What happens when you click "pay now" on a website
When you enter your card details and click submit, your payment does not go directly to the merchant. Instead, your information travels through a chain of companies in a specific order: your bank, a payment processor, the merchant's bank, and the merchant themselves. Each step takes seconds, but each one has a job. Your bank checks that the card is real and you have enough money. The processor translates your card data into a format the merchant's bank can read. The merchant's bank confirms the transfer is safe. Only then does the merchant see the money.
The entire chain exists because no single company can do all of this alone. Your bank does not talk directly to the merchant's bank. The processor acts as the middleman, routing the request, managing the security, and keeping a record. If something goes wrong at any step—a declined card, a fraud flag, a network glitch—the payment stops and you see an error message. If everything clears, the merchant gets a confirmation code and you get a receipt.
Key Takeaways
- Your payment travels through your bank, a payment processor, the merchant's bank, and finally the merchant—each step takes seconds but serves a specific security or verification purpose.
- The payment processor is the middleman that translates your card data, checks fraud signals, and routes the request to the right bank.
- Authorization (the approval) and settlement (the actual money transfer) are two separate events that can happen hours or days apart.
- Fraud detection happens at multiple points: your bank checks your account, the processor checks the transaction pattern, and the merchant's bank checks the receiving account.
- If a payment fails, the merchant sees a code that tells them why—insufficient funds, card expired, fraud hold, or a network error.
The role of the payment processor
The payment processor is the company that sits between you and the merchant. When you use Stripe, Square, PayPal, or Authorize.net, you are using a payment processor. Their job is to take your card information, encrypt it so it cannot be read in transit, send it to the right bank, and report back to the merchant whether the payment went through.
Processors also handle the rules. They know which card types (Visa, Mastercard, American Express, Discover) require which security checks. They flag transactions that look unusual—a purchase from a different country than your last one, a very large amount, multiple failed attempts in a row. They do not make the final decision to approve or decline, but they gather the signals and pass them along. If your bank says no, the processor tells the merchant no. If your bank says yes, the processor confirms it and moves the money.
Processors also keep the records. Every transaction gets a unique ID, a timestamp, the amount, the merchant name, and the outcome. If you dispute a charge later, the processor has this record and can show it to your bank. If a merchant needs to refund you, the processor handles that too—they reverse the transaction and send the money back to your card.
Authorization versus settlement: why the timing matters
Authorization and settlement are not the same thing, and the gap between them is where problems can happen. Authorization is the approval—your bank says yes, the funds are there, the card is valid. Settlement is when the money actually moves from your account to the merchant's account.
Authorization usually happens in seconds. You see the confirmation page, the merchant sees the approval code. But settlement can take one to three business days. During that time, the money is held in a clearing account—not yet in your bank, not yet in the merchant's bank. If the merchant never completes the settlement (because they cancel the order, for example), the hold drops and the money stays in your account. If settlement completes, the money leaves your account and arrives in theirs.
This is why you might see a charge on your account before it actually posts. Your bank shows it as pending because authorization happened, but settlement has not. Once settlement completes, the status changes to posted and the money is gone. If you dispute a charge during the pending phase, your bank can stop the settlement. If you dispute it after posting, your bank has to reverse it—which takes longer and requires more documentation.
How fraud detection works across the payment chain
Fraud checks happen at three points: your bank, the processor, and the merchant's bank. Your bank looks at your account history—does this purchase match your normal spending? Is the location plausible? Is the amount reasonable? If something seems off, your bank can decline the transaction or flag it for review.
The processor runs its own checks. It compares the card details to the billing address. It checks whether the card has been reported stolen. It looks at the velocity—how many transactions from this card in the last hour, the last day. It checks the merchant's history too. If the merchant has high chargeback rates or is flagged as high-risk, the processor may decline even a normal-looking transaction.
The merchant's bank does a final check. They verify that the receiving account is real and active. They check whether the merchant typically receives transactions of this size. If something triggers a fraud alert, they can hold the settlement and ask the merchant for more information before releasing the funds.
If any of these checks fail, the transaction is declined. You see an error message—"Card declined," "Transaction not authorized," or "Please contact your bank." The merchant does not know which check failed, only that the payment did not go through. You have to contact your bank to find out why, or try a different payment method.
What happens when a payment fails
When a payment fails, the processor sends a decline code to the merchant. Common codes include: insufficient funds (your account does not have enough money), card expired (the expiration date has passed), lost or stolen card (your bank flagged it), incorrect CVV (the security code does not match), address mismatch (the billing address does not match the card's address), and issuer unavailable (your bank's system is down).
The merchant sees this code but you may not. Some merchants show you a generic message like "payment declined." Others show the specific reason. If the reason is something you can fix—expired card, wrong address, wrong CVV—you can try again with corrected information. If the reason is insufficient funds or a fraud hold, you need to contact your bank.
A failed payment does not charge you. The authorization was never approved, so no hold was placed on your account. You can try again immediately with a different card, or wait and try the same card later if the issue was temporary (like your bank's system being down). If you try multiple times and keep failing, stop—multiple failed attempts can trigger a fraud alert on your account.
How refunds and chargebacks move backward through the system
A refund is when the merchant sends money back to you. The processor handles this by reversing the original transaction. The merchant's bank sends the money back to your bank, and your bank puts it back in your account. Refunds usually take one to five business days, depending on your bank and the processor. The merchant initiates the refund, the processor processes it, and your bank receives it.
A chargeback is different. A chargeback is when you dispute a charge with your bank and your bank reverses it without asking the merchant first. Your bank pulls the money back from the merchant's account and puts it in yours. The merchant then has a chance to dispute the chargeback—they can provide evidence that the transaction was legitimate. If they do, your bank reviews the evidence and decides whether to side with you or the merchant.
Chargebacks are slower than refunds and more adversarial. They take two to three months to resolve. Merchants pay a chargeback fee (usually $15 to $100) even if they win the dispute. If a merchant gets too many chargebacks, their processor can drop them or raise their fees. This is why merchants prefer refunds—they are faster, cheaper, and do not trigger a dispute process.
Security measures that protect your card information
Encryption scrambles your card data so that only the processor and the merchant's bank can read it. When you enter your card number on a website, it gets encrypted before it leaves your computer. The merchant never sees your full card number—they see only the last four digits and a token that represents your card.
Tokenization replaces your card number with a unique code. If you save your card on a website for future purchases, the website stores the token, not your actual card number. If that website gets hacked, the hackers get a token that only works on that one website, not your actual card number that would work everywhere.
PCI compliance is a set of security standards that processors and merchants must follow. They have to encrypt data, limit who can access it, test their systems for vulnerabilities, and report breaches. If a processor or merchant is not PCI compliant and your data gets stolen, they can be fined and sued.
3D Secure (also called Verified by Visa or Mastercard SecureCode) adds an extra step. After you enter your card details, the processor sends you to your bank's website where you enter a password or get a code on your phone. This proves you are the real cardholder, not someone who stole your card number. Not all merchants use 3D Secure, but it is becoming more common, especially for high-value purchases.
Why some online payments take longer to process
Most online payments authorize in seconds, but settlement can take one to three business days. Bank transfers (ACH payments) are slower—they typically take three to five business days because the banks process them in batches, not in real time. Wire transfers are faster—usually same-day or next-day—but they cost more and cannot be reversed.
International payments are slower still. They have to go through multiple banks in different countries, each with their own processing times and rules. A payment from the US to Europe can take five to ten business days. The processor has to convert the currency, which adds another step and another fee.
Payments to certain merchants are slower because of industry rules. Mortgage payments, property taxes, and court fees often require manual processing. Subscription payments may batch together and settle once a day instead of in real time. Payments flagged for fraud review can take days or weeks while the processor investigates.
Frequently Asked Questions
Why does my bank show a pending charge that is not in my available balance?
A pending charge is an authorization hold—your bank has approved the payment and set the money aside, but settlement has not happened yet. The money is not gone, but it is not available to spend either. Once settlement completes (usually one to three days), the charge moves from pending to posted and the money leaves your account.
Can a merchant charge me twice if the payment fails the first time?
A failed payment does not charge you at all—no authorization means no hold. If you see two charges, one is likely pending and one is posted, or you accidentally submitted the form twice. Contact your bank to dispute the duplicate charge; they can reverse it within a few days.
What should I do if I see a charge I did not make?
Contact your bank immediately, not the merchant. Your bank can freeze your card, reverse the charge, and investigate. If the charge is still pending, your bank can stop the settlement. If it has already posted, your bank will reverse it and send the money back—this takes three to five business days. Do not wait; banks have time limits on disputes.
Why was my payment declined even though I have money in my account?
A decline can happen for reasons other than insufficient funds: your card expired, the billing address does not match, your bank flagged it as fraud, the CVV is wrong, or your bank's system is temporarily down. Contact your bank to find out which one. If your bank says the card is fine, try a different payment method on the merchant's website.
How long does a refund take to show up in my account?
Refunds usually take one to five business days, depending on your bank and the processor. The merchant initiates the refund, the processor reverses the transaction, and your bank receives the money. Some banks post refunds faster than others. If it has been more than five business days, contact the merchant to confirm they processed the refund.