How Online Card Payments Actually Work

What a Card Payment Really Is

At its most fundamental level, a card payment is a promise. When a consumer taps, swipes, or types a card number at checkout, they are authorising their bank to transfer money on their behalf to the merchant's bank. The card itself, whether physical plastic or a digital token stored on a smartphone, is simply an authentication credential linked to a financial account. That account can be a credit line (in which case the bank is lending the consumer money) or a deposit account (in which case the bank is drawing directly from the consumer's funds).

The distinction matters commercially. Credit card transactions carry higher processing fees because the issuing bank bears the risk that the consumer may never repay the borrowed amount. Debit card transactions are cheaper to process because the money is verified and available at the moment of purchase. In the United States, the average credit card interchange fee runs approximately 1.79%, while debit card fees are capped by the Durbin Amendment at USD 0.21 plus 0.05% of the transaction value for large issuers.

Anatomy of a Card

Before tracing the flow, it helps to know what is actually printed, embedded, and encoded on the card itself. Every visible element corresponds to a piece of data that the network and issuer rely on to authenticate, route, and price the transaction.

The Primary Account Number, or PAN, is the most important field. Its first six to eight digits — the Bank Identification Number, or BIN — tell the processor which issuer to route to, which network owns the brand, and which interchange tier applies. The EMV chip generates a unique cryptogram for each transaction, which is why a copied magstripe is dramatically less secure than a chip dip. The CVV on the back, separately printed and never encoded on the magstripe, exists specifically to prove the cardholder is in possession of the physical card during card-not-present checkout.

The Five Parties Behind Every Card Transaction

Every standard card transaction involves five core participants. The cardholder is the consumer making the purchase. The merchant is the business accepting the payment. The issuing bank is the consumer's bank, which issued the card and ultimately approves or declines the transaction. The acquiring bank is the merchant's bank, which holds the merchant account and receives the funds once the transaction settles. Connecting these four parties is the card network (Visa, Mastercard, American Express, or Discover), which operates the infrastructure over which transaction data travels.

Visa and Mastercard function purely as networks; American Express and Discover also act as issuers, a structure known in industry terms as the three-party model. That distinction explains why Amex and Discover often negotiate pricing and acceptance directly with merchants, while Visa and Mastercard pricing is mediated through acquirers.

Card-Present vs Card-Not-Present

The single biggest determinant of fee level and fraud exposure is whether the card is physically present at the point of sale. Networks treat the two contexts as fundamentally different risk environments, and pricing reflects that gap.

Tap to Settlement, Step by Step

The lifecycle of a card payment unfolds in seconds, but behind that speed lies a complex choreography of data exchange between multiple institutions.

Authorisation Decisioning: What the Issuer Actually Checks

The two-second authorisation window hides a dense stack of parallel checks. The issuer's decision engine evaluates dozens of signals before returning a yes or no.

• Account status. Is the card active, not blocked, not reported lost or stolen?
• Available balance or credit line. Are funds available, including any pending holds?
• Velocity. How many transactions has this card attempted in the last minute, hour, and day?
• Geographic plausibility. Is the merchant's country consistent with the cardholder's typical pattern, or has the card travelled physically impossible distances?
• AVS and CVV match. Do the billing address and CVV provided match what the issuer holds on file?
• 3D Secure outcome. Was the cardholder challenged, and did they pass? Successful SCA shifts liability to the issuer.
• Machine-learning fraud score. Hundreds of features feed real-time models that score the transaction against the issuer's known fraud patterns.

Clearing and Settlement Explained

Capture and Batching

Once the merchant fulfils the order, the authorised transaction is captured. Merchants typically group captured transactions at the end of each business day and submit the batch to their acquirer. No money moves during this stage. The process simply reconciles data so both sides agree on what is owed.

Clearing

The acquirer and issuer exchange the full transaction records through the card network. Clearing confirms that the details match the original authorisation and prepares the payment for final transfer. This step catches discrepancies between what was authorised and what is being claimed, adding a layer of verification before funds are released.

Settlement

The card network coordinates the movement of funds. The issuing bank debits the consumer's account and transfers the transaction amount, minus the interchange fee, to the card network. The network forwards the funds, minus its own scheme fee, to the acquirer. The acquirer deposits the remaining amount, minus its markup, into the merchant's bank account. Settlement usually takes one to three business days.

The Money Trail: Where Your £100 Goes

Three distinct fees are deducted between the customer's payment and the merchant's deposit. Interchange goes to the issuer, the scheme fee goes to the network, and the acquirer markup is the processor's margin. Of the three, only the acquirer markup is genuinely negotiable — interchange and scheme fees are published rates that apply to every processor identically.

For merchants processing significant volume, the difference between a competitive markup and a default one can run into six figures annually. Use the interactive fee calculator to model your own blended rate, and see payment fee structure for the full breakdown of how each layer is set.

Cash Flow Implications for Merchants

The multi-day lag between customer approval and actual fund arrival explains why merchants see money appear later than the customer experience suggests. In high-volume e-commerce or subscription businesses, the timing directly affects cash flow planning and reconciliation. A merchant processing thousands of transactions daily must account for the gap between revenue recognition and bank deposits when managing operating expenses and supplier payments.

Real-time payment methods are gaining ground in 2026 precisely because they compress or eliminate these delays. Systems such as UPI and PIX settle within seconds rather than days. Yet cards remain dominant for their global acceptance, buyer trust, and the consumer protections that come with chargeback rights.

Common Decline Codes and What to Do With Them

Decline codes are not all created equal. Treating them uniformly is one of the most common — and most expensive — mistakes in payment operations.

Visa and Mastercard both monitor excessive-retry behaviour and apply network fines when merchants exceed thresholds — typically more than fifteen retries on the same hard-decline card within a 24-hour period. Building decline-code logic into the retry engine is one of the highest-leverage operational improvements a merchant can make.

Frequently Asked Questions