Articles on Online payments
How a card payment works on the web: checkout, authorisation, settlement, wallets, and payment methods.
20 articles
Card routing modernization, UK open banking architecture, and ECB consumer expectations
Bank Pekao upgrades its card infrastructure with NCR Atleos, while UK open banking faces credit crunch debates and the ECB releases consumer data.
Apple Pay and Google Pay without the marketing: network tokens and fraud reduction
Far from simple digital wallets, Apple Pay and Google Pay rely on network tokens and dynamic cryptograms. We examine their technical mechanics and fraud impact.
What changes with PSD3 and the PSR: spoofing fraud, refunds, and transparency
The EU's updated payment framework splits its rules between a directive and a directly applicable regulation. Here is what it means for merchants, gateways, and consumers dealing with social engineering fraud.
Card tokenization: what a token is, who stores it, and why your database should never see a PAN
Understand how tokenization works in modern e-commerce, the key differences between gateway and network tokens, and why card numbers should never touch your servers.
Personal data in payments: what GDPR says about emails, addresses, and purchase history
GDPR requires limiting data collection to the minimum necessary, but tax laws and fraud prevention mandate retaining transaction records. We analyse which legal bases justify each data point and for how long.
Bizum, card, or bank transfer: which method to offer and what each one costs
We analyse the operational differences, processing fees, fraud risks, and settlement times of cards, Bizum, and bank transfers for an online store in Spain.
Strong customer authentication (SCA) and 3D Secure: requirements, exemptions, and conversion
Strong customer authentication curbs card fraud but introduces checkout friction. We examine when the mandate applies, available exemptions, and how to protect conversion.
Flat rate or interchange++: which payment gateway pricing model is cheaper for your sales
Choosing between a flat rate and interchange++ determines whether you overpay on transaction fees. We examine how card types and European regulations shape the final cost.
Payment links: when they replace an online store and how to collect via direct channels
Payment links allow businesses to collect quotes and direct sales through WhatsApp or email without a web store, keeping full SCA and security standards.
Simplified vs full invoice in online sales: legal thresholds and required data
Knowing when an online store can issue a simplified invoice and when it must collect full fiscal details is essential for conversion and tax compliance. We examine Spanish regulations and their technical impact on the checkout flow.
What is an entitlement and why access permissions should live on your server, not the device
Decoupling commercial purchases from actual usage rights prevents local tampering, simplifies multiplatform logic, and protects application revenue.
Idempotency in payments: how to avoid double charges from retries and duplicate webhooks
Network hiccups or duplicate webhooks can trigger duplicate charges if systems lack idempotency protections. We review the mechanics and database patterns to prevent repeated billing.
Digital goods, physical goods, and external links: charging inside and outside mobile apps
The boundary between what must be processed via in-app purchases and what can be steered to the web causes ongoing technical and regulatory friction. We analyze Apple and Google rules in Europe and the true cost of each route.
Preauthorisations and deferred captures: how to hold an amount and charge it later without surprises
Separating card authorisation from final settlement is a standard practice in e-commerce. We analyse how preauthorisation works, validity windows, and how to avoid operational friction.
Risk rules at checkout: velocity, geolocation, and smart authentication
Configuring effective risk filters in the payment gateway prevents fraud without hurting conversion. We examine how to assess velocity, IP, and issuing country to decide when to require 3D Secure.
pci dss for online sellers: saq a, data you should never store, and the payment gateway's role
The Payment Card Industry Data Security Standard (PCI DSS) is crucial for any business handling card payments. This article details what SAQ A compliance means for online sellers, which sensitive data should never be stored, and how a payment gateway facilitates compliance.
how a card payment works on a website: phases and failure points
An online card payment is not an instant transaction, but a complex sequence of steps. From the moment a customer enters their data until the funds reach the merchant, multiple actors are involved. Understanding these phases is crucial for optimizing operations and minimizing incidents.
Payment security: what you must never store, and why webhooks are signed
Most online payment incidents don't come from a sophisticated attack, but from two design decisions: storing card data you never needed, and trusting whatever the customer's browser says.
In-app payments: what the store takes, and when you can charge outside it
App Store and Google Play commissions don't apply to everything you sell from an app. The dividing line is what kind of product you deliver, and knowing where your case falls decides whether you pay 15%, 30%, or your own gateway's fee.
What actually happens inside an online card payment
Between the customer pressing "pay" and the money reaching your account, three separate things happen: authorisation, capture, and settlement. Knowing where each one occurs explains why a payment can show as "approved" and still not be charged.