What happens when you enter your card details at checkout
A payment gateway is the software that sits between you and the merchant's bank, capturing your card information and sending it through a series of checks before the transaction completes. When you type your card number into a checkout form, the gateway encrypts it immediately, routes it to the payment processor, which contacts your bank to verify funds, and then sends the result back to the merchant—all in seconds. The merchant never sees your full card number; the gateway handles that encryption and passes only a token or reference number to the merchant's system.
The diagram most payment gateways follow is the same whether you're buying groceries online or paying a utility bill: customer → gateway → processor → your bank → processor → merchant's bank → merchant. Each step has a specific job, and if any step fails or flags a problem, the transaction stops and you see an error message.
Key Takeaways
- The payment gateway encrypts your card data at the point of entry and never stores the full number on the merchant's server.
- Your bank and the merchant's bank communicate through the processor, which acts as the middleman translating requests and responses.
- Authorization (checking funds exist) happens before settlement (actually moving the money), which is why a charge can appear pending for hours or days.
- Fraud detection runs at multiple points: the gateway screens for suspicious patterns, your bank checks for unusual activity, and the processor flags mismatches between card data and billing address.
- If any step rejects the transaction, you receive a decline code that tells you whether the problem is insufficient funds, incorrect CVV, or a security block.
The five stops your transaction makes before it settles
Stop 1: The gateway captures and encrypts. You enter your card number, expiration date, and CVV into the checkout form. The gateway immediately encrypts this data using TLS (Transport Layer Security), the same encryption banks use. The merchant's website never touches the raw card number—it only receives a token, a reference code that stands in for your card. This token is what gets stored in the merchant's database if you save the card for future purchases.
Stop 2: The processor receives the request. The gateway sends the encrypted transaction to the payment processor (Stripe, Square, PayPal, or your bank's own processor). The processor decrypts the data and begins the authorization sequence. It also checks whether the card is active, whether it has been reported stolen, and whether the transaction matches the card's known usage pattern. If the processor spots a red flag here—for example, a card used in New York an hour ago now appearing in Tokyo—it can decline the transaction before your bank even sees it.
Stop 3: Your bank verifies funds and identity. The processor sends an authorization request to your bank (the card issuer). Your bank checks whether you have sufficient funds or available credit, whether the transaction amount is within your normal spending range, and whether the billing address or CVV matches their records. Your bank responds with an authorization code (a yes) or a decline reason (insufficient funds, CVV mismatch, fraud suspected). This entire exchange typically takes one to three seconds.
Stop 4: The merchant's bank receives the transaction. Simultaneously, the processor notifies the merchant's bank (the acquiring bank) that a transaction is coming. The merchant's bank reserves the funds in the merchant's account, but does not yet move the money. This is the authorization phase—the transaction is approved but not yet settled.
Stop 5: Settlement moves the actual money. Hours or days later, the merchant's bank and your bank exchange the actual funds. Your bank debits your account; the merchant's bank credits the merchant. This is settlement, and it is why a charge can show as "pending" for up to three business days even though the authorization happened instantly. The merchant sees the money in their account only after settlement completes.
Why authorization and settlement are two separate events
Many people assume that when a charge appears on their card, the money has moved. It has not. Authorization and settlement are two different moments, and understanding the gap between them explains why a pending charge can disappear, why a refund takes time, and why a merchant can hold funds without actually taking them.
Authorization is a promise: your bank says "yes, this person has the funds and we approve this transaction." The merchant's bank sets the money aside in a holding account. But the actual transfer of funds—settlement—happens later, usually within one to three business days. During that window, the merchant can cancel the transaction (called a void), and the hold disappears. After settlement, the merchant must issue a refund, which takes another one to three business days to appear in your account because your bank has to reverse the debit.
This two-step process exists because banks batch transactions. Instead of moving money one transaction at a time (which would be slow and expensive), they collect all transactions from a merchant over a day or two, verify them, and then move them in bulk. A merchant who processes 500 transactions in a day does not trigger 500 separate bank transfers; instead, the net total of all transactions moves once, at the end of the day or the next morning.
Where fraud detection happens in the flow
Fraud screening does not happen in one place; it happens at multiple points, and each checkpoint uses different signals. The gateway checks for basic tampering—whether the data has been altered in transit. The processor runs pattern matching: Does this card usually buy from this merchant category? Is the transaction amount typical? Is the card being used in a geographically impossible way (two transactions on opposite sides of the world within minutes)? Your bank runs its own checks: Does the billing address match? Does the CVV? Has this card been reported stolen? Is the transaction amount an outlier for this account?
If any checkpoint flags the transaction as risky, it can decline it outright, or it can trigger a secondary verification step. Some banks send you a text or email asking you to confirm the transaction. Some gateways use 3D Secure, a protocol that redirects you to your bank's website to enter a password or receive a one-time code. These extra steps slow down checkout, but they reduce fraud and protect both you and the merchant.
The decline codes you see when a transaction fails tell you which checkpoint rejected it. "CVV mismatch" means your bank flagged the security code. "Insufficient funds" means your bank said no. "Declined by processor" usually means the processor's fraud detection caught something. "Card not supported" means the gateway does not accept that card type. Each code points to a different stop in the flow, which is why calling your bank about a processor decline is often less useful than contacting the merchant to resubmit with corrected information.
How different payment methods follow the same diagram
Credit and debit cards follow the flow described above. But digital wallets (Apple Pay, Google Pay), bank transfers (ACH, wire), and buy-now-pay-later services all use variations of the same diagram, with different starting points and different endpoints.
When you use Apple Pay, you are not sending your card number to the merchant. Instead, Apple generates a one-time token specific to that transaction and merchant. The token goes to the gateway, which treats it like a card number and routes it through the processor. Your bank receives the request and authorizes it the same way, but the processor already knows the token is tied to your Apple account, so it skips some fraud checks. The settlement happens the same way: your bank and the merchant's bank exchange funds days later.
ACH transfers (bank-to-bank payments) skip the processor entirely. You provide your bank account number and routing number. The merchant's bank sends a request directly to your bank asking for a debit. Your bank verifies the account exists and has funds, then moves the money. No card, no processor, no authorization code—just a direct bank-to-bank instruction. Settlement is immediate or next-day, depending on the banks involved.
Buy-now-pay-later services (Affirm, Klarna, Afterpay) insert themselves between you and the merchant. You do not pay the merchant; you pay the BNPL company. The BNPL company pays the merchant immediately (or on a schedule), and you pay the BNPL company in installments. From the merchant's perspective, the transaction looks normal: the BNPL company's bank sends the payment through the processor. From your perspective, you are making a loan, not a card purchase, so different rules apply to disputes and refunds.
What happens when a transaction fails or gets declined
When a transaction is declined, the flow stops at one of the five stops described above. The gateway, processor, your bank, or the merchant's bank rejects the request and sends back a decline code. The merchant's system displays an error message to you. Importantly, no money moves. The authorization never completes, so there is no hold on your account and no settlement to reverse later.
If you see a charge on your statement for a declined transaction, it is a hold, not a completed charge. Holds typically disappear within one to three business days as the banks clear their queues. If a hold persists beyond that, contact your bank and provide the transaction reference number (usually visible in your email receipt or on your statement). Your bank can investigate and release the hold manually.
If a transaction is authorized but you want to cancel it, you have a narrow window. If you contact the merchant within hours of the transaction, before settlement, they can void it—which tells the processor to cancel the authorization. The hold disappears immediately. If settlement has already happened, the merchant must issue a refund, which reverses the debit and takes one to three business days to show in your account.
Frequently Asked Questions
Why does my bank show a pending charge but the merchant says the transaction failed?
Authorization and settlement are separate. Your bank may have authorized the transaction (putting a hold on your account), but the merchant's system may have failed to complete the sale before settlement. Contact the merchant to confirm whether they received the payment. If they did not, ask your bank to release the hold—it should disappear within three business days anyway.
Can a merchant see my full card number?
No. The payment gateway encrypts your card number before it reaches the merchant's server. The merchant receives only a token or a reference number. This is why merchants cannot steal your card number even if their website is hacked—they never had it in the first place. Only the processor and your bank see the full number.
Why does a refund take longer than a charge?
A charge is authorized in seconds but settled days later. A refund reverses a completed settlement, which means your bank has to undo a transaction that already moved money. Your bank batches refunds the same way it batches charges, so a refund issued on Monday might not appear in your account until Wednesday or Thursday. The merchant cannot speed this up; it depends on your bank's processing schedule.
What is the difference between a hold and a charge?
A hold is a temporary reservation of funds during authorization. A charge is a completed debit after settlement. A hold disappears if the transaction is voided or declined; a charge requires a refund to reverse. Holds typically expire within three business days if the merchant does not complete settlement.
Does the payment gateway store my card information?
The gateway encrypts and transmits your card data but does not store the full number on its servers. If you save your card for future purchases, the gateway stores a token—a reference code that stands in for your card. The token is useless to a thief because it only works with that specific merchant and gateway. Your full card number is never stored anywhere except at your bank and the processor.