argument of this guide: hot failover shortens the window, while bonding removes the window entirely. Bonding requires a termination point. The router splits traffic at the site, and a FusionHub endpoint, hosted in the cloud or at the operator's data center, reassembles the traffic. The acquirer and the charger management platform see one stable connection, regardless of what any individual path is doing. Without the endpoint, the router reverts to selecting one link at a time.

Why a Second SIM Is Not a Second Carrier

"Dual SIM" is the feature most commonly sold as redundancy, and the least examined. The label conceals two separate problems.

One Modem, Two SIMs

A single modem attaches to one network at a time, which makes a second SIM in the same modem a spare rather than a second path. The router vendor's own guidance notes that switching between SIMs on one modem can take minutes and is not recommended for wireless-to-wireless failover where uptime matters. A dual-modem router works differently, with two active radios, each attached to its own carrier and each able to carry traffic simultaneously. Bonding depends on that hardware.

Two Carriers on the Same Tower

Two active radios on two carriers still share whatever infrastructure those carriers have in common. In many locations, that includes the tower and, behind the tower, the fiber route that carries its traffic. A backhaul cut or tower power loss takes down both carriers at once, and the site fails over from one dead path to another. Carrier diversity is therefore a matter of verification, not SIM count: a site-by-site check of which tower each carrier uses to serve the site and whether those towers share an outbound route.

Why Offline Mode Is Not the Fallback at an Unattended Site

Offline mode, store-and-forward, and deferred authorization are three names for the same function. The terminal approves the card without contacting the acquirer, stores the transaction, and submits it for authorization once a path returns. At a staffed counter, that function is a reasonable bridge. At an unattended site, it becomes a liability decision, as card network and processor documentation make clear.

None of this makes store-and-forward useless. The function has a legitimate role, but that role is narrow.

Relied on as the primary plan, store-and-forward tends to reveal on Monday how many Friday sessions went unpaid.

What a Cellular Path Does to PCI Scope

Operators often ask whether a cellular backup changes their PCI obligations. A cellular path neither adds nor removes a requirement. It adds a network path, and that path must be treated as the standard treats any network the operator does not own.

The current standard contains no cellular-specific requirement. An assessor evaluates a cellular path with the same questions applied to any network path: whether the data is encrypted, whether the path is segmented, and who can reach the devices on the path.

The Site Nobody Visits: Power, Antennas, and Alerts

Everything above assumes the router is powered, the antenna has line of sight to a tower, and someone is notified when a path drops. At a staffed site, those conditions are usually in place. At an unstaffed site, each one is a design decision.

Site power

A grid outage takes down the router and terminal as well, and an unpowered backup line provides no protection. Battery backup for both, sized to the outages the site actually experiences, is the first line item.

Antenna placement

An indoor antenna inside a steel enclosure can mean the difference between two bars and none. Outdoor cellular antennas oriented toward the serving towers, together with a clear view of the sky for any satellite path, belong in the installation survey rather than in a later fix.

Monitoring and alerting

The operations center needs visibility into which path is carrying traffic at each site, along with an alert when a path drops, ideally before the first customer is affected. With no one available to power-cycle a router at 2 a.m., the router must recover on its own and report the recovery.

Tower backup power

Cell sites run on battery when the grid fails. Carriers publicly describe that capacity in hours, extended to days by generators at some sites, and California requires 72 hours of backup power at sites in high-risk fire areas. A multi-day outage can outlast that capacity, and a tower that is standing but dark is precisely the scenario a satellite path is designed to cover.

Sizing the Data Plan for a Line That Only Works During Outages

No credible published figure exists for how much data a failover line consumes, and this guide does not attempt to estimate one. The only available processor figure places a single card transaction under one kilobyte. The transactions themselves are not what exhausts the plan.

What Uses Data	When	How to Bound It
Management traffic and keepalives	Every day, whether or not there is an outage, on every bonded path kept warm.	Measure usage on a pilot site for a full billing cycle before sizing the fleet.
Firmware and configuration pulls	Whenever the primary is down and an update is scheduled.	Schedule updates over the primary path, and defer them while a site is on backup.
Everything at the site	The days the backup carries the full load: charger telemetry, cameras, signage, and payments.	Decide in advance what rides the backup and what waits. Payments and telemetry take priority; cameras and signage can pause.
Deprioritization	Outage days, when every user in the area shares the same towers.	Expect slower performance on the backup when the backup matters most, and keep payment traffic small and prioritized.

Pooling data across a fleet keeps sizing manageable. A site that spends a week on backup draws from the shared pool rather than exceeding its own allowance, and the operator receives a single bill. Pooled-data SIM plans from Paygasus are in development, and the SIM plans page accepts notify-me requests in the meantime.

What to Put at the Site

Each layer below is described by what it is built to do, because that is the only accurate basis for describing a layer. No single layer prevents a dropped signal; together, the layers determine whether a dropped signal becomes a dropped sale.

Layer	What It Is Built to Do	Where It Still Fails
Router with two active radios, running a bonded tunnel	Carry two or more paths at once and reweight traffic when one fails, without a reconnect.	Site power loss, or every path failing together.
SIMs on different carriers, verified for different towers	Keep a path available when one carrier's tower loses power or backhaul.	A regional event that takes every tower and route in the area.
Satellite path, bonded as a standing low-weight link	Carry traffic through a regional terrestrial outage, independent of any local tower or fiber.	Heavy precipitation, an obstructed sky view, or site power loss.
Unattended terminal with store-and-forward	Bridge a gap of seconds under the bonded network, for credit only, within limits set at underwriting.	A multi-day outage, a debit card, or a deferred authorization that later declines.
Monitoring and alerting with one owner	Report which path is live at every site and raise an alert before a customer notices.	Split ownership across three vendors and three tickets, which is why a single owner matters.

Paygasus Connect delivers the full stack under one contract alongside the payments. As a Starlink Authorized Solution Provider, a Peplink Authorized Solution Provider, and an authorized Cradlepoint reseller, Paygasus sources the routers, antennas, and terminals; configures the bonded tunnel and the FusionHub endpoint; manages SIMs across AT&T, T-Mobile, and Verizon; installs at the site; and monitors the result. Routers and satellite kits are available in the Paygasus shop, and Apollo and ApolloMax terminals serve the stall, the gate, and the kiosk. When a path drops at 2 a.m., the partner that settles the transaction is the same partner that owns the router, and one number reaches the team accountable for both.

Common Questions

Does a Payment Terminal Work When the Internet Goes Down?

A card-present terminal requires a live path to the acquirer to obtain an approval. When the primary connection drops, a terminal without a backup path either declines every card or falls back to offline mode, where the merchant carries the risk of a later decline. A terminal behind a router with a second live path continues authorizing if the switch is fast enough, and without any gap if the paths are bonded.

Is Dual SIM Enough for a Payment Terminal?

Not on its own. Two SIMs in one modem provide only one attached carrier at a time, and the switch between them can take minutes and does not trigger when the attached SIM is passing no data. Two active radios on two carriers is the minimum for a site that cannot absorb the switch, and even then the carriers must be checked for a shared tower or route.

How Long Does a Terminal Wait Before It Fails Over?

The answer depends on the terminal and the router, and both clocks matter. Published terminal documentation places the fallback window between 15 seconds and two minutes on one platform and at 36 seconds on another. Router vendors describe hot failover as fast and SIM switching as taking minutes, without publishing a figure. A card tapped during any of those windows is declined, which is why a bonded design that avoids the switch altogether is the design that holds at an unattended site.

Can an Unattended Terminal Take Payments Offline?

Many can, and most operators should set tight limits. Store-and-forward approves without verification, the merchant is fully liable for a later decline, debit is excluded, and the authorization must be submitted within a short window. At a site where no one is present to collect on a decline, store-and-forward works as a bridge of seconds under a resilient network, not as the plan.

Does Cellular Backup Change Our PCI Scope?

A cellular backup adds a path that must be treated as a public network, which means cardholder data on that path must be encrypted in transit. A private APN keeps the traffic off the public internet, segmentation isolates the terminals and router from the rest of the site, and a validated P2PE solution may reduce the assessment. The acquirer decides what applies to a given operator.

Audit the sites before the next outage

One Review per Site, Four Questions

The review centers on four questions: which sites have a single path out, how long the failover window is at each terminal, whether the two carriers use different towers, and what the data plan should be. Paygasus reviews the fleet with the operator and returns an assessment of which sites will hold and which will not, along with the stack and the contract to address those that fall short.

Start the conversation

Next in this series → Keep EV Charging Payments Clearing Through Storm Season

Cellular Failover for Payment Terminals: How to Keep Unattended Sites Online