How Online Stores Process Payments and Where Your Money Goes

What happens when you buy something online

When you enter your card number on an online store, that information does not go straight to the business owner. Instead, it moves through a chain of companies—your bank, the store's bank, a payment processor, and often a gateway that encrypts the data. Each one takes a small cut, and each one has rules about what kinds of transactions are allowed. Understanding this chain helps you see why some purchases get declined, why refunds take days, and why online stores sometimes charge you differently than brick-and-mortar ones.

The store itself rarely touches your card details directly. A payment gateway—software like Stripe, Square, or PayPal—sits between the customer and the merchant. The gateway encrypts your information, sends it to a payment processor, which routes it to your bank and the store's bank. Both banks check whether the transaction is legitimate, whether you have funds, and whether the card is flagged for fraud. If everything clears, the processor sends back an approval code, the gateway tells the store the sale went through, and you see a confirmation.

Key Takeaways

• Your card information passes through a gateway, a processor, and two banks—the store never sees your full card number if the system works correctly.
• Fees charged to the store (typically 2 to 3 percent of the sale plus a flat amount per transaction) are set by the processor and the card networks, not by the store alone.
• A declined transaction usually means your bank flagged it as suspicious, your card is expired, or you lack funds—not that the store rejected you.
• Refunds go back to your card issuer first and can take three to five business days to appear in your account, even if the store processes them immediately.
• Chargebacks let you dispute a charge with your bank, but the store gets penalized and may stop accepting your card if you file too many.

How the payment chain works, step by step

You enter your card details on the store's website or app. The payment gateway immediately encrypts that information so the store's servers never store your full card number. The gateway sends the encrypted data to the payment processor, which is usually a separate company hired by the store's bank.

The processor routes your transaction to your card network (Visa, Mastercard, American Express, or Discover). The network sends it to your bank—the card issuer—which checks your account balance, your credit limit, and whether the transaction matches your spending patterns. Your bank sends back an approval or decline code. If approved, the processor sends that code back to the gateway, which displays a confirmation on the store's checkout page. The entire process usually takes two to five seconds.

The money does not move immediately. Your bank holds the approved amount in a temporary state called authorization. The store's bank—the acquiring bank—does not receive the actual funds until the store submits a batch of transactions, usually at the end of the business day. The acquiring bank then requests the money from your bank, which transfers it. Depending on the banks involved, this settlement can take one to three business days.

Why some transactions get declined

A decline almost never means the store rejected you. It means one of the banks in the chain said no. The most common reasons are: your bank flagged the transaction as potentially fraudulent (especially if you are buying from a new store, in a new location, or for an unusually large amount); your card is expired or you entered the wrong expiration date; you do not have enough available credit or funds; or the card network itself blocked the transaction because the store is in a high-risk category.

If your card is declined, contact your bank directly—not the store. Your bank can tell you the specific reason and can approve the transaction if it was a false alarm. Some banks let you pre-approve large or unusual purchases through their app or website. If you are buying from a store your bank does not recognize, calling your bank before you shop can prevent a decline.

Stores sometimes use address verification and CVV checks to reduce fraud. Address verification compares the billing address you enter to the address your bank has on file. CVV (the three-digit code on the back of your card) is a basic check that you physically have the card. Neither is foolproof, and both can cause false declines if your address has changed or if you mistype.

Fees the store pays and why they matter to you

Every online transaction costs the store money. The interchange fee—set by the card networks, not the processor—is usually 1.5 to 2.5 percent of the sale. The assessment fee (charged by Visa, Mastercard, etc.) is typically 0.1 percent. The processor fee (charged by the payment processor) is usually 0.3 to 1 percent plus a flat amount per transaction, often 20 to 30 cents. Together, these add up to roughly 2 to 3.5 percent of every sale, plus that per-transaction fee.

Stores pass these costs along in the prices you see. A store that accepts only cash can charge less because it has no payment processing costs. A store that accepts many payment methods pays more in fees and may charge higher prices to cover them. Some stores add a "convenience fee" or "processing fee" at checkout—this is legal in most states, though a few states cap or ban it. That fee goes to the store or processor, not to your bank.

Certain card types cost stores more to process. Business cards, rewards cards, and premium credit cards carry higher interchange fees than basic cards. Some stores try to discourage these by charging a higher fee at checkout, though this is not allowed for debit cards in most cases. If you see a fee that seems wrong, check the store's policy or ask customer service what it covers.

How refunds work and why they take time

When you return an item or cancel an order, the store initiates a refund through the same payment processor. The processor sends a message to your bank saying "reverse this charge." Your bank then reverses the authorization and sends the money back to the store's bank. This process can take three to five business days, sometimes longer if your bank is slow or if the transaction was already settled.

The delay is not the store's fault in most cases. Once the store processes the refund, it is out of their hands. Your bank controls when the money reappears in your account. Weekends and holidays add extra days because banks do not process transactions on those days. If a refund was supposed to post and did not, contact your bank first—they can see whether the refund arrived and why it has not shown up yet.

Some stores issue refunds as store credit instead of returning money to your card. This is faster for the store (no bank processing needed) but locks you into using that store again. Always check the store's refund policy before you buy. If a store refuses to refund to your original payment method, you have the right to dispute the charge with your bank through a chargeback.

Chargebacks and what happens when you dispute a charge

A chargeback is a dispute you file with your bank when you believe a charge is wrong or fraudulent. You contact your card issuer and explain why you want the charge reversed. Your bank then contacts the store's bank and asks for evidence that the transaction was legitimate. The store has a chance to respond with proof—usually a receipt, shipping confirmation, or your signature.

If your bank sides with you, the money goes back to your account and the store loses it. If the store provides proof you authorized the purchase, your bank may side with the store and the charge stays. Chargebacks are powerful but come with a cost: stores that receive too many chargebacks get flagged as high-risk, and payment processors may drop them or charge them higher fees. If you file chargebacks frequently, stores and processors may refuse to work with you.

Use chargebacks only when you genuinely did not authorize a charge or when a store refuses to refund you after a legitimate return. For most disputes, contacting the store first is faster and does not damage your relationship with payment processors. If a store is unresponsive, then file a chargeback.

Different payment methods and how they are processed differently

Credit cards, debit cards, and digital wallets (Apple Pay, Google Pay) all move through the same basic chain, but they have different rules. Credit card transactions are authorized against your credit limit, not your bank balance. Debit card transactions pull directly from your checking account and are authorized against your available balance. Digital wallets encrypt your card details and send a token instead of your actual card number, which adds a layer of security.

ACH transfers (bank-to-bank transfers) and bank account payments skip the card networks entirely. The store's processor connects directly to your bank and requests money from your checking account. These are slower (usually one to three business days) but cheaper for the store, so some stores offer a discount if you pay by ACH. The downside is that ACH disputes are harder to file and take longer to resolve than credit card chargebacks.

Buy now, pay later services (Affirm, Klarna, Afterpay) act as a middleman. You authorize the service to charge your card or bank account in installments, and the service pays the store immediately in full. The store gets paid like a normal credit card transaction, but you owe the service, not the store. These services charge stores higher fees, which is why they are not available everywhere.

Fraud prevention and why stores ask for extra information

Stores and payment processors use fraud detection software to spot suspicious patterns. If you buy from a new store, make a large purchase, or buy from a different country than usual, the software may flag the transaction for extra checks. Some stores ask for a phone number, email, or billing address to verify you are who you say you are. Others use 3D Secure, a system that sends a verification code to your phone or email before the charge goes through.

These checks slow down checkout but protect both you and the store. If someone steals your card number and tries to use it, fraud detection can catch it before the charge is approved. The downside is false positives—legitimate purchases get flagged and declined. If this happens to you, contact your bank and ask them to whitelist the store, or call the store's customer service and ask if they can manually verify the transaction.

Stores also use tokenization, which means they store a token (a stand-in code) instead of your actual card number. If the store's database is hacked, the hackers get tokens, not card numbers. Tokens are useless without the payment processor's key, so your card stays safe. This is why major stores and payment processors push for tokenization—it reduces their liability if they are breached.

Frequently Asked Questions

Why did my card get declined even though I have money in my account?

Your bank likely flagged the transaction as suspicious based on your spending patterns, the store's location, or the amount. Call your bank and ask why it was declined. They can approve the transaction and add the store to a whitelist so future purchases go through. If your card is expired or you entered the wrong expiration date, that will also cause a decline.

How long does a refund actually take?

The store usually processes refunds within one to two business days, but your bank controls when the money appears in your account. Most refunds show up within three to five business days after the store processes them. Weekends and holidays add extra time. If more than five business days have passed, contact your bank to see if the refund arrived on their end.

Can I get my money back if I change my mind about a purchase?

That depends on the store's return policy, not on the payment method. Check the store's website or your receipt for the return window and conditions. If the store refuses to refund you and you believe you have a valid reason, you can file a chargeback with your bank, but this should be a last resort because stores penalize frequent chargebacks.

Is it safe to enter my card number on a website?

If the website uses a secure payment gateway (look for "https://" and a lock icon in your browser), your card number is encrypted before it leaves your device. The store's servers should never store your full card number. Avoid entering card details on unsecured websites (those without "https://") or on public Wi-Fi without a VPN. Using a digital wallet like Apple Pay or Google Pay adds extra encryption.

What is the difference between a payment processor and a payment gateway?

A payment gateway is the software that encrypts your card details and sits on the store's checkout page. A payment processor is the company that routes your transaction to the card networks and banks. Some companies offer both services; others specialize in one. As a customer, you interact with the gateway; the processor works behind the scenes.