What happens when you enter your card details at checkout
A payment gateway is the software that captures your payment information when you buy something online and sends it to the bank that will actually move the money. When you type your card number into a checkout form, the gateway encrypts it, routes it to the merchant's bank and your card issuer, waits for approval or decline, and sends the result back to the website in seconds. The gateway itself does not hold money or decide whether to approve you — it is a messenger between the merchant, the banks, and the payment processor.
The entire process from the moment you click "pay" to the moment you see "transaction approved" typically takes 2 to 5 seconds. Behind that speed are multiple systems checking whether the card is valid, whether the account has funds, whether the transaction looks fraudulent, and whether the card issuer will allow it. If any step fails, you see a decline message and the transaction stops.
Key Takeaways
- A payment gateway encrypts your card data and routes it to your bank and the merchant's bank, but does not store your information or approve the payment itself.
- The authorization process involves your card issuer, the merchant's bank, and a payment processor all communicating in real time to verify funds and detect fraud.
- Approved transactions settle in 1 to 3 business days, meaning the merchant does not receive the money immediately even though your card was charged right away.
- If a transaction is declined, the gateway returns a specific code that tells you why — insufficient funds, incorrect address, card expired, or suspected fraud.
- Payment gateways use encryption and tokenization to keep your actual card number off the merchant's servers, reducing the risk that a data breach exposes your details.
The three parties that must communicate for a transaction to go through
Your card issuer is the bank that issued your credit or debit card. When you make a purchase, the gateway sends a request to your issuer asking "does this person have the funds and permission to spend this amount?" Your issuer checks your account balance, your credit limit, and whether the transaction matches your normal spending patterns. If something looks wrong — the purchase is in a country you never visit, or the amount is far larger than usual — your issuer can decline it as a fraud prevention measure.
The merchant's bank, called the acquiring bank, is the bank that holds the merchant's business account. This bank receives the transaction request from the payment processor and passes it along to your card issuer. Once your issuer approves the charge, the acquiring bank confirms the approval back through the processor to the gateway, which then tells the website the transaction went through.
The payment processor sits between these two banks and handles the technical work of moving the request and response back and forth. Processors like Stripe, Square, and PayPal operate the infrastructure that connects thousands of merchants to thousands of banks. They also handle the settlement — the actual movement of money from your bank account to the merchant's account — which happens separately from authorization and usually takes 1 to 3 business days.
Why authorization and settlement are two separate events
When you see "transaction approved" on your screen, your card issuer has said yes to the charge, but the money has not moved yet. This moment is called authorization. The merchant now knows they can ship your order or deliver your service, but they do not have the cash in their account.
Settlement is when the actual money transfer happens. The processor collects all the transactions the merchant processed that day, bundles them, and sends them to the acquiring bank. The acquiring bank then pulls the funds from all the card issuers involved and deposits the total into the merchant's account. This process takes 1 to 3 business days depending on the banks involved and the time of day the transaction occurred. If you make a purchase on Friday evening, settlement might not complete until Tuesday morning.
This delay matters if you need to cancel an order. If you contact the merchant before settlement completes, they can void the transaction and you will never be charged. If settlement has already happened, the merchant must process a refund instead, which takes another 1 to 3 business days to appear back in your account. Some merchants hold authorization for longer than settlement takes — for example, hotels often authorize your card when you book but do not settle the charge until you check out.
How the gateway protects your card information
Payment gateways use encryption to scramble your card number the moment you enter it, so it cannot be read if someone intercepts the data in transit. The gateway also requires the website to have an SSL certificate, which you can verify by looking for the padlock icon in your browser's address bar. Without encryption, your card number would be visible to anyone monitoring the internet connection.
Most modern gateways also use tokenization, which means your actual card number is never stored on the merchant's servers at all. Instead, the gateway stores your card information in its own secure vault and gives the merchant a token — a random string of characters that represents your card. If a hacker breaks into the merchant's database, they get tokens that are useless without access to the gateway's vault. This is why you can often check out faster on repeat visits: the merchant asks the gateway to charge the token associated with your card, not your card number itself.
The gateway also screens transactions for fraud using rules you or the merchant can set. If a transaction is flagged as suspicious — a purchase from an unusual location, an amount far above your normal spending, or a card number that appears on a fraud watch list — the gateway can decline it automatically or flag it for manual review before settlement.
What decline codes mean and why your transaction was rejected
When a transaction is declined, the gateway returns a specific code that tells you the reason. Common codes include: insufficient funds (your account does not have enough money), card expired (the expiration date on your card has passed), incorrect CVV (the three-digit security code on the back of your card does not match), address mismatch (the billing address you entered does not match the address on file with your card issuer), and lost or stolen card (your card issuer has flagged the card as compromised).
Some declines are temporary. If your card was declined for insufficient funds, you can add money to your account and try again. If it was declined for an address mismatch, you can update your billing address with your card issuer or re-enter it correctly at checkout. Other declines are permanent — an expired card will not work until you renew it, and a card flagged as lost or stolen will not work until you contact your issuer and confirm you still have it.
If you see a decline code that does not match any of these common reasons, or if you believe the decline is a mistake, contact your card issuer directly. The merchant and the gateway can see that the transaction was declined, but only your issuer can tell you the exact reason and whether you can fix it.
How different payment methods move through the gateway differently
Credit and debit cards follow the authorization and settlement process described above. ACH transfers (bank-to-bank transfers) work differently: the gateway collects your bank account and routing number, sends them to the processor, and the processor initiates a debit from your bank account directly. ACH transfers take 1 to 3 business days to complete and cannot be reversed instantly like a card transaction can.
Digital wallets like Apple Pay and Google Pay use tokenization by default. When you set up a wallet, you give it your card information once, and the wallet stores a token. When you pay with the wallet, the gateway receives the token from the wallet provider, not your actual card number. This adds a layer of security because the merchant never sees your card details at all.
Buy now, pay later services like Affirm and Klarna work through the gateway but operate on a different timeline. When you choose a payment plan at checkout, the gateway sends the request to the BNPL provider, not directly to your card issuer. The BNPL provider approves the purchase, charges your card for the first installment immediately, and schedules future charges for the dates you agreed to. The merchant receives their full payment from the BNPL provider, not from you directly.
What happens if a transaction fails partway through
If the connection between the gateway and the processor drops while your transaction is being processed, you may see an error message but not know whether the charge went through. This is rare but can happen. If you were charged but the website did not confirm the order, check your card statement after a few hours. If the charge appears, contact the merchant to confirm they received the order. If the charge does not appear within 24 hours, it was declined and you do not owe anything.
If you were not charged but the website showed an error, do not retry immediately — wait a few minutes and check your card statement first. Retrying too quickly can result in duplicate charges if the first attempt actually went through but the confirmation did not reach the website. If you are unsure, contact the merchant's customer service with the time and amount of the attempted transaction, and they can look it up in their gateway logs.
Some gateways offer idempotency keys, which prevent duplicate charges if you accidentally submit the same payment twice. When you make a payment, the gateway assigns it a unique key. If you submit the payment again with the same key within a set time window, the gateway recognizes it as a retry and does not charge you twice. Not all merchants use this feature, so it is still safer to wait and check your statement before retrying.
Frequently Asked Questions
Why does my card show as charged but the merchant says they did not receive the money?
Authorization and settlement are separate. Your card was authorized (approved) immediately, but settlement — the actual transfer of funds to the merchant's account — takes 1 to 3 business days. If the merchant is checking their account before settlement completes, they will not see the money yet. Ask them to check again after one business day.
Can I dispute a charge if I authorized it but changed my mind?
Yes, but the process depends on timing. If settlement has not completed, ask the merchant to void the transaction immediately — this cancels the charge before money moves. If settlement already happened, you must request a refund from the merchant. If the merchant refuses, you can dispute the charge with your card issuer, though the issuer will ask why you authorized it in the first place.
Is it safe to enter my card number on a website?
It is safe if the website uses a payment gateway with encryption and an SSL certificate. Look for the padlock icon in your browser's address bar and check that the URL starts with "https://" not "http://". Never enter your card number into an email, text message, or unsecured form. If you are unsure whether a website is legitimate, use a digital wallet or call the merchant directly to pay over the phone instead.
What if I see a charge I do not recognize?
Contact your card issuer immediately and report it as unauthorized. Your issuer will investigate and can reverse the charge while they look into it. You are not responsible for unauthorized charges while the investigation is ongoing. The issuer will ask you to describe the transaction and confirm you did not make it.
Why was my transaction declined even though I have money in my account?
Common reasons include an expired card, incorrect billing address, mismatched CVV, or your card issuer flagging the transaction as suspicious. Check that your card has not expired and that the billing address you entered matches your card issuer's records exactly. If those are correct, contact your card issuer — they may have declined it as a fraud prevention measure and can approve it if you confirm the purchase was legitimate.