What happens when you buy something online
When you enter your card details on an ecommerce site and hit "buy," your payment doesn't go straight to the seller. It travels through at least four separate systems before the merchant sees the money. Your card issuer (your bank) talks to the payment processor, who talks to the card network (Visa, Mastercard, American Express), who talks to the merchant's bank. Each step takes seconds, but each one is a separate transaction with its own rules and protections.
The merchant never actually sees your full card number. Instead, the payment processor creates a token—a unique code that stands in for your card. That token gets stored in the merchant's system, not your actual card data. This is why you can save your card to a site and check out faster next time: the site is using the token, not re-entering your real number.
Money doesn't move instantly, even though the purchase feels instant. Your card issuer approves the charge in real time, but the actual transfer of funds happens later—usually within one to three business days. Until then, the money is held in a clearing account, and the merchant sees a "pending" status in their bank account.
Key Takeaways
- Your payment travels through your bank, a payment processor, the card network, and the merchant's bank—each one checks the transaction before it moves forward.
- The merchant receives a token representing your card, not your actual card number, which reduces fraud risk for both you and the seller.
- Approval happens in seconds, but the money itself settles into the merchant's account within one to three business days.
- If something goes wrong—a duplicate charge, an unauthorized purchase, or a merchant who never ships—you have dispute rights through your card issuer.
- Different payment methods (debit card, credit card, digital wallet, buy-now-pay-later) follow the same basic path but have different fraud protections and settlement timelines.
The four stops your payment makes
Your card issuer is your bank or credit card company. When you swipe or enter your card, they receive a request that says "This person wants to spend $X at this merchant." They check whether you have enough money (for debit) or available credit (for credit cards), whether the amount seems normal for your account, and whether the location makes sense. If something looks wrong—a purchase in another country at 3 a.m., or a charge ten times your usual spending—they can decline it. This check takes milliseconds.
The payment processor is the middleman. Companies like Stripe, Square, PayPal, and Adyen sit between the merchant and the card networks. The processor collects the transaction details, sends them to the card network, waits for approval, and then tells the merchant whether the charge went through. Processors also handle the money movement later—they collect funds from the card networks and deposit them into the merchant's bank account, minus their fee (usually 2 to 3 percent).
The card network (Visa, Mastercard, Discover, American Express) is the infrastructure. They don't hold your money or the merchant's money. They set the rules for how transactions work, manage the communication between your bank and the merchant's bank, and handle disputes. They also set the interchange fee—the cut that goes to your card issuer for processing the transaction.
The merchant's bank receives the transaction from the card network and deposits the funds into the merchant's account. They also handle chargebacks if you dispute the charge later. The merchant's bank is where the money actually lands, and it's also where the merchant can see their settlement report—a daily or weekly summary of all transactions that cleared.
Why approval is instant but settlement takes days
Approval and settlement are two separate events. Approval is a yes-or-no decision that happens in real time. Your bank checks your balance or credit limit and says "yes, this charge is okay" or "no, decline it." The merchant sees this answer immediately and either completes your order or tells you the card was declined.
Settlement is the actual movement of money. After approval, the transaction sits in a queue. Your bank holds the money in a clearing account. The card network batches transactions together—usually once per day—and sends them to the merchant's bank. The merchant's bank then deposits the funds into the merchant's account. This whole process typically takes one to three business days, depending on the banks involved and whether the transaction happened on a weekend or holiday.
This delay is why you sometimes see a charge as "pending" on your card for a day or two after you make a purchase. The money is reserved—you can't spend it again—but it hasn't officially left your account yet. Once settlement completes, the charge moves from "pending" to "posted."
Some payment methods settle faster. ACH transfers (bank-to-bank transfers) can take three to five business days. Credit card transactions usually settle within one to three days. Debit card transactions often settle within one business day. Digital wallets like Apple Pay and Google Pay use the underlying card or bank account, so they follow the same timeline as the payment method you linked to them.
How fraud protection works at each step
Your card issuer is your first line of defense. They use machine learning to spot unusual patterns—a purchase in a city you don't live in, a charge at 4 a.m., a series of small transactions that look like testing a stolen card. If something looks suspicious, they can decline the charge or call you to confirm. This is why your bank sometimes texts you asking "Did you just buy gas in Denver?" They're checking before the transaction settles.
The payment processor adds a second layer. They check the address you entered against your billing address, verify that the card number passes a checksum test (a mathematical formula that catches typos and some fake numbers), and flag transactions that match known fraud patterns. Some processors use 3D Secure, a system that requires you to enter a code sent to your phone before the charge goes through. This proves you have the card in your possession.
The merchant themselves can implement fraud checks too. They might require a CVV (the three-digit code on the back of your card), check that the shipping address matches the billing address, or flag orders that are unusually large or going to a new address. Some merchants use third-party fraud detection services that score each transaction on the likelihood it's fraudulent.
If fraud does happen—someone uses your card without permission—you have dispute rights. You contact your card issuer and report the unauthorized charge. They investigate, and if they agree it was fraud, they reverse the charge and issue you a new card. This process usually takes 10 to 30 days, though your issuer often credits the money back to you within a few days while they investigate.
Different payment methods and how they differ
A credit card goes through the full four-step process described above. Your bank approves the charge, the processor handles it, the card network routes it, and the merchant's bank deposits the funds. You don't pay the merchant directly—you pay your card issuer, and your card issuer pays the merchant (through the processor and network). This creates a buffer: if something goes wrong, you dispute it with your card issuer, not the merchant.
A debit card follows the same path, but the money comes directly from your bank account instead of a line of credit. Settlement is often faster—sometimes within one business day instead of three. However, fraud protection is weaker. If someone uses your debit card fraudulently, the money is already gone from your account. You have to dispute it and wait for your bank to investigate and refund you, which can take weeks. Credit cards are safer for online purchases because the money isn't yours until you pay the bill.
A digital wallet (Apple Pay, Google Pay, Samsung Pay) stores a tokenized version of your card or bank account. When you use it, the wallet sends the token to the merchant, not your actual card number. This adds a layer of security because the merchant never sees your real card details. The underlying payment method (credit card, debit card, or bank account) still goes through the normal four-step process, but the wallet handles the encryption and token generation.
Buy-now-pay-later (BNPL) services like Affirm, Klarna, and Afterpay work differently. Instead of charging your card immediately, they pay the merchant in full right away, and then you pay the BNPL company in installments. From the merchant's perspective, it's a normal transaction—they get paid by the BNPL processor. From your perspective, you're making a loan with the BNPL company, not a purchase with your card. BNPL services often don't report to credit bureaus, and they may charge interest or fees if you miss a payment.
What happens if something goes wrong
If you're charged twice for the same order, contact the merchant first. Duplicate charges usually happen because the page didn't load properly or you clicked "buy" twice. The merchant can often reverse the duplicate charge within hours. If they don't respond or refuse, contact your card issuer and file a dispute. Your issuer will investigate and reverse the charge if they agree it was a duplicate.
If you never receive the item, you have two options. First, try to resolve it with the merchant—ask for a refund or a replacement. If the merchant doesn't respond or refuses, file a chargeback with your card issuer. A chargeback is a formal dispute where your card issuer investigates whether the merchant actually delivered what they promised. If your issuer agrees the merchant failed to deliver, they reverse the charge. This process takes 10 to 30 days.
If you recognize a charge you didn't make, report it to your card issuer immediately. Don't contact the merchant. Your card issuer will investigate, and if they agree it was unauthorized, they'll reverse it and send you a new card. Federal law (the Fair Credit Billing Act) limits your liability to $50 for unauthorized credit card charges, and most card issuers offer zero-liability fraud protection, meaning you pay nothing.
If a merchant goes out of business after you pay but before they ship, your card issuer can't force them to send the item. However, you can still dispute the charge as "merchant failed to deliver" or "services not rendered." Your issuer will reverse the charge if the merchant doesn't respond to their investigation.
How merchants get paid and what fees they pay
The merchant doesn't receive the full amount you paid. The payment processor takes a cut—usually 2 to 3 percent for credit cards, sometimes less for debit cards. This fee covers the processor's cost, the card network's fee, and the interchange fee that goes to your card issuer. For a $100 purchase, the merchant might receive $97 or $98, depending on the card type and the processor's rates.
Merchants also pay a monthly gateway fee (usually $10 to $30) to use the payment processor's system, and some pay a per-transaction fee on top of the percentage. Larger merchants negotiate lower rates. A big retailer might pay 1.5 percent, while a small online shop might pay 3 to 4 percent.
The merchant's processor deposits the funds into their bank account on a schedule—usually daily or weekly. The merchant can see a settlement report that breaks down each transaction, the fees charged, and the net amount deposited. If a transaction is disputed or charged back, the processor reverses the deposit and deducts the chargeback fee (usually $15 to $100) from the merchant's account.
Frequently Asked Questions
Why does my card show "pending" after I buy something online?
Pending means your bank approved the charge and reserved the money, but it hasn't officially settled yet. Settlement—the actual transfer of funds—takes one to three business days. Until then, the money is held in a clearing account and you can't spend it, but it hasn't left your account. Once settlement completes, the charge moves from pending to posted.
Is it safe to enter my card number on a website?
Yes, if the site uses HTTPS (look for the lock icon in your browser's address bar). HTTPS encrypts your card number so it can't be intercepted. The merchant also shouldn't store your full card number—they should store a token instead. If you're still worried, use a digital wallet like Apple Pay or Google Pay, which sends a token instead of your actual card number.
What's the difference between a chargeback and a refund?
A refund is when the merchant agrees to return your money and processes it through the payment processor. A chargeback is when you dispute the charge with your card issuer because the merchant won't refund you or didn't deliver. Chargebacks take longer (10 to 30 days) and cost the merchant a fee, so always ask the merchant for a refund first.
Can I get my money back if I change my mind about a purchase?
That depends on the merchant's return policy, not your card issuer. If the merchant offers returns, they'll process a refund through the payment processor. If they don't offer returns and you change your mind, your card issuer can't force them to refund you. You can only dispute the charge if the merchant failed to deliver or the item was significantly different from what was described.
Why do some online stores ask for my billing address?
Merchants use address verification to reduce fraud. They check that the address you entered matches the billing address on file with your card issuer. If it doesn't match, the transaction might be declined or flagged for manual review. This protects both you and the merchant by making it harder for someone with a stolen card to make a purchase.