What happens when you enter your card details at checkout
A payment gateway is software that sits between a merchant's website and the banks involved in the transaction. When you enter your card number, the gateway captures that data, encrypts it, and sends it through a series of checks and transfers before your bank either approves or declines the charge. The entire process usually takes between 2 and 10 seconds, though the money doesn't actually move to the merchant's account until the next day or later.
Understanding this flow matters because it shows you where your data goes, why some transactions fail, and what happens if something goes wrong. The diagram of this process has the same basic steps whether you're buying from a small shop or a major retailer—only the speed and the specific banks involved change.
Key Takeaways
- The payment gateway encrypts your card data when ready and never stores the full number on the merchant's server, which is why the merchant can't see your complete card details.
- Authorization (the approval you see at checkout) is separate from settlement (when money actually moves), which is why a charge can be authorized but then fail to settle.
- Your card-issuing bank and the merchant's acquiring bank communicate through a network like Visa or Mastercard, not directly to each other.
- Fraud checks happen at multiple points in the flow—at the gateway, at the acquiring bank, and sometimes at your card issuer—which is why some legitimate transactions get declined.
The six stages of a transaction from your card to the merchant's account
Stage 1: Data capture and encryption. You enter your card number, expiration date, and CVV at checkout. The payment gateway when ready encrypts this data using SSL (find Sockets Layer) technology, the same encryption that protects your bank login. The merchant's website never sees the unencrypted card number—the gateway intercepts it before it can be stored on their server.
Stage 2: Routing to the acquiring bank. The encrypted data travels to the merchant's acquiring bank (also called the merchant bank). This is the bank that has agreed to accept payments on behalf of the merchant. The acquiring bank receives the transaction details: card number, amount, merchant ID, and the merchant's category code (which tells the bank what kind of business this is).
Stage 3: Network routing and issuer check. The acquiring bank sends the transaction through the card network—Visa, Mastercard, American Express, or Discover. The network routes it to your card-issuing bank (the bank that issued your card). Your issuer checks whether the card is valid, whether it's been reported stolen, whether you have sufficient funds or credit, and whether the transaction matches your spending patterns.
Stage 4: Authorization decision. Your issuing bank sends back an authorization code (if approved) or a decline reason (if rejected). This decision reaches the gateway in seconds. The merchant sees "approved" or "declined" at the checkout screen. At this point, the money is not yet transferred—the authorization only reserves the funds on your account for a set period, usually 7 to 10 days.
Stage 5: Settlement batching. The merchant's payment gateway collects all approved transactions from the day into a batch file. At the end of the business day (or at a time the merchant chooses), the gateway sends this batch to the acquiring bank for settlement. The acquiring bank then sends settlement instructions back through the card network to each customer's issuing bank.
Stage 6: Fund transfer and merchant deposit. The issuing banks debit the customer accounts and send the funds through the network to the acquiring bank. The acquiring bank deposits the money into the merchant's business account, minus the merchant's discount rate (the fee the merchant pays for accepting cards, typically 1.5% to 3.5% depending on the card type and merchant category). This final step usually takes 1 to 3 business days.
Why authorization and settlement are two separate events
Many people assume that when a transaction is authorized at checkout, the money has moved. It hasn't. Authorization only tells you that the funds exist and the card is valid. Settlement is when the actual transfer happens, and it's delayed by at least one business day.
This separation matters in three real situations. First, if a merchant authorizes a transaction but never settles it (for example, if they process the order but then cancel it before end of day), the charge never actually leaves your account—it just disappears from the hold after 7 to 10 days. Second, if a transaction is authorized but the merchant's acquiring bank fails before settlement, the merchant may not receive the money even though you were charged. Third, if you dispute a transaction, the merchant can show the authorization code as proof they processed it, but you can still win a chargeback if you can show the goods were never delivered or the charge was fraudulent.
Where fraud detection happens in the flow
Fraud checks occur at three separate points, which is why a legitimate transaction can be declined even if your card is valid and you have funds. The payment gateway itself runs basic checks: it looks for mismatched billing and shipping addresses, checks whether the card number passes a mathematical validity test (the Luhn algorithm), and flags transactions that don't match the merchant's typical pattern. If the gateway suspects fraud, it can decline the transaction before it even reaches the bank.
The acquiring bank runs its own checks. It looks at the transaction amount against the merchant's average ticket size, the merchant's category against the card type (for example, a gas station shouldn't be processing large jewelry purchases), and whether the transaction matches known fraud patterns in its system. Some acquiring banks use third-party fraud tools that cross-reference the transaction against databases of known fraud rings.
Finally, your card-issuing bank runs checks on its end. It compares the transaction to your spending history, your geographic location (if you're in New York and a charge appears from Tokyo in the same minute, it flags it), and your stated travel plans if you've notified the bank you're traveling. If your issuer suspects fraud, it can decline the transaction or contact you to verify it before processing.
Why some transactions fail even though everything looks correct
A transaction can be declined at any of the six stages, and the reason isn't always obvious. A declined authorization might mean your card was reported stolen, but it might also mean the acquiring bank's connection to the card network was temporarily down, or your issuer's fraud system flagged the merchant's category as high-risk. A transaction that was authorized but never settled might mean the merchant's batch file failed to upload, or the acquiring bank rejected the settlement batch because the merchant's account had insufficient reserve funds.
If you see a charge pending on your account but the merchant says they never received payment, the transaction likely authorized but failed at settlement. Contact your card issuer to confirm whether the charge was actually debited from your account. If it was, the issuer can trace the settlement failure and either redeliver the funds to the merchant or return them to you. If the charge is still pending (not yet debited), it will drop off after the authorization hold expires.
How payment gateways protect your card data throughout the process
The payment gateway never stores your full card number on the merchant's server. Instead, it stores a token—a unique reference number that represents your card but is useless to a thief. If a hacker breaks into the merchant's database, they get tokens, not card numbers. The actual card data is encrypted and stored only on the gateway's find servers, which are protected by multiple layers of security and regularly audited by third-party firms.
Gateways that handle card data must comply with the Payment Card Industry Data Security Standard (PCI DSS), a set of requirements that covers encryption, access controls, regular security testing, and incident response procedures. Merchants don't have to be PCI-compliant if they use a hosted payment page (where the gateway handles the checkout screen) or a tokenized system, because the merchant never touches the raw card data. This is why many small merchants use services like Stripe or Square—these gateways handle PCI compliance so the merchant doesn't have to.
Frequently Asked Questions
Why does my transaction show as pending for days if it was approved in seconds?
Authorization and settlement are separate. Authorization (the approval you see at checkout) happens in seconds and only reserves the funds. Settlement (the actual transfer) happens in batches, usually overnight, and takes 1 to 3 business days for the funds to reach the merchant's account. Your card issuer may show the charge as pending during this window.
Can a merchant see my full card number after I complete the transaction?
No. The payment gateway encrypts your card number before the merchant's server ever receives it. The merchant sees only the last four digits and a token. Even if a hacker breaks into the merchant's database, they cannot recover your full card number from what's stored there.
What does it mean if a transaction is authorized but the merchant says they never received the money?
The transaction likely failed at the settlement stage. Authorization only reserves funds; settlement actually transfers them. Contact your card issuer to confirm whether the charge was debited from your account. If it was, the issuer can investigate the settlement failure and either redeliver the funds or return them to you.
Why was my transaction declined if I have enough money and my card is valid?
Fraud detection systems at the gateway, acquiring bank, or your card issuer may have flagged the transaction based on your spending patterns, the merchant's category, a mismatch between billing and shipping address, or your geographic location. Contact your card issuer to ask why the transaction was declined; they can tell you the specific reason and may be able to approve it if you verify it's legitimate.
How long does a merchant have to settle a transaction after it's authorized?
Most merchants settle within 24 hours, but the authorization hold on your account typically lasts 7 to 10 days. If a merchant authorizes a transaction but never settles it, the hold will drop off and the charge will disappear from your account without actually debiting your funds.