> For the complete documentation index, see [llms.txt](/llms.txt). Full text of every page: [llms-full.txt](/llms-full.txt).

# Module 2: How Card Payments Work

## Why it matters

Every time a customer swipes, taps, or enters card details, they set off a complex interaction across banking systems, APIs, and networks. Understanding this process helps you:

- Design integrations that are secure and reliable
- Negotiate better pricing and terms
- Predict payout timing and reduce cash flow surprises
- Improve approval rates and customer experience

Card transactions are where software meets money – and precision matters.

## The two-phase model

Card transactions unfold in two distinct — but tightly linked — phases.

### 1. Authorization

The moment a card is used, a real-time check occurs to confirm:

- The card is valid
- Funds or credit are available
- There are no signs of fraud

These checks will result in either the transaction being approved or declined within 1-2 seconds.  

### 2. Settlement

If approved, the merchant groups the transaction with others and submits them to their processor or acquirer. Funds are then:

- Deducted from the cardholder’s account
- Routed through the card networks
- Deposited into the merchant’s account

Funds are typically available to the merchant within 1-3 business days (or faster with real-time options). 

## Key roles in a card transaction

The table below describes the core roles in a card transaction, which often includes a payment processor and payment gateway. 

Two of the most complex aspects a card payment system are:

- Sending payments between a merchant and an acquirer
- Processing card payments

Payment gateways and processors are technology partners that can make these parts of the process easier. While not strictly required for a card transaction, they play an important role in the authentication and settlement processes.

| **Role** | **Function** |
| --- | --- |
| Cardholder | Uses a credit or debit card to initiate a transaction. |
| Merchant | Sells goods/services to a cardholder and submits the transaction data for authorization through a payment gateway. |
| Gateway | Software and servers that securely transmit cardholder data from the merchant’s website, mobile app, or POS system to the payment processor or acquirer, and transmits responses from issuers for authorization. |
| Processor | A company that helps a merchant process card payments by providing the technology to route payment data between the merchant, acquirer, and card networks. |
| Issuer|A financial institution that issues payment cards to cardholders, approves or declines transactions, issues payment to the acquirer on behalf of the cardholder, and bills the cardholder. |
| Acquirer | A financial institution that manages the merchant’s account, processing card payments for the merchant and sending the transactions to the card network. |
| Card Network | A card brand (Mastercard, Visa, etc.) that provides the global financial infrastructure for routing transactions between the acquirer and issuer, sets operational rules, and manages settlement and interchange fees. |

## How authorization and settlement work

### Authorization flow

| **Step** | **Description** |
| --- | --- |
| 1 | The cardholder initiates a payment at the point of sale (POS) or through an online checkout process. |
| 2 | The merchant sends the transaction data (card information and amount) to the acquirer either directly or through a payment processor, who will use a payment gateway to send the transaction data to the acquirer. |
| 3 | The acquirer requests authorization from the issuer. |
| 4 | The issuer sends the authorization response (approved or declined) to the acquirer. |
| 5 | The acquirer sends the authorization response to the merchant either directly or back through the payment gateway and payment processor if the merchant is using those services. |
| 6 | Assuming the transaction is approved, the merchant finalizes the sale. |

![](https://developer.globalpayments.com/gh-assets/fintech-guide/auth-flow.png)

**Authorization flow**

### Settlement flow

| **Step** | **Description** |
| --- | --- |
| 1 | The merchant sends captured transactions in batches to the acquirer at the end of the day. |
| 2 | The acquirer clears the transactions (works with the card network and issuer to verify and agree on what’s owed) and then sends the batch file to the card network (aka the card brand). |
| 3 | The card network forwards the transactions to the issuers, who debit/credit each cardholder’s account for the amount of the transactions. |
| 4 | The card network then transfers funds to the acquirers for the sales and credit transactions. |
| 5 | The acquirer deposits funds into the merchant’s account, minus any fees either directly or via the payment gateway and payment processor if the merchant is using those services. |

![](https://developer.globalpayments.com/gh-assets/fintech-guide/settle-flow.png)

**Settlement flow**

## Important considerations when building payment systems 

- **Idempotency**: Always use unique keys (aka request IDs) for each attempt to process a transaction. This will prevent duplicate processing. 
- **Authorization vs. Capture**: You can authorize a payment, then capture it (i.e., submit it to the issuer for financial settlement) later. This is a common practice for businesses with rentals or delayed fulfillment.  
- **Webhooks**: Using 'payment_succeeded', 'chargeback_opened', and 'settlement_completed' are important for ensuring your system is reliable, responsive, and trustworthy—one that reacts correctly to each key payment event, reduces risk, and improves the user experience.
- **Retry Logic**: When a card is declined, instead of simply showing an error, your system should trigger a user-friendly flow to guide the user through options to try the payment again, fix the issue, or use a different payment method.

## Your tech stack for security and compliance

The following capabilities are critical to ensuring your system is secure and compliant:

- **PCI-DSS**: Compliance with the PCI-DSS is mandatory for any merchant or provider storing or transmitting cardholder data.
- **Tokenization**: To reduce PCI scope and risk, use tokenization to replace sensitive card information with a secure token.
- **3DS and EMV**: Adding an extra verification step with 3-Domain Secure (3DS) and Europay, Mastercard, and Visa (EMV) chip technology help prevent fraud and ensure strong customer authentication (SCA) compliance under the Revised Payment Services Directive (PSD2) in Europe.
- **Fraud Prevention**: Use AI and machine learning models to strengthen fraud protection by monitoring transaction velocity, identifying IP/location mismatches, and to trigger additional security checks if a transaction comes from a new or unrecognized device (device fingerprinting).

## KPIs to track the performance of your payment system

| **Metric** | **Why It Matters**|**Target Benchmark** |
| --- | --- | --- |
| Authorization Rate | Measures approval success | 97–99% |
| False Decline Rate | Indicates friction from risk rules | Less than 0.5% |
| Time to Settle | Impacts cash flow | 1–2 business days (avg) |
| Chargeback Rate | Indicates disputes/fraud | Less than 0.9% (Visa/MC threshold) |
| Latency | Affects user experience | Less than 2 seconds |

## What’s changing?

In the future, card transaction flows will be more:

- **Real-time**: With emerging real-time payment (RTP) rails and instant funding APIs (FedNow, Visa Direct)
- **Modular**: With APIs abstracting issuer/acquirer roles (e.g., Stripe’s Payment Intents)
- **Smart**: With dynamic routing, AI-based fraud scoring, and token networks replacing static credentials

These shifts are making payments programmable, composable, and highly developer-centric.

## Summary

Card payments may feel simple to end users — but they represent one of the most high-volume, multi-actor workflows in global commerce.

Building a successful payment system requires that developers, product owners, and merchants:

- Understand each step for better integrations
- Choose vendors and APIs based on reliability and control
- Improve performance, approvals, and payout speed

## What’s Next

Next, we’ll explore who actually makes the payments ecosystem work—introducing the players behind each transaction, including card networks, processors, gateways, and platforms like yours.

### [Module 3](https://developer.globalpayments.com/docs/getting-started/new-to-payments/fintech-education-module-3.md)

Continue to Module 3