Who Is Involved in a Card Payment

  • You and your card.
  • The acquirer: the shop’s bank, which gave the shop its card machine.
  • The card network: Visa, Mastercard, RuPay and others. It routes the message between banks and sets the rules.
  • The issuer: your bank, which gave you the card. It is the one that says yes or no.

How a Card Payment Works, Step by Step

When you tap or insert your card, the chip and the terminal create a one-time code (a cryptogram) for this payment only. Copied card data can’t be reused, because the next payment needs a new code. Then:

Card + terminalat the shopAcquirerthe shop’s bankCard networkVisa / Mastercard / RuPayIssueryour bank1. ₹1,200 + one-time code2. authorisation request3. routed by card numberlimit, PIN, fraud check4. approved + auth code5. approved6. Approved ✓
A card payment: the shop’s bank asks, the card network routes, and your bank decides.
  1. The terminal sends the amount, card details and the one-time code to the shop’s bank (the acquirer).
  2. The acquirer sends an authorisation request to the card network.
  3. The network reads the first digits of the card number and routes the request to your bank (the issuer).
  4. Your bank checks: is the card valid and not blocked, is the code or PIN right, is there enough credit limit, and does this look like fraud?
  5. If all is well, it approves, puts a hold on that amount of your limit, and sends back an approval code.
  6. The answer travels back the same way, and the terminal shows Approved.

Small contactless payments go through without a PIN, up to a limit set by the RBI (₹5,000 at the time of writing). Above that, you enter your PIN.

Why Was My Credit Card Declined?

  • Not enough limit left for the amount.
  • Wrong PIN or OTP.
  • Card blocked, expired or not yet activated.
  • That kind of use is switched off. In India, online, contactless and international use can each be turned on or off in your bank’s app.
  • The fraud check said no. Your bank scores every payment in milliseconds (amount, place, shop, your usual pattern), and an unusual one can be declined or sent for an extra check.

Online Payments: OTP and Tokenisation

Paying online, nobody can see your card, so India adds a second check: usually an OTP sent to your registered mobile number. And shops are no longer allowed to store your card number. Instead, a token stands in for it: a substitute number that works only for that shop, so a leak from one shop doesn’t expose your actual card.

On a website, your card details first go through the shop’s payment gateway: see How Payment Gateways Work.

After Approved: Clearing and Settlement

Approved only reserves the money. Later the same day, the shop sends its batch of payments; the network clears them (works out who owes whom), and the money is settled between the banks. Along the way, fees are taken: the shop pays a merchant discount rate (MDR), part of which goes to your bank as interchange. You pay nothing at this point: the amount simply appears on your next card bill.

How that fee is split, and how the card networks earn from it, is in How Visa and Mastercard Make Money.

For Engineers: Deciding in Milliseconds

Authorisation messages travel in the ISO 8583 format, and the issuer typically has a few hundred milliseconds to answer. Inside that window it has to check the limit, the cryptogram and the fraud score, and it must never approve the same payment twice when a message is retried. If the issuer can’t be reached, the network can approve small payments on its behalf within agreed rules (stand-in processing). The fraud check, a scoring decision under a hard time limit, is the most interesting part to build.

This article explains how the systems work. It is not financial advice, and limits and rules change: check the current ones with RBI, NPCI or your bank.