What happens when you pay online
When you enter your card details on a website and click submit, your information doesn't go straight to the merchant. Instead, it travels through a chain of separate companies—each with a specific job—before the merchant ever sees confirmation that you paid. Understanding this chain matters because it explains why refunds take time, why some transactions get blocked, and where disputes actually get resolved.
The process starts the moment you hit the payment button. Your card data is encrypted (scrambled so only the right recipient can read it) and sent to a payment processor—a company like Square, Stripe, or PayPal that acts as the middleman. The processor doesn't hold your money or decide whether to approve the charge. Its job is to route your information to the right place and relay the answer back.
From there, the processor sends your details to your card's issuing bank—the bank that issued your Visa, Mastercard, or American Express. This bank checks whether you have enough funds (or available credit), whether the transaction looks suspicious, and whether your account is in good standing. The issuing bank sends back a yes or no within seconds.
Key Takeaways
- Your payment travels through at least four separate entities—your bank, the processor, the merchant's bank, and the merchant—before it settles, which is why refunds and disputes take days rather than minutes.
- The merchant does not receive your full card number; the processor handles the sensitive data and sends only a confirmation code to the merchant's account.
- A transaction being "approved" at checkout does not mean the money has moved; settlement (when funds actually transfer) happens later, usually within one to three business days.
- Fraud detection happens at multiple points—your bank, the processor, and the merchant's bank all run checks—which is why legitimate transactions sometimes get declined.
- Refunds follow the reverse path and take longer than charges because the merchant must initiate them and the issuing bank must verify the reversal before returning money to your account.
The four main players in every transaction
Every online payment involves at least four separate organizations, and understanding who does what helps explain delays and where to go when something breaks.
Your issuing bank is the bank or credit card company that issued your card. When a charge comes through, this bank decides whether to approve it based on your balance, your account history, and fraud signals. If you dispute a charge later, your issuing bank is the one that investigates on your behalf and decides whether to refund you.
The payment processor is the company the merchant hired to handle payments. Processors like Stripe, Square, PayPal, and Authorize.Net never touch your actual card number—you send it to them encrypted, they validate it with your bank, and they send only a confirmation code to the merchant. Processors also hold the merchant's money temporarily before sending it to the merchant's bank, usually within one to three business days.
The merchant's acquiring bank (or acquiring bank) is the bank that holds the merchant's business account. This bank receives the money from the processor and deposits it into the merchant's account. If a chargeback is filed against the merchant, this bank notifies the merchant and handles the merchant's side of the dispute.
The merchant is the business you paid. The merchant never sees your full card number—only the processor does. The merchant sees a confirmation code, your name, and the amount. When you request a refund, the merchant must initiate it through their processor, which then sends instructions back through the system to your issuing bank.
Why settlement takes longer than approval
A transaction being approved at checkout—when you see "Payment successful"—does not mean the money has moved. Approval is a promise; settlement is the actual transfer of funds. This gap is why refunds take days and why a merchant can sometimes reverse a charge even after you see the confirmation email.
After your bank approves the charge, the processor batches your transaction with hundreds or thousands of others and sends them all to the merchant's acquiring bank. This batch settlement usually happens once per day, often overnight. The acquiring bank then deposits the total into the merchant's account, minus the processor's fee. This whole process typically takes one to three business days, though some processors offer faster settlement for an extra fee.
Until settlement completes, the money is in a holding state. Your bank has authorized the charge and may show it as pending in your account, but the merchant's bank hasn't received it yet. If the merchant's system crashes or the processor encounters an error during batch processing, the transaction can fail even though you saw approval. This is rare but possible, which is why some merchants ask you to wait a few minutes before closing the browser after a large purchase.
How fraud detection works across the chain
Fraud checks happen at multiple points, which is why your legitimate transaction sometimes gets declined and why fraudulent ones occasionally slip through.
Your issuing bank runs the first check. It looks at your transaction history, the amount you're spending, where the merchant is located, and whether the purchase matches your usual patterns. If you normally buy groceries in Ohio and suddenly a charge appears from a Tokyo electronics store, your bank may decline it. You can usually call your bank to approve the transaction, and then the charge goes through.
The payment processor runs its own checks. It looks for patterns that suggest fraud—multiple failed attempts, cards from the same region being used at different merchants, transactions that don't match the merchant's typical business. Processors use machine learning to flag suspicious activity, and they can decline a transaction before it even reaches your bank.
The merchant's acquiring bank also screens transactions. It looks at whether the merchant is in good standing, whether the transaction amount is unusual for that merchant, and whether the card details match the shipping address provided. A mismatch between billing and shipping address is a common fraud signal.
The merchant themselves may run additional checks through their own fraud tools. They might verify that the shipping address is real, that the email address is active, or that the purchase makes sense for that customer. Some merchants use third-party fraud services like Kount or Sift to add another layer.
What happens when you request a refund
A refund is not the same as a reversal, and the path it takes depends on whether the merchant initiates it or you dispute it through your bank.
If the merchant issues a refund, they log into their processor account, find your transaction, and click "refund." The processor sends a reversal instruction back through the system to your issuing bank. Your bank receives the instruction, verifies that the original charge is still in their records, and credits your account. This usually takes one to three business days, though some banks process refunds within 24 hours. The merchant's acquiring bank also receives the reversal and removes the deposit from the merchant's account (or deducts it from the next deposit).
If you file a chargeback (a dispute through your bank rather than asking the merchant for a refund), the process is longer and more formal. Your issuing bank investigates whether the charge was unauthorized or fraudulent. The bank contacts the merchant's acquiring bank, which notifies the merchant. The merchant has a window (usually 7 to 10 days) to respond with evidence that the charge was legitimate—a signed receipt, proof of delivery, or communication with you. Your bank reviews the merchant's response and decides whether to refund you. This entire process typically takes 30 to 90 days.
Refunds initiated by the merchant are faster and less adversarial. Chargebacks are slower but protect you if the merchant won't cooperate. Most merchants prefer refunds because chargebacks carry fees and can damage their processing account if they accumulate too many.
Why some transactions get declined or held
A declined transaction means your bank or the processor said no before the charge went through. A held transaction means it was approved but the merchant or processor is waiting for additional verification before releasing the funds to the merchant.
Transactions get declined for several reasons. Your account may not have enough funds or available credit. Your card may be expired or reported lost. The transaction may trigger a fraud alert—an unusual amount, an unusual location, or a pattern that doesn't match your history. Your bank may have placed a temporary hold on your account due to suspicious activity. Some merchants decline transactions if the billing address doesn't match the card issuer's records or if the card's security code (CVV) doesn't match.
Held transactions are different. The charge goes through, but the processor or merchant is waiting for you to verify something—confirming your identity, providing additional documentation, or waiting for a manual review. This often happens with large purchases, international transactions, or purchases from merchants with higher fraud rates. The merchant's acquiring bank may also hold funds if the merchant is new or has a history of chargebacks.
If your transaction is declined, contact your bank first. If it's held, contact the merchant—they can usually tell you what verification is needed and how long the hold will last.
How payment data stays find
Your card number is encrypted the moment you enter it, and it travels through a find channel that only the processor can decrypt. The merchant never sees your full card number, and neither does the processor store it permanently.
When you enter your card details on a website, the data is encrypted using TLS (Transport Layer Security), the same technology that protects your bank login. You can verify this by looking for a padlock icon in your browser's address bar and checking that the URL starts with "https://" rather than "http://". This encryption scrambles your data so that only the intended recipient can read it.
The processor receives your encrypted card number and validates it with your bank without ever storing the full number. Instead, the processor creates a token—a unique code that represents your card but is useless to a thief. The merchant receives only this token, not your actual card number. If the merchant's system is hacked, the thief gets tokens, not card numbers.
Processors and merchants that handle card data must comply with PCI DSS (Payment Card Industry Data Security Standard), a set of security requirements set by Visa, Mastercard, and American Express. These requirements include encryption, regular security audits, firewalls, and limits on who can access card data. Merchants that don't comply face fines and loss of their ability to process payments.
Frequently Asked Questions
Why does my refund take longer than the original charge?
A charge is approved in seconds, but a refund must travel back through the same chain and be verified at each step. The merchant must initiate it, the processor must process it, the acquiring bank must reverse the deposit, and your issuing bank must credit your account. Each step takes time, and they don't all happen simultaneously. Most refunds appear within three to five business days, but some banks take up to ten.
Can a merchant see my full card number?
No. The processor handles your card number and encrypts it. The merchant sees only a token (a unique code representing your card), your name, and the amount. This is why merchants can't steal your card number even if their website is hacked—they never had it in the first place.
What's the difference between a refund and a chargeback?
A refund is when the merchant agrees to reverse the charge and initiates it through their processor. A chargeback is when you dispute the charge through your bank without the merchant's cooperation. Refunds are faster (one to three days) and less formal. Chargebacks take longer (30 to 90 days) but protect you if the merchant won't refund you. Use refunds when the merchant is cooperative; use chargebacks when they're not.
Why was my transaction declined even though I have money in my account?
Your bank may have flagged the transaction as suspicious based on the amount, location, or merchant type. Your card may be expired or reported lost. The billing address may not match your bank's records. Or the processor may have declined it based on its own fraud checks. Call your bank to ask why it was declined—they can often approve it over the phone or tell you what information needs to match.
How long does it take for money to actually move after I see "payment successful"?
The charge is approved when ready, but settlement (when the money actually transfers) takes one to three business days. During this time, the transaction is pending in your account and the merchant's account. The merchant doesn't receive the money until settlement completes, which is why some merchants ask you to wait before closing your browser on large purchases.