What happens when you swipe, tap, or enter your card number

When you hand over your card or enter the number online, the merchant's payment terminal or website captures your card data and sends it to their bank—called the acquiring bank. That bank doesn't hold your money. Instead, it forwards your card details to a payment processor, a company that specializes in moving card data securely between banks. The processor checks that your card number is real and hasn't been reported stolen, then sends the request to your bank—the issuing bank—which decides whether to approve or decline based on your available balance and fraud patterns.

If your bank approves the charge, the issuing bank tells the processor, the processor tells the merchant's bank, and the merchant's terminal shows "approved" in seconds. But the money doesn't move yet. What you see is authorization—permission to charge you. Settlement—the actual transfer of funds—happens later, usually overnight or within one to three business days.

Key Takeaways

  • Authorization (the approval you see at checkout) and settlement (when money actually moves) are two separate events that happen hours or days apart.
  • Your card data passes through at least four different entities—your bank, the merchant's bank, a payment processor, and often a payment gateway—each with its own security role.
  • The merchant's bank holds the money in a temporary account for one to three business days before depositing it into the merchant's actual business account.
  • Interchange fees, assessment fees, and processing fees are deducted from the merchant's deposit before they receive their money, which is why receipts sometimes show a different total than what the merchant actually gets.

The four parties involved and what each one does

Your bank—the issuing bank—is the entity that issued your card and holds your account. When a charge comes through, your bank verifies that the card number is valid, that you haven't reported it stolen, and that you have enough available credit or funds. Your bank also watches for fraud patterns: a charge in another country minutes after a local charge, or a purchase that doesn't match your spending history, might trigger a decline even if you have the money.

The merchant's bank—the acquiring bank—is the business account holder for the store or website you're buying from. This bank doesn't know you and doesn't verify your identity. Its job is to receive the authorization request from the merchant, forward it to the payment processor, and later hold the settlement funds before moving them to the merchant's account.

The payment processor is the middleman that moves data between banks securely. It doesn't hold money and doesn't make approval decisions. It encrypts your card data, routes it to the right issuing bank based on your card's network (Visa, Mastercard, Discover, American Express), and relays the approval or decline back to the merchant. Large processors like First Data, Fiserv, or Worldpay handle millions of transactions daily.

The payment gateway is the software layer between the merchant's website or terminal and the processor. If you're shopping online, the gateway is what encrypts your card number before it leaves your browser. If you're in a store, the terminal itself is the gateway. The gateway never stores your full card number; it passes it securely to the processor and receives back only an approval code.

Authorization versus settlement: why the timing matters

Authorization happens in real time or within seconds. Your bank says yes or no, the merchant sees the result, and you walk out with your purchase or the website confirms your order. At this moment, your available balance drops—your bank reserves the money so you can't spend it twice—but the merchant doesn't have the cash yet.

Settlement is the actual movement of funds and takes longer because it involves batch processing. At the end of each business day, the merchant's acquiring bank collects all the day's approved transactions into a batch file and sends it to the payment processor. The processor sorts transactions by issuing bank and sends each bank a file of all the charges its customers made that day. Each issuing bank then moves money from customer accounts to a settlement account at the acquiring bank. This whole cycle usually completes within one to three business days, depending on the banks and the payment network involved.

This gap matters if you dispute a charge. During authorization, the merchant can still cancel the transaction and release the hold on your account. After settlement, the money has moved to the merchant's account, and you'll need to dispute it through your bank's chargeback process instead, which takes longer and has stricter rules about what qualifies.

Fees that come out before the merchant gets paid

When the merchant's acquiring bank deposits the settlement funds into the merchant's business account, the amount is less than what customers paid. Three types of fees are deducted first.

Interchange fees go to your issuing bank and are set by the card network (Visa, Mastercard, etc.). They typically range from 1.5% to 3.5% of the transaction, depending on the card type and merchant category. A rewards credit card usually has a higher interchange fee than a basic debit card. The merchant never negotiates this fee—it's set by the network and the same for all merchants in that category.

Assessment fees are paid to the card network itself (Visa, Mastercard, Discover, Amex) and are usually 0.1% to 0.3% of the transaction. These are also non-negotiable and set by the network.

Processing fees go to the payment processor and are negotiated between the processor and the merchant. These might be a flat per-transaction fee (like $0.30 per transaction), a percentage of the sale (like 2.2%), or a combination. Larger merchants negotiate lower rates; small merchants often pay higher percentages.

A $100 purchase might result in the merchant receiving $95 to $97 after all three fee types are deducted. The customer paid $100, but the merchant's account shows a deposit of $95 to $97.

What happens if the transaction is declined

If your issuing bank declines the charge, the authorization stops there. The merchant's terminal shows "declined," no hold is placed on your account, and no money moves. The merchant can ask you for a different card or payment method, but the transaction never reaches settlement.

Common reasons for decline include insufficient funds, a card reported stolen, a mismatch between the billing address you entered and the address on file with your bank, or a fraud alert your bank triggered. If you believe the decline was an error, you can contact your bank to ask why, but the merchant cannot override your bank's decision.

If a transaction is declined but you see a temporary hold on your account anyway, that's an authorization hold that your bank will release within one to five business days. The merchant never received approval, so no settlement will occur—the hold is just your bank's way of reserving funds while it processes the request.

How chargebacks work when something goes wrong

If you dispute a charge after settlement has occurred—the money has already moved to the merchant's account—you file a chargeback through your issuing bank. You tell your bank the charge was unauthorized, the merchant didn't deliver the goods, or the amount was wrong. Your bank then reverses the charge, pulling the money back from the merchant's acquiring bank and returning it to your account.

The merchant has the right to respond to the chargeback with evidence that the transaction was legitimate: a signed receipt, proof of delivery, email confirmation from you, or documentation that you received the goods. If the merchant provides strong evidence, your bank may side with the merchant and re-charge your account. If the merchant doesn't respond or their evidence is weak, the chargeback stands and the merchant loses the money.

Chargebacks take 30 to 90 days to resolve, depending on the card network and the banks involved. During this time, the money is held in dispute and neither you nor the merchant has access to it. If you file too many chargebacks, your bank may close your account or flag you as a high-risk customer.

Fraud prevention at each step

Your issuing bank uses fraud detection to watch for unusual patterns: a charge in a different country within hours of a local charge, a purchase far larger than your typical spending, or a charge at a merchant category you've never used before. If the pattern looks suspicious, your bank declines the charge or calls you to verify.

The payment processor uses tokenization to protect your card number. Instead of passing your actual card number through the system, the processor assigns a token—a random string of characters—that represents your card. The merchant and the processor see only the token, not your real number. If a merchant's system is hacked, the thief gets tokens, not card numbers, which are useless without the processor's decryption key.

The payment gateway encrypts your card data before it leaves your device. If you're entering your card on a website, the gateway uses SSL encryption (the "https" in the web address) to scramble the number so that even if someone intercepts the data in transit, they can't read it.

The merchant is required to comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules about how to store and handle card data. Merchants are not supposed to store full card numbers at all; they should store only the last four digits and an expiration date. If a merchant violates PCI rules and gets hacked, they face fines from the card networks and potential liability to customers.

Frequently Asked Questions

Why does my bank show a hold on my account but the merchant says the charge didn't go through?

Authorization and settlement are separate. Your bank placed a hold when it approved the charge, but the merchant's system may have failed to complete the settlement, or the merchant may have manually voided the transaction. The hold should release within one to five business days. If it doesn't, contact your bank to ask them to release it manually.

Can a merchant charge my card twice for the same purchase?

It can happen by accident if a customer hits submit twice or if the merchant's terminal glitches and processes the same transaction twice. It's not supposed to happen because the processor assigns each transaction a unique ID and the merchant's system should reject duplicate IDs. If you're charged twice, contact the merchant first—they can usually void the duplicate charge within 24 hours. If they don't, dispute it through your bank.

What's the difference between a credit card and a debit card from the processor's perspective?

From the processor's view, both work the same way: the data is routed to a bank, the bank approves or declines, and settlement happens the same day or the next day. The main difference is that a credit card charge goes against your credit line (and your issuing bank pays the merchant), while a debit card charge comes directly from your bank account. Debit cards usually have lower interchange fees and less fraud protection than credit cards.

Why do some online purchases take longer to settle than others?

Authorization is fast, but settlement depends on the merchant's acquiring bank and the issuing bank's processing schedules. Most settle within one to three business days, but some merchants batch their transactions less frequently, or some banks process batches on different schedules. Weekends and holidays also delay settlement because banks don't process batches on non-business days.

If I use a payment app like PayPal or Venmo, does my card go through the same process?

Yes, but with an extra step. When you link your card to PayPal or Venmo, those apps act as an intermediary. Your card data goes to PayPal's or Venmo's processor first, then to your bank for authorization. Settlement still happens through the normal banking channels, but PayPal or Venmo may hold the funds temporarily before moving them to the recipient's account.