How Online Payments Actually Work: Behind the Scenes

The 2-Second Journey of a Payment

When a customer enters their card details and clicks "Pay," a complex chain of events happens in under two seconds. Understanding this flow helps you make better decisions about your payment stack and troubleshoot issues when they arise.

The Key Players

Every online payment involves at least five parties, each with a specific role.

The Cardholder

The customer making the purchase. They have a payment card issued by their bank.

The Merchant

That is you, the business accepting the payment. You have an account with a payment processor.

The Payment Processor

Stripe, PayPal, Adyen, or similar. They provide the technology layer that connects your checkout to the card networks. They handle tokenization, fraud checks, and communication with the rest of the chain.

The Card Network

Visa, Mastercard, American Express, or Discover. They operate the rails that route transactions between banks. They set the rules, interchange rates, and security standards.

The Issuing Bank

The cardholder's bank that issued their card. They approve or decline the transaction based on available funds, fraud signals, and card restrictions.

The Payment Flow Step by Step

Step 1: Tokenization

When the customer enters their card number, the payment processor converts it into a secure token. The actual card number never touches your server, which keeps you out of PCI scope.

Step 2: Authorization Request

Your processor sends the transaction details (amount, currency, merchant info) through the card network to the issuing bank. This is the authorization request.

Step 3: Fraud and Risk Checks

The issuing bank runs fraud checks: Is the card reported stolen? Is the transaction amount unusual? Does the location match the cardholder's profile? The processor may run its own checks too (Stripe Radar, for example).

Step 4: Approval or Decline

The issuing bank sends back a response: approved, declined, or "try again." Common decline reasons include insufficient funds, suspected fraud, expired card, or incorrect CVV.

Step 5: Authorization Hold

If approved, the issuing bank places a hold on the funds. The money has not actually moved yet. It is reserved for your transaction.

Step 6: Capture

You (or your processor) send a capture request, typically at the end of the day or when you fulfill the order. This tells the issuing bank to finalize the transfer.

Step 7: Settlement

The actual money movement happens during settlement, usually 1-3 business days after capture. Funds move from the issuing bank through the card network to your processor, and finally into your bank account.

Why Payments Fail

Understanding failure points helps you recover lost revenue.

Soft Declines

Temporary issues like insufficient funds or processor timeouts. These can often be resolved by retrying the transaction later. Smart retry logic can recover 10-20% of soft declines.

Hard Declines

Permanent issues like stolen cards, closed accounts, or invalid card numbers. Do not retry these. Ask the customer to use a different payment method.

3D Secure Failures

When additional authentication (like a one-time code from the bank) fails or is abandoned by the customer. This is more common with international transactions.

Interchange Economics

Interchange fees are the biggest cost component and vary by card type.

• Debit cards: 0.5-1.0% (regulated, lower fees)

• Consumer credit cards: 1.5-2.0%

• Rewards credit cards: 2.0-2.5% (higher because the bank funds those rewards)

• Corporate cards: 2.5-3.0%

• International cards: Add 0.5-1.5% on top of base rates

You cannot control which card a customer uses, but understanding these costs helps you price your products and choose the right processor.