What happens when you click "pay now"

When you submit a payment online, your information travels through at least four separate systems before money actually moves. Your browser encrypts your card or bank details and sends them to the merchant's payment gateway — a service like Stripe, Square, or PayPal that acts as a middleman. The gateway forwards your information to the card network (Visa, Mastercard, Discover, American Express) or your bank, depending on the payment method. That network or bank checks whether the transaction is legitimate and whether you have enough funds or available credit. If approved, the merchant receives a confirmation code within seconds, and you see a receipt.

The actual transfer of money happens later, in a separate batch process. The merchant's bank collects all approved transactions from that day and sends them to the card network or ACH system (for bank transfers). The network then pulls funds from your bank account or credit card issuer. This settlement process typically takes one to three business days, which is why a payment shows as "pending" even after you receive a confirmation email.

Key Takeaways

  • Your payment information is encrypted and routed through a payment gateway, card network, and your bank in seconds, but the actual money transfer happens in a separate batch process one to three days later.
  • A confirmation email means the transaction was approved, not that the money has moved — the merchant's bank and your bank still need to settle the funds.
  • Different payment methods (credit card, debit card, bank transfer, digital wallet) follow different routes and have different settlement speeds and fraud protections.
  • Merchants pay a fee for each transaction, typically 2 to 3 percent for card payments, which is why some businesses offer discounts for cash or ACH payments.

The four systems that touch your payment

Your payment gateway is the first stop. This is the software the merchant uses to collect your information securely. The gateway does not hold your money or make decisions about whether to approve the payment — it is a secure tunnel that passes your details to the next layer. Common gateways include Stripe, Square, PayPal, Authorize.net, and 2Checkout. The gateway encrypts your data using TLS (Transport Layer Security), the same technology that protects your bank login.

The card network comes next if you are paying by credit or debit card. Visa, Mastercard, Discover, and American Express each operate their own network of banks and merchants. The network receives your transaction details and checks them against fraud rules — does the amount match your typical spending, is the merchant location plausible, has your card been reported stolen. This happens in real time and takes less than a second. If the network flags the transaction as risky, it may decline it or send it to your bank for additional verification.

Your bank or card issuer makes the final approval decision. For credit cards, the issuer (often a bank like Chase or Capital One) checks your available credit and fraud patterns specific to your account. For debit cards, your bank checks your account balance. For bank transfers, your bank verifies the receiving account exists and that you have authorized the transfer. This step also happens in seconds, but the bank does not move money yet — it only confirms that the transaction can proceed.

The merchant's bank is the fourth system. Once the transaction is approved, the merchant's bank collects it into a batch with hundreds or thousands of other transactions from that day. At the end of the business day, the merchant's bank sends the entire batch to the card network or ACH operator. The network then instructs your bank to transfer the funds. This settlement process is what causes the one- to three-day delay between approval and the money actually leaving your account.

Why there is a delay between approval and settlement

The delay exists because banks do not process transactions one at a time. Instead, they batch them — collecting all transactions from a merchant or a region and processing them together at set times, usually overnight. This batching is more efficient for banks than processing millions of individual transactions in real time. It also gives banks time to verify that the merchant is legitimate and that the funds are actually available before pulling money from customer accounts.

For credit card payments, the delay is typically one to three business days. Your card issuer may show the transaction as "pending" immediately, but the money does not actually leave your account until the merchant's bank sends the batch to the card network and the network instructs your bank to pay. Weekends and holidays extend the timeline because banks do not process batches on those days.

For debit card payments, the timeline is similar — one to three business days for the funds to actually leave your account, even though the transaction is approved instantly. For ACH transfers (bank-to-bank payments), the standard timeline is one to three business days as well, though some banks offer next-day ACH for an additional fee.

For digital wallets like Apple Pay, Google Pay, or PayPal, the approval is instant, but settlement still follows the same batching process. The wallet provider acts as an intermediary, so the merchant's bank sends the batch to the wallet provider's bank, which then settles with your bank. This can add an extra day in some cases.

Fraud protection at each step

Your payment gateway encrypts your information so that the merchant's website never actually sees your full card number or bank details. Instead, the gateway stores a token — a unique code that represents your payment method. The merchant uses the token to process future payments without handling your actual information. This is why you can save a card on a website and not worry that a data breach will expose your card number directly.

The card network and your bank use machine learning to detect fraud patterns. They look for transactions that deviate from your normal behavior — a purchase in a different country minutes after a local transaction, a sudden spike in spending, purchases at merchants known for fraud. If the system flags a transaction, it may decline it automatically or send you a text or email asking you to confirm. You can also set spending limits or geographic restrictions in your bank's app.

If a fraudulent transaction does go through, your protection depends on your payment method. Credit cards offer the strongest protection — you can dispute the charge and the card issuer will typically refund you within 10 business days while they investigate. Debit cards offer weaker protection because the money is already out of your account, though federal law (Regulation E) limits your liability to $50 if you report the fraud within two business days. Bank transfers and ACH payments offer the least protection — once the money is sent, recovery is difficult and depends on whether the receiving bank will cooperate.

Why merchants pay fees for online payments

Every time a customer pays by credit or debit card online, the merchant pays a fee to the payment gateway, the card network, and the card issuer. The total fee is typically 2 to 3 percent of the transaction amount, plus a flat fee per transaction (often $0.30). For a $100 purchase, the merchant might pay $2.30 to $3.30. These fees are built into the prices you see — merchants raise prices to cover the cost of accepting cards.

The fee is split among three parties. The card issuer (your bank) takes the largest cut, typically 1 to 2 percent. The card network (Visa, Mastercard, etc.) takes a smaller percentage. The payment gateway takes a flat fee or a small percentage. Merchants have no control over these rates — they are set by the card networks and banks, not negotiated individually.

ACH transfers and bank-to-bank payments have much lower fees, often $0 to $1 per transaction, which is why some merchants offer discounts for ACH payments or ask customers to pay by check. Digital wallets like PayPal and Square Cash charge fees similar to credit cards — around 2 to 3 percent — because they ultimately route the payment through the card network or ACH system.

What happens if a payment fails or is declined

A payment can fail for several reasons. Insufficient funds is the most common — your account balance is too low or your credit limit is too high. An expired card, a mistyped card number, or a mismatch between your billing address and the address on file will also cause a decline. Fraud detection can decline a legitimate transaction if the system flags it as suspicious. A technical error — a problem with the payment gateway, the merchant's bank, or the card network — can also cause a failure.

When a payment fails, the merchant's system should display an error message explaining why. If the reason is insufficient funds or an expired card, you can fix it and try again. If the reason is fraud detection, you may need to contact your bank to confirm the transaction. If the reason is a technical error, try again in a few minutes — the problem is usually temporary.

A failed payment does not charge your account, even if the merchant's website shows a temporary hold. Holds are placed by your bank to reserve funds while the transaction is pending, but they disappear within one to three business days if the transaction never settles. If a hold does not disappear after three business days, contact your bank to have it removed manually.

How disputes and chargebacks work

If you are charged for something you did not authorize or did not receive, you can dispute the charge with your bank or card issuer. For credit cards, this is called a chargeback. For debit cards and ACH transfers, it is called a dispute. The process is similar: you contact your bank, explain why you are disputing the charge, and provide any documentation (emails, receipts, screenshots). Your bank then investigates and either refunds you or sides with the merchant.

For credit cards, the card issuer typically refunds you immediately while they investigate, then recovers the money from the merchant's bank if they determine the charge was fraudulent. This investigation usually takes 30 to 60 days. For debit cards, the refund may take longer — sometimes up to 45 days — because the money is already out of your account and the bank has to recover it from the merchant.

Merchants can fight a chargeback by providing evidence that the transaction was legitimate — a signed receipt, a delivery confirmation, an email from you authorizing the charge. If the merchant provides strong evidence, your bank may reverse the refund and put the money back in the merchant's account. This is why keeping receipts and confirmation emails is important if you think you might dispute a charge later.

Different payment methods and how they work differently

Credit cards route through the card network and your card issuer's bank. Approval is instant, settlement takes one to three days, and fraud protection is strong. You can dispute charges and typically receive a refund within 10 business days.

Debit cards route through the same networks as credit cards, but the money comes directly from your bank account instead of a line of credit. Approval is instant, settlement takes one to three days, but fraud protection is weaker than credit cards. If your debit card is used fraudulently, you must report it within two business days to limit your liability to $50.

ACH transfers (bank-to-bank payments) do not use card networks. Instead, they route through the ACH network, which is operated by the Federal Reserve and Nacha. Approval takes one to three business days, and settlement happens at the same time. Fraud protection is minimal — once the money is sent, recovery is difficult. ACH transfers are common for bill payments, payroll, and peer-to-peer transfers.

Digital wallets like Apple Pay, Google Pay, Venmo, and PayPal store your card or bank information and let you pay by scanning a code or tapping your phone. The wallet provider handles the encryption and tokenization, so the merchant never sees your actual payment details. Settlement follows the same timeline as the underlying payment method — if the wallet uses your credit card, settlement takes one to three days; if it uses your bank account, it may take longer.

Frequently Asked Questions

Why does my bank show a pending charge but the merchant says the payment failed?

A pending charge means your bank has reserved the funds while waiting for the merchant's bank to settle the transaction. If the merchant's system shows a failure, the settlement may not happen, and the hold will disappear in one to three business days. Contact the merchant to confirm whether they received the payment before assuming it failed.

Can I cancel a payment after I click submit?

If the payment is still pending (not yet settled), you may be able to contact your bank and ask them to reverse it, but this is not may provide. Once settlement happens, the money has left your account and you will need to request a refund from the merchant or dispute the charge. The faster you act, the better your chances of stopping the payment before it settles.

Why do some merchants charge extra for credit card payments?

Merchants pay 2 to 3 percent in fees for credit card transactions, so some pass this cost to customers by charging a surcharge or offering a discount for other payment methods. ACH transfers and checks cost merchants much less, so they may encourage those methods instead. Surcharges are legal in most states but are capped at the actual cost the merchant pays.

What is the difference between a hold and a charge?

A hold is a temporary reservation of funds by your bank while a transaction is pending. A charge is the actual debit from your account after settlement. Holds disappear in one to three business days if the transaction does not settle. Charges are permanent unless you dispute them or the merchant refunds you.

How do I know if my payment information is safe online?

Look for a padlock icon in your browser's address bar and check that the URL starts with "https" (not "http"). This means the connection is encrypted. Never enter your full card number or bank details directly into an email or text message. Use payment gateways that are PCI-DSS compliant — this means they meet security standards set by the card networks. PayPal, Stripe, and Square are all PCI-DSS compliant.