iATS Payments Recurring Contributions job does NOT finish

[yashodha]

I see this in error log when the job for iATS Payments Recurring Contributions is run and the job never completes

get this error status : You cannot change a contribution that already has been reconciled. Please contact your system administrator for more information on this error.

In the logs, I can see
$FAPS transaction failure result = Array ( [data] => [isError] => 1 [errorMessages] => Array ( [0] => Transaction Declined Due to Security Reasons ) [validationHasFailed] => [validationFailures] => Array ( ) [isSuccess] => [action] => AchDebitUsingVault )

Separate issue :
Even when I have no errors on running these job
I have also entries corresponding to the recurring contributions in civicrm_iats_faps_journal as Settled but no contributions pending/completed created in CiviCRM.

Any pointers?
using 5.19 + iats1.5.4
 

[adixon]

That error message "Transaction Declined Due to Security Reasons" is just passed in from iATS/Firstpay, you'd have to contact them.

re: iATS journal entries missing in civicrm - is it possible that the iats transation is getting triggered somewhere else? I'd look at the invoice id to see if it looks like a civi one. The other possibility is that the transaction is attempted from civicrm and doesn't get an answer, but iATS did get the request but didn't manage to tell you at the time. In cases like that, the contribution is left as pending, and there are cases where civicrm does some kind of clean and it disappears.

A good place to look at what actually happened between civicrm and iats is these two tables:

civicrm_iats_request_log
civicrm_iats_response_log

where all requests/responses get logged.

[adixon]

I note that you've got some old code running there, which I don't recommend. Old code wasn't as good at dealing with unexpected errors. And of course, running a server that's dealing with credit cards, you're voiding your PCI compliance if you're not keeping your code up to date.

[yashodha]

@adixon Strangely, both these tables civicrm_iats_request_log and civicrm_iats_response_log are empty.

Does that tell us something?

[yashodha]

@adixon
The other possibility is that the transaction is attempted from civicrm and doesn't get an answer, but iATS did get the request but didn't manage to tell you at the time. In cases like that, the contribution is left as pending, and there are cases where civicrm does some kind of clean and it disappears.

The problem is that the we have an entry in civicrm_iats_faps_journal as Settled but no contribution (no entry in civicrm_iats_verify table) for some of the months. We have had recurring contribution in Jan recorded in CiviCRM, Feb entry in civicrm_iats_faps_journal but missing in CiviCRM(NO contribution record), March record again properly in CiviCRM and April entry missing (no record in CiviCRM).

[adixon]

Strangely, both these tables civicrm_iats_request_log and civicrm_iats_response_log are empty.
Does that tell us something?

It tells me you're using FirstPay instead of legacy, which you already told me (i.e. sorry, red herring).

But it sounds like a complicated collection of issues and I can't really help other than to send you to iATS for the weird error message and encourage you to update your civi and iats versions.

Specifically, you've got:

1. "You cannot change a contribution that already has been reconciled." - this is a core civicrm message I believe and I have no idea what it actually means.
2. "Transaction Declined Due to Security Reasons" - is a FirstPay/Iats error message which is either what it says, or else something that FirstPay/Iats would have to tell you more about.
3. Missing contributions in CiviCRM for transaction that are recorded in your journal (which is just reported from iATS/FirstPay). CiviCRM likes to clean up pending contributions, which makes it hard to diagnose errors.

Some of those issues may be related and some not ...