What happens when you enter your card details online
When you buy something online and enter your card number, that information does not go directly to the merchant's bank. Instead, it travels through a chain of companies, each with a specific job: your bank verifies you have the money, the merchant's bank receives it, and a processor in the middle makes sure both sides follow the rules. The whole chain takes seconds, but each step has a reason.
Your card details are encrypted the moment you type them—scrambled into code that only the intended recipient can read. This happens before the information leaves your computer. The merchant never actually sees your full card number; they see a token, which is a stand-in code that lets them process the charge without storing the real number.
The merchant's payment processor is the company that handles the technical side. They receive the encrypted information, route it to the right bank, wait for approval, and send back a yes or no. Common processors include Stripe, Square, PayPal, and Authorize.net, though there are hundreds more. The processor also handles disputes later if something goes wrong.
Key Takeaways
- Your card information is encrypted before it leaves your device and is replaced with a token so the merchant never sees your actual number.
- A payment processor acts as the middleman between your bank, the merchant's bank, and the merchant itself, handling the technical routing and security checks.
- Your bank checks whether you have sufficient funds and whether the transaction matches your normal spending patterns before approving the charge.
- The merchant's bank receives the funds, usually within one to three business days, though the charge appears on your statement when ready.
- If a transaction fails, the processor tells you why—insufficient funds, incorrect address, card expired, or fraud detection—so you know what to fix.
The role of your bank and the merchant's bank
Your bank (the issuing bank) is the one that issued your card. When a charge comes through, they check three things: Do you have enough money? Does this transaction look like something you would do? Is the card still active? If all three answers are yes, they approve it. If they see something unusual—a purchase in another country, an amount much larger than normal, or a merchant type you never use—they might decline it or ask you to confirm.
The merchant's bank (the acquiring bank) is different. They hold the merchant's account and receive the money from your bank. They take a small cut called the interchange fee, which varies by card type and merchant category. A grocery store pays a different rate than a gas station, and a credit card transaction costs more than a debit card one. The acquiring bank passes most of that fee to the processor and the merchant's payment processor.
The two banks do not talk to each other directly. The processor sits between them and translates. Your bank sends approval or denial to the processor, the processor tells the merchant, and the processor also tells the acquiring bank to expect the money. This separation exists for security and regulation—each bank is responsible only for its own customer.
How the processor decides whether to approve or decline
The payment processor runs your transaction through a fraud detection system before it even reaches your bank. This system looks for patterns: Is the card number valid? Does the billing address match what the card issuer has on file? Is the card expired? Is the amount reasonable? If something fails these checks, the processor declines the transaction when ready and tells the merchant why.
If the processor's checks pass, the request goes to your issuing bank. Your bank runs its own checks, which are more detailed because they know your account history. They see whether you have the funds, whether this merchant type is normal for you, and whether you have recently reported the card lost or stolen. They send back an approval code or a decline reason.
Common decline reasons include insufficient funds, incorrect CVV (the three-digit security code on the back), address mismatch, card expired, or fraud detection triggered. Some declines are temporary—your bank might decline a charge and then approve it after you call to confirm. Others are permanent until you fix the underlying problem, like updating an expired card.
When the money actually moves and where it sits
The charge appears on your statement almost when ready, but the actual money does not move right away. Your bank deducts the amount from your available balance when ready to prevent you from spending it twice, but the funds do not leave your account for one to three business days. This delay is called the settlement period.
During settlement, the processor batches all the day's transactions together and sends them to the acquiring bank in one large file. The acquiring bank then moves money from a clearing account (a temporary holding place) into the merchant's actual business account. If the merchant uses a third-party processor like Stripe, that processor takes their cut first, then passes the remainder to the merchant.
If you dispute a charge during this window, the processor can sometimes stop the transfer before it completes. If settlement has already happened, the money goes back through the same chain in reverse—the merchant's bank pulls it from the merchant's account, sends it back through the processor, and your bank credits it to you. This reversal is called a chargeback and takes another few business days.
What happens when a transaction fails
When a charge is declined, the merchant sees a specific code that tells them why. Common codes include "insufficient funds," "card expired," "incorrect CVV," "address mismatch," or "fraud detection." The merchant's system usually displays a message to you with the reason, though not always in plain language.
If the decline was your bank's decision (fraud detection, for example), you can call your bank to confirm the transaction and ask them to approve it. If the decline was the processor's decision (invalid card number, expired card), you need to fix the card information and try again. If the decline was the merchant's decision (they do not accept your card type), you need to use a different payment method.
Some merchants offer a retry option if a charge fails. Do not assume the charge went through just because you did not see an error message—check your statement. A failed transaction should not appear at all, but sometimes a hold appears and then disappears after a few days.
The difference between credit cards, debit cards, and digital wallets
Credit cards and debit cards follow the same processing path, but the money comes from different places. With a credit card, your bank is lending you the money and you pay them back later. With a debit card, the money comes directly from your checking account. The processor does not care which one you use—the technical steps are identical.
Digital wallets like Apple Pay, Google Pay, and PayPal add one more layer. Instead of sending your actual card number, the wallet sends a token that represents your card. This token is unique to that wallet and that merchant, so even if a hacker steals it, they cannot use it anywhere else. The token goes through the same processor and bank chain as a regular card number would.
Bank transfers and ACH payments (automated clearing house) are slower but cheaper. Instead of going through a processor in seconds, they batch overnight and settle the next business day. Merchants use these for recurring charges like subscriptions because the lower cost makes sense for small, repeated amounts.
Fees and who pays them
Every online transaction has costs, and they are split among the processor, the acquiring bank, and sometimes the merchant. The interchange fee is the largest piece—it goes to your bank for approving the transaction. This fee varies: credit cards cost more than debit cards, and some merchant categories pay higher rates than others.
The processor takes a separate fee, usually a percentage of the transaction plus a flat amount per charge. A typical rate might be 2.9% plus $0.30 for a credit card transaction. The acquiring bank also takes a cut. Together, these fees usually total between 2% and 3% of the transaction for a standard credit card.
The merchant pays all these fees, not you. They build the cost into their prices. Some merchants offer a discount if you pay with cash or debit instead of credit, because those transactions cost them less. A few merchants pass the fee to you as a surcharge, though this is less common and some states restrict it.
What protections exist if something goes wrong
If a charge appears on your statement that you did not make, you have the right to dispute it. With a credit card, your bank must investigate within 30 days and give you a temporary credit while they look into it. With a debit card, the timeline is shorter—10 days to investigate—and you may not get a temporary credit, though federal law requires your bank to return the money if fraud is confirmed.
The processor and merchant's bank are also involved in disputes. The merchant gets a chance to respond with proof that you authorized the charge—a receipt, an email confirmation, or a signature. If the merchant cannot prove it, your bank credits you and the merchant loses the money. If the merchant can prove it, you lose the dispute and owe the charge.
Chargebacks are not free. If you dispute a charge and lose, the merchant can charge you a chargeback fee, usually $15 to $100. If you dispute too many charges, your bank may close your account. Use disputes only for genuine fraud or merchant error, not for buyer's remorse.
Frequently Asked Questions
Why does my charge show as pending for days after I made the purchase?
The charge appears on your statement when ready, but the merchant's bank does not receive the actual money for one to three business days. During this settlement period, the transaction is pending. Your available balance is reduced, but the money has not left your account yet. If you dispute the charge during this window, it can sometimes be stopped before settlement completes.
Can a merchant see my full card number when I pay online?
No. Your card number is encrypted and replaced with a token before the merchant ever sees it. The merchant's payment processor handles the encrypted information, not the merchant themselves. This is why merchants cannot steal your card number even if their website is hacked—they never had it in the first place.
What does it mean when a transaction is declined for "fraud detection"?
Either your bank or the processor's system flagged the transaction as unusual. This might happen if you are in a different country, the amount is much larger than normal, or the merchant type is new for you. Call your bank to confirm the charge is legitimate, and they can approve it. Future transactions from that merchant may go through without delay.
How long does a refund take after I dispute a charge?
If your bank confirms fraud, a credit card refund usually appears within 5 to 10 business days. A debit card refund can take longer—up to 10 business days for the investigation, then another few days for the money to post. If the merchant voluntarily refunds you instead of fighting the dispute, the timeline depends on their processor and bank, but typically takes 3 to 5 business days.
Why do some online stores ask for my billing address if they already have my card number?
The billing address is a security check called Address Verification Service (AVS). The processor compares the address you enter with the address your bank has on file. If they match, it is a sign the person using the card is the actual cardholder. If they do not match, the transaction may be declined or flagged for manual review, even if the card number is correct.