What happens when you press “Pay”
A checkout page looks like a simple form, but the purchase usually passes through several organizations in a couple of seconds. Understanding the chain makes it easier to see where the risks sit, why some payments can be reversed and others cannot, and what the various safety features are actually protecting.
The parties involved in a typical card payment are:
- You, the cardholder, who supplies a card (or a wallet or bank account) as the way to pay.
- The merchant, the shop selling the goods or service.
- A payment gateway, which securely collects and forwards the payment details from the merchant’s site or app.
- A payment processor, which routes the request onward and handles much of the technical plumbing.
- The acquiring bank (the acquirer), which holds the merchant’s account and takes responsibility for the merchant on the card system’s side.
- The card network, the scheme that connects banks to each other and sets the rules.
- The issuing bank (the issuer), the bank that gave you the card and holds your account or credit line.
In practice some of these roles are combined. A single company may act as both gateway and processor, and many small shops use a payments provider that bundles everything so the merchant never has to deal with the individual pieces.
Step 1: Entering the details
When you type a card number, expiry date and security code into a checkout, well-built sites do not let the details touch the merchant’s own servers more than necessary. Often the form fields are supplied directly by the payments provider, or the data is sent straight to the gateway over an encrypted connection. The merchant then receives a reference to the payment rather than the raw card number.
This matters because a shop that never stores card numbers has less to lose if it is attacked. It is also why you may see a returning-customer option that shows only the last four digits: the full number is held, if at all, by the provider in a protected form.
Step 2: Authorization
The gateway packages the request, including the amount, the currency and the card details, and sends it through the processor and acquirer to the card network. The network passes it to your issuing bank.
The issuer then decides, usually within a moment, whether to approve. It typically considers whether the account is open, whether there is enough available balance or credit, whether the card details match, and whether the transaction looks unusual compared with your normal pattern. It may also run its own fraud checks, which is where the kind of alerts described in the article on fraud alerts can start.
The answer travels back along the same route: approved, declined, or “needs more verification.” An approval at this stage generally places a hold on the funds. It does not yet move the money.
Step 3: Extra verification
Some payments ask you to prove it is really you. In many regions this takes the form of a second step, such as a code sent to your phone or a confirmation inside your banking app. The common name for the widely used card-payment version is 3-D Secure. Whether a payment triggers it depends on the bank, the amount, the region and local rules.
This is related to, but separate from, the sign-in security covered under two-factor authentication. One protects an account login; the other confirms a particular payment.
Step 4: Clearing and settlement
After authorization, the actual movement of money happens later, in batches. Many merchants submit their approved transactions to the acquirer at the end of the day, or when an order ships. The card network then sorts out which bank owes which, a step usually called clearing. The issuer sends the funds, and the acquirer pays the merchant, normally after deducting fees. This final step is settlement.
How long it takes for a merchant to see the money varies. It is often a matter of a few business days, but it depends on the provider, the country and the type of payment. That delay is one reason a charge can appear as “pending” on your statement before it becomes final.
Who pays the fees
Each party in the chain typically takes a small cut, and these charges are usually bundled into one fee the merchant pays. Customers rarely see them directly, though some shops add surcharges or price in the cost. Exact rates differ widely and are not something to guess at, so check a provider’s published terms if you run a shop.
When something goes wrong
Because payments are authorized and settled through a chain of regulated parties, there are procedures for disputes. If you did not receive what you paid for, or a charge is not yours, the usual route is to contact your issuer, which may open a dispute (often called a chargeback) and ask the merchant’s side for evidence. Protections differ between cards, bank transfers and other methods, and between countries, so it is worth finding out what your own card or account offers before you need it.
Other payment methods rearrange this chain:
- Phone-based payments. The mobile wallets approach replaces your real card number with a stand-in and adds device unlocking.
- Disposable numbers. Virtual card numbers limit what a shop ever sees.
- Direct person-to-person transfers. Payment apps often move money between accounts without the card network’s dispute process, which is why those transfers can be hard to undo.
- Instalments. Buy now pay later services insert a lender between you and the merchant.
- Repeat charges. Subscription billing relies on stored credentials that the merchant can use again.
Where the real risks are
Most of the technology in the chain is encrypted and well tested. The weak points are often human or at the edges. Phishing scams try to collect card details or one-time codes directly from you. Lookalike domains imitate a genuine checkout. A data breach at a merchant can expose stored details, even when the payment network itself was not attacked.
Sensible habits follow from the map above: check that you are on the genuine site before paying, treat any request for a verification code with suspicion, review your statements periodically, and use the protections your bank offers. No tool removes risk entirely, but knowing who handles what makes the signs of trouble easier to spot.