how a card payment works on a website: phases and failure points

From click to cash: the sequence of an online card payment

When a customer makes an online purchase using their bank card, the transaction that seems immediate is actually a complex orchestration of processes and actors. This flow, typically occurring in a matter of seconds, involves the buyer, the merchant, the payment gateway, the acquiring bank (the merchant's bank), the card networks (Visa, Mastercard, etc.), and the issuing bank (the customer's bank). Understanding each stage – authorization, capture, and settlement – as well as their potential failure points, is fundamental for any online business looking to optimize its payment process and offer a seamless experience.

Phase 1: Authorization

Authorization is the first step, and its purpose is to verify that the card is valid and that the cardholder has sufficient funds or credit for the purchase. It's a kind of "reservation" of the amount in the customer's account.

How it works:

1. Transaction initiation: The customer enters their card details (number, expiry date, CVV) into the merchant's payment form (`checkout`).

2. Submission to the gateway: The merchant's payment gateway encrypts this data and sends it to the acquiring bank. At this point, implementing security in card data handling is critical to prevent leaks.

3. Route to the network: The acquiring bank forwards the authorization request to the corresponding card network (e.g., Visa or Mastercard).

4. Inquiry to the issuing bank: The card network directs the request to the customer's issuing bank.

5. Verification and SCA: The issuing bank checks the card's validity, if it's active, if funds or credit are available, and if the transaction complies with Strong Customer Authentication (SCA) requirements, often via `3D Secure` in Europe.

6. Response: The issuing bank returns an approval or denial response through the same chain until it reaches the merchant, who then informs the customer.

Failure points in authorization:

* Incorrect data: The customer enters a wrong card number, an incorrect expiry date, or an invalid CVV.

* Insufficient funds: The customer's account does not have enough balance or credit.

* Invalid card: The card is expired, blocked, reported as stolen/lost, or not activated for online purchases.

* Suspicion of fraud: The risk systems of the issuing bank or card network detect anomalous patterns or transactions that deviate from the customer's usual behavior.

* Authentication failure: If SCA is required and the customer does not complete the challenge (e.g., incorrectly enters a code sent to their mobile) or the `3D Secure` system fails.

* Bank limits: The issuing bank may have daily or per-transaction limits that the purchase exceeds.

* Technical issues: Momentary communication failures between any of the involved actors.

Phase 2: Capture

Once the transaction is authorized, capture is the step that indicates the merchant wishes to proceed with the actual charge. The initial authorization is only a hold on funds; capture converts that hold into a movement of money.

How it works:

1. Capture request: The merchant, through their payment gateway, requests the capture of the authorized amount. This can be done automatically immediately after authorization, or manually (known as "delayed capture" or "pre-authorization") if the merchant needs to prepare shipping or verify stock availability before charging. Authorizations usually have a limited validity, often 7 days, after which they expire.

2. Processing: The payment gateway sends the request to the acquiring bank, which in turn communicates it to the card network and, finally, to the issuing bank.

3. Debit confirmation: The issuing bank processes the debit from the customer's account for the captured amount.

Failure points in capture:

* Expired authorization: The merchant attempts to capture funds after the authorization's validity period has expired.

* Different amount: The capture amount differs from the authorized amount. If a higher amount is attempted, the transaction will be denied. It is possible to capture a smaller amount (partial capture).

* Order cancellation: The customer or merchant cancels the order before capture is performed.

* Technical issues: Interruptions in communication between the various systems.

Phase 3: Settlement

Settlement is the final process where funds are effectively moved from the customer's account to the merchant's bank account. It is the culmination of the transaction.

How it works:

1. Network clearing: At the end of the day, card networks gather all captured transactions from their acquiring and issuing banks. They perform a "netting" process, where they calculate which issuing banks must pay which acquiring banks.

2. Interbank transfer: The network facilitates the transfer of the net funds between banks.

3. Deposit to the merchant: Once the acquiring bank receives the funds from the network, it proceeds to deposit them into the merchant's bank account, deducting agreed-upon fees with the gateway and acquirer. Timelines vary but are typically 1 to 3 business days (`T+1` to `T+3`).

Failure points in settlement:

* `Chargebacks`: The customer disputes a transaction directly with their issuing bank. This can occur for multiple reasons (fraud, product not received, defective product, etc.) and can result in the reversal of already settled funds or the withholding of future payments. Effective management of these chargebacks is vital for business sustainability and is a key aspect of online payment security.

* Reconciliation issues: Discrepancies between the merchant's records and the payment gateway's or acquiring bank's reports, making it difficult to correctly attribute revenue.

* Fund holds: The acquiring bank or payment gateway may hold a portion of the merchant's funds as a reserve for risk (for example, if the chargeback volume is high or there's a history of suspicious activity).

* Banking errors: Although less frequent, errors can occur in bank transfer or deposit processes.

Practical conclusion

Understanding the mechanics of authorization, capture, and settlement is not just a technical matter; it is a strategic advantage for any online merchant. It allows identifying bottlenecks, optimizing payment gateway configuration, improving the customer experience in the face of potential denials, and proactively managing the risks associated with chargebacks. Proper configuration and monitoring of this process can directly impact the conversion rate and the financial health of the business. Choosing a good payment gateway that offers transparency and management tools is fundamental to simplifying these operations and focusing on what truly matters. To understand how the fees for these services are structured, you can consult our pricing section.