Inside an online checkout: the parts you never see

To the person paying, an online checkout is a form and a button. Behind that button, a payment travels through several companies, passes several checks, and comes back with an answer, usually in under three seconds. Most of the time you never need to know how. When something goes wrong (a decline, a double charge, a refund that takes a week) knowing the route makes the problem much easier to understand.

This guide explains what happens inside an online card payment, in plain terms. It is the pillar of the library's section on platform guides.

The companies involved

• The shop (merchant). Sells the product and shows the checkout.
• The payment provider. A company that takes card payments on behalf of shops. It collects the card details securely, runs its own checks and passes the payment on. Many shops never touch card numbers at all; the provider's form does.
• The acquirer. The bank or institution that holds the shop's merchant account and receives money on its behalf. Often bundled with the payment provider.
• The card network. The scheme whose logo is on the card. It routes the payment between the shop's side and the card's side and sets rules for both.
• The issuer. The company that issued the card. It knows the card's state and balance and gives the final answer.

Step by step

1. You enter the details

The checkout collects the card number, expiry date, security code and often a name and address. On well-built sites these go straight to the payment provider, not the shop's own servers.

2. The provider checks the request

Before anything reaches your card's issuer, the provider (and the shop's own rules) look at the request: Is the card number valid? Does the shop accept this card type and this card's country? Does the address look right? Is this device making many attempts? A payment can be refused here without the issuer ever seeing it. Reading a decline message explains how to tell where a refusal came from.

3. Extra verification

Many checkouts add a step where the card's issuer confirms that you are the cardholder: a one-time passcode, an approval in an app, or an invisible check in the background. One-time passcodes and bank approval screens at checkout explains when and why this appears.

4. Authorisation

The network carries the request to the issuer, which checks that the card is active, not expired, has enough balance, and that the payment does not look like fraud. It answers yes or no. A yes reserves the amount on the card; this is the authorisation. The seconds after you press Pay slows this moment down.

5. Settlement

Later (often at the close of the day, sometimes when goods ship) the shop settles its authorised payments, and the money actually moves. The final amount can differ from the authorisation, for example after a tip, a partial shipment or a currency conversion. Holds, authorisations and the amount that settles explains the difference between the two.

Saved cards and repeat payments

When you let a shop save your card, it usually stores a token: a stand-in for your card number that only that shop can use. Subscriptions and one-click purchases charge the token later without asking for the details again. Saved cards, tokens and card on file and Recurring billing: how a shop charges you again cover these.

Marketplaces and app stores

On a marketplace, the company that charges your card may not be the seller you bought from. On a phone, purchases inside apps are often charged by the app store rather than the app's maker. This matters when you need a refund or want to cancel: you deal with whoever charged you. Marketplaces: who actually charges your card and Phone app marketplaces and purchases inside apps explain both.

Refunds

A refund starts at the shop and travels the same chain backwards: provider, network, issuer, card. Each step processes in batches, which is why a refund that takes seconds to request can take several working days to appear. Refunds go back to the card that paid; if that card has been closed, the issuer and the shop have to find another way, which takes longer.

Why one card behaves differently at different shops

If every checkout uses the same route, why does a card work at one shop and fail at the next? Because each company along the route has its own rules:

• Shops choose what they accept. A shop can refuse card types, card countries or currencies for business or legal reasons.
• Payment providers score risk differently. One provider may approve a payment that another sends for extra checks.
• Some shops ask for more. A full address, a phone number, a verification step. Each extra check is another place a payment can stop.
• Some categories carry stricter rules. Travel, gambling, digital goods and subscriptions often have tighter screening than a one-off purchase of a physical item.

So a decline at one shop says little about the next. It is worth reading each shop's list of accepted payment methods before deciding a card "does not work online".

What this means for a virtual card

A virtual card follows exactly the same route. The shop sees a card number, an expiry and a code. The issuer checks the card's state and balance. So the same advice applies:

• Declines usually come from typos, balance, the shop's own rules or the issuer's risk checks.
• Holds reserve part of the balance until they are released or settled.
• Refunds return to the card that paid, so keep a card open until refunds you expect have arrived.

What a virtual card is explains the card itself, and Ten words you will meet when paying online by card is a short glossary of the terms above.

In short

A checkout is a relay: shop, provider, network, issuer, and back. Each runs its own checks, and any of them can stop a payment. Approval reserves money; settlement moves it; refunds run the route in reverse, more slowly. With that map in mind, most payment puzzles become a question of which step to look at.