A client emails: "we've got hundreds of failed orders, is the payment gateway broken?" The gateway is almost certainly fine. What is happening is worse, it is documented by WooCommerce itself, and the damage will outlast the attack by months. Let's read the three patterns properly — because each one means something completely different, and two of them are invisible in the reports your client actually looks at.
First, what "failed" actually means
WooCommerce is precise about this, and the distinction matters for everything below:
Pending payment — "The order has been received, but no payment has been made." The customer hasn't paid yet; often they are mid-flow, or wandered off.
Failed — "The customer's payment failed or was declined, and no payment has been successfully made." A payment was attempted and rejected.
