How Payment Processing Works for Online Businesses

A card payment is not one event. It is three, and they happen at different times.

1. Authorization (seconds)
   Checkout -> gateway -> processor -> acquirer -> network -> issuer
   Issuer checks the card, funds and fraud signals, then approves or declines.
   Funds are held on the cardholder's account. No money moves yet.

2. Clearing (usually end of day)
   Merchant submits a batch of authorized transactions.
   Network validates the data, applies rules, calculates fees.

3. Settlement (one to a few business days)
   Issuer pays the acquirer through the network.
   Acquirer pays the merchant, minus fees.

Authorization answers three questions: is the card valid, are there funds or credit, and does the transaction look safe. Concryt's guide stresses that after an approval the bank reserves the funds but does not transfer them. An approval is a promise, not a payment.

Clearing is where the banks agree on the details. Payment Matters describes it as the step that typically occurs at the end of each business day when merchants submit their batch of authorized transactions, with the network calculating fees and converting currencies. A Federal Reserve Bank of Philadelphia paper based on a Mastercard briefing adds that high-volume merchants may batch several times a day and very low-volume merchants less than daily. Online platforms usually batch for you automatically.

Settlement is when money actually moves. The issuer pays the acquirer, and the acquirer credits the merchant, typically within one to three business days according to Payment Matters. The U.S. Chamber of Commerce notes that if you batch after your processor's daily cutoff time, settlement may not begin until the next business day.

The practical lesson is about cash flow and inventory. Count revenue as earned when you deliver, count cash as available when it settles, and do not ship expensive goods on the strength of an authorization alone if your risk is high.

Your processing fee looks like one number on a statement. It is really three layers.

1. Interchange. The acquiring bank pays this to the issuing bank on every transaction. Stripe explains that interchange is set by the card networks and varies by card type, transaction method and size, and that networks publish their rate tables twice a year. NMI's guide, read on 2026-10-17, puts typical US credit card interchange at roughly 1.4% to 2.5% of the transaction plus a fixed fee.
2. Assessments. These go to the card networks themselves. NMI describes them as non-negotiable and generally much smaller than interchange.
3. Processor markup. This is the margin your processor or gateway adds. It is the only layer you can negotiate.

Online businesses pay a particular premium. NMI notes that card-present transactions often qualify for lower rates because fraud risk is lower when the card is physically there. Every online sale is card-not-present, so your baseline is higher than a shop's.

Processors package these layers in a few ways. Stripe lists the common models:

Stripe calls interchange plus the most transparent model and flat rate predictable but usually more expensive. To compare providers honestly, the U.S. Chamber suggests calculating your effective rate: add all fees and divide by total sales volume. That one number cuts through every pricing model.

These three terms are often used interchangeably, and that causes bad purchasing decisions. Stripe separates them clearly:

• A payment gateway encrypts and transmits sensitive transaction data from your checkout to the processor. It is the front door.
• A payment processor verifies and authorizes the transaction and handles the transfer of funds between banks. It often adds fraud screening and chargeback management.
• A merchant account is a specialized account that receives settled funds from card sales and holds them before they move to your ordinary business bank account.

Twenty years ago an online business usually bought these separately: a gateway from one company, processing from another and a merchant account from a bank. Today most small businesses buy all three from one provider that bundles them. Bundling is simpler to set up, but it also means your payment provider controls your payout timing, your reserve requirements and your account status. If that provider freezes your account, all three functions stop at once.

The part your own code touches is the gateway. If card numbers never reach your servers, because the provider's hosted fields or checkout page collect them, your exposure under the card industry's security standard (PCI DSS) is much smaller. Spreedly notes that the major networks together form the PCI Security Standards Council, which sets and enforces that standard. Keeping raw card data out of your systems is the cheapest compliance decision you will ever make.

The most consequential choice is not which brand of processor you pick. It is who is legally the seller.

Your own merchant account. You go through full underwriting with an acquirer. You get the most control and, at volume, the best rates. You also own every obligation: tax, disputes, fraud losses and compliance.

A payment facilitator (payfac). The payfac holds a master merchant account and onboards you as a sub-merchant. Stripe explains that this makes onboarding take minutes rather than weeks, but the payfac does not take on compliance, tax or liability obligations on your behalf. You are still the seller.

A merchant of record (MoR). The provider becomes the legal seller. Stripe's definition: the MoR charges the customer, remits applicable taxes, handles disputes and absorbs fraud liability. Paddle, which sells an MoR service, summarizes the difference as payfacs not being responsible for tax calculation and filing, while an MoR is.

A sensible rule of thumb follows from Stripe's own guidance. Choose an MoR when you sell digital products internationally and do not want to build a tax function. Choose a payfac when you are early, mostly domestic and comfortable owning tax and disputes. Move to your own merchant account when volume makes the rate difference worth the extra work. Tax obligations differ by country and state, so check with an accountant before you decide that any of these routes removes yours.

Three things go wrong in card payments, and each one has a different owner.

Declines happen at authorization. Concryt lists the common causes as expired or invalid card details, insufficient funds, fraud blocks and technical errors, and warns that a high decline rate can lead processors to impose stricter terms. You fix declines with clean checkout forms, more payment methods and sensible retry logic for recurring charges.

Refunds are you choosing to return money. They are cheap and they are your decision.

Chargebacks are the cardholder's bank taking money back. The issuer reviews the cardholder's evidence and decides whether to process the chargeback, then pulls the funds from the acquirer, which pulls them from you. The U.S. Chamber points out that some networks, such as American Express and Discover, send a retrieval request before issuing a chargeback, and that ignoring it can cost you the chance to respond. Watch your dashboard for these early notices.

A good default: refund quickly when a customer is unhappy. A refund costs you the sale. A chargeback costs you the sale, a dispute fee and a mark on your account's risk profile.

Use this list when you set up payments or review an existing setup.

1. Decide who the seller is. Own merchant account, payfac or merchant of record. Write down why.
2. Keep card data off your servers. Use hosted fields or a hosted checkout so your PCI scope stays small.
3. Know your effective rate. Total fees divided by total volume, calculated every quarter.
4. Ask for a fee breakdown. Interchange, assessments and markup, shown separately.
5. Know your settlement schedule. When does a sale become cash in your bank account, and what is the cutoff time?
6. Read the reserve and hold terms. Find out when the provider can delay payouts and what triggers it.
7. Track declines by reason. Separate fraud blocks from insufficient funds from technical errors.
8. Answer disputes fast. Assign an owner and a deadline for every dispute notification.
9. Reconcile monthly. Match settled payouts to sales, refunds, fees and chargebacks in your books.
10. Keep a second provider in mind. Know which provider you would move to if your account were frozen, and what it would take.

Payment processing is not a feature you build once. It is a supply chain for your revenue, and it rewards the same attention you give to any other supplier: know the parts, read the terms and measure the cost.