The basic steps to process a credit card payment
To process a credit card payment, you need the cardholder's 16-digit card number, expiration date, and CVV (the three-digit security code on the back). You enter these details into a payment system — either online, over the phone, or in person at a terminal — and the transaction routes through your payment processor to the cardholder's bank. The payment either goes through or is declined within seconds to a few minutes.
The actual movement of money takes longer. The cardholder's bank holds the charge for one to three business days before sending it to your bank or payment processor. You see the money in your account anywhere from the next day to five business days later, depending on your processor and your bank's settlement schedule.
If you are a business owner or someone processing payments for others, you will need a merchant account or a payment processor like Square, Stripe, PayPal, or your bank's own payment gateway. If you are paying a bill or making a purchase as a cardholder, you typically just enter your card details on the merchant's website or hand your card to a cashier — the merchant handles the processing.
Key Takeaways
- Credit card payments require the 16-digit card number, expiration date, and CVV, and are approved or declined within minutes.
- The cardholder's bank holds the charge for one to three business days before sending funds to your account.
- You will receive the money in your account one to five business days after the transaction, depending on your processor and bank.
- Businesses need a merchant account or payment processor to accept credit cards; individual cardholders simply provide their card details to the merchant.
- Chargebacks and fraud disputes can reverse a payment weeks or months later, so keep transaction records and delivery proof.
How the payment flows from card to your account
When a credit card payment is processed, the cardholder's bank (the issuing bank) receives the transaction request from your payment processor. The issuing bank checks whether the card is valid, whether the account has sufficient credit, and whether the transaction matches the cardholder's spending patterns. This check happens in real time and takes seconds.
If approved, the issuing bank sends an authorization code back to your processor. At this point the charge appears on the cardholder's statement as pending. The cardholder's bank then holds the funds for one to three business days — this is called the hold period. During this time, the cardholder can still dispute the charge or report it as fraudulent.
After the hold period, the funds move to your processor's account, then to your business bank account. This final step is called settlement. Depending on your processor's schedule, settlement happens once a day or once a week. Most processors settle within 24 hours, but some take up to five business days. Your bank account shows the deposit as "pending" for a day or two before the money is fully available.
What information you need to collect and store safely
To process a credit card payment, you need the cardholder to provide: the full 16-digit card number, the expiration date (month and year), the CVV (three digits on the back of Visa and Mastercard, or four digits on the front of American Express), and the cardholder's billing address and ZIP code. Some processors also ask for the cardholder's name and phone number.
If you are storing this information for repeat payments, you must comply with PCI DSS (Payment Card Industry Data Security Standard). This means your system must be encrypted, your staff must have limited access to card data, and you must never store the CVV. Many small businesses avoid this by using a payment processor that handles storage for you — Square, Stripe, and PayPal all store card data securely on their servers, so you do not have to.
Never store card information in plain text, email, or spreadsheets. If you are hacked or audited and card data is found unencrypted, you face fines from the card networks and liability for fraud that results. Use your processor's tokenization feature instead: the processor gives you a token (a random string of characters) that represents the card, and you store the token. When you need to charge the card again, you use the token, not the actual card number.
Processing payments online, by phone, and in person
Online payments happen through a payment gateway — a form on your website or app that encrypts the cardholder's data and sends it to your processor. Common gateways include Stripe, Square Online, PayPal Checkout, and Authorize.Net. The cardholder enters their card details, clicks submit, and the payment is approved or declined on the same page. The whole process takes 10 to 30 seconds.
Phone payments require you to manually enter the card details into your processor's system or payment terminal. Read the card number, expiration date, and CVV from the cardholder over the phone, or ask them to provide it verbally. Some processors have a phone payment link you can text or email to the cardholder, and they enter their own details — this is safer because you never handle the card number. Phone payments take two to five minutes and carry higher fraud risk because you cannot verify the cardholder's identity in person.
In-person payments use a card reader (a physical terminal or a mobile device like a Square Reader) that the cardholder inserts, taps, or swipes their card into. The reader encrypts the card data and sends it to your processor. Chip readers (EMV) and contactless payments (tap or mobile wallet) are more secure than magnetic stripe swipes because the data cannot be copied. In-person payments take 30 seconds to two minutes and have the lowest fraud risk.
What happens if a payment is declined
A payment is declined when the cardholder's bank rejects the transaction. Common reasons include: insufficient credit available, the card is expired, the CVV does not match, the billing address does not match, the card is flagged for fraud, or the card has been reported lost or stolen. The cardholder's bank sends a decline code to your processor, which displays a specific reason on your screen or the cardholder's screen.
When a payment is declined, no money moves and no charge appears on the cardholder's statement. The cardholder can try again with a different card, contact their bank to ask why the card was declined, or ask you to try the payment again in a few minutes (sometimes a temporary system issue causes a decline). You should not retry the same card more than twice in a row — multiple failed attempts can trigger a fraud block on the account.
If the cardholder says they have money available but the payment keeps declining, ask them to contact their bank directly. The bank can tell them whether the card is locked, whether there is a fraud hold, or whether the card is too old to use online. You cannot override a decline — only the cardholder's bank can authorize the payment.
Chargebacks and how to protect yourself
A chargeback is a reversal of a credit card payment initiated by the cardholder's bank. The cardholder contacts their bank and disputes the charge — claiming they did not authorize it, did not receive the goods or services, or were charged twice. The bank pulls the money back from your account and gives it to the cardholder while they investigate. This can happen days, weeks, or even months after the original payment.
To win a chargeback dispute, you need to provide proof that the cardholder authorized the payment and received what they paid for. For physical goods, this means a tracking number showing delivery to the address on the card. For services, this means a receipt, invoice, or email confirmation showing the cardholder received the service. For digital goods, this means a download confirmation or access log. If you cannot provide this proof, you lose the chargeback and the money is gone.
To protect yourself: always get a signature or digital confirmation that the cardholder received the goods or services, keep all receipts and invoices for at least 18 months, use address verification (AVS) to confirm the billing address matches the card, and monitor your chargeback rate. If your chargeback rate exceeds 1 percent, your processor may charge you higher fees or close your account.
Fees and costs of processing credit cards
Credit card processing costs vary by processor and by card type. Most processors charge a percentage of each transaction (typically 2 to 3 percent) plus a flat fee per transaction (typically 20 to 30 cents). Some also charge a monthly account fee, a batch fee, or a gateway fee. American Express and Discover usually cost more to process than Visa and Mastercard.
If you process $10,000 in credit card payments in a month at 2.9 percent plus 30 cents per transaction, and you average 100 transactions, your cost is roughly $290 in percentage fees plus $30 in per-transaction fees, totaling $320 or about 3.2 percent of revenue. Interchange fees (the fee the card network charges your processor) are set by the card networks and cannot be negotiated, but your processor's markup on top of interchange can vary by 0.5 to 1 percent depending on your volume and industry.
Some processors offer flat-rate pricing (a single percentage for all cards) or tiered pricing (different rates for different card types). Flat-rate is simpler but may cost more if you process mostly Visa and Mastercard. Tiered pricing can be cheaper if you have high volume, but the tiers are not standardized and can be confusing. Compare processors by calculating your total monthly cost, not just the advertised rate.
Frequently Asked Questions
How long does it take for a credit card payment to show up in my bank account?
The payment is approved within seconds, but the money does not reach your account for one to five business days. Your processor typically settles once a day, and your bank takes one to two business days to deposit the funds. Weekends and holidays add extra days. If you process a payment on Friday evening, you might not see it until Wednesday.
Can I process a credit card payment without a merchant account?
Yes. You can use a payment processor like Square, Stripe, or PayPal that provides a merchant account as part of their service. You do not need to open a separate merchant account with a bank. These processors handle the payment processing, fraud detection, and settlement for you, and they deposit the money into your personal or business bank account.
What should I do if a cardholder claims they did not authorize a payment?
Ask them to contact their bank and file a dispute. Do not refund the payment yourself unless you are certain it was unauthorized — if you refund and the cardholder also disputes it, you lose the money twice. Provide your processor with any proof you have that the cardholder authorized the payment: an email confirmation, a signed receipt, or an IP address log showing they accessed your website.
Is it safe to process credit card payments over email or text?
No. Never ask a cardholder to email or text their card number to you. Instead, send them a secure payment link from your processor (Square, Stripe, and PayPal all offer this feature). The cardholder clicks the link, enters their card details on an encrypted page, and you never see the card number. This protects both of you from fraud and data breaches.
What is the difference between a debit card and a credit card payment?
Debit card payments pull money directly from the cardholder's bank account, while credit card payments charge the cardholder's credit line. Debit cards settle faster (usually within 24 hours) and have lower processing fees, but they offer less fraud protection to the cardholder. Credit cards have higher fees but stronger dispute rights. From your perspective as the processor, both work the same way — you enter the card number and the payment is approved or declined.