How Web Payments Work: From Your Click to the Merchant's Account

What happens when you pay online

A web payment is any transaction you make through a website or app using a card, bank account, or digital wallet. The moment you click "pay," your information travels through several systems in sequence: your browser encrypts it, a payment processor receives it, a bank approves or declines it, and the merchant gets a confirmation. The whole chain usually takes seconds, but each step has a specific job and a specific company doing it.

You do not send your payment directly to the merchant. Instead, your information goes to a payment gateway—software that sits between the website and the payment processor. The gateway collects your details, encrypts them so they cannot be read in transit, and passes them along. The processor then contacts your bank (or card issuer) to verify you have the funds and permission to spend them. Once approved, the processor tells the merchant the payment went through, and the merchant tells you the transaction is complete.

Key Takeaways

• Your payment information is encrypted before it leaves your device and never sits on the merchant's server unprotected.
• A payment processor and your bank both verify the transaction before money moves, which is why some payments take a few seconds to confirm.
• Merchants pay a fee to accept each payment—usually a percentage of the sale plus a flat amount per transaction.
• If a payment fails, the most common reasons are insufficient funds, a mistyped card number, or a fraud block from your bank.
• Chargebacks let you dispute a payment with your bank if the merchant does not deliver or you were charged twice.

The three main systems in a web payment

Every online payment involves three separate entities: the payment gateway, the payment processor, and the acquiring bank. The gateway is the software interface you see—the form where you type your card number. The processor is the company that handles the transaction behind the scenes, checking with your bank and moving the money. The acquiring bank is the merchant's bank, which receives the funds and deposits them into the merchant's account.

Some companies combine these roles. Stripe, for example, acts as both gateway and processor. Square does the same. Smaller merchants often use PayPal, which handles all three functions. Larger retailers may use separate vendors for each step, which gives them more control but requires more setup. The merchant chooses which system to use based on their size, the types of payments they want to accept, and how much they want to pay in fees.

Your bank is also in the chain. When the processor sends your transaction to your bank, your bank checks whether the card is active, whether you have enough money (for debit) or available credit (for credit cards), and whether the transaction looks suspicious. If your bank suspects fraud—a purchase in a different country, an unusually large amount, or a merchant you have never used—it can block the payment automatically. You can usually unblock it by calling your bank or confirming the transaction through your banking app.

Why some payments fail and what to do

A payment can fail at several points, and the reason usually tells you how to fix it. If your card is declined, the most common cause is insufficient funds, an expired card, or a typo in the card number or security code. Try entering your information again, slowly, and check that your card has not expired. If it fails a second time, contact your bank—they may have flagged the transaction as suspicious or your account may have a hold on it.

If the payment goes through but the merchant's website shows an error, the money may still have been taken from your account. This happens when the connection breaks after your bank approves the payment but before the merchant receives the confirmation. Check your bank statement or app within a few minutes. If the charge appears, contact the merchant immediately with your transaction ID (usually in your email receipt) and ask them to cancel the duplicate. Most merchants can reverse it within 24 hours.

Some merchants use address verification or CVV checks to reduce fraud. If your billing address does not match what your bank has on file, or if you enter the wrong three-digit security code on the back of your card, the payment will fail. Update your address with your bank before trying again, or call the merchant to ask if they can process the payment manually.

Fees merchants pay and why they matter to you

Every time you pay online, the merchant pays a fee to accept that payment. The fee is usually split between the payment processor and the acquiring bank, and it typically ranges from 2% to 3% of the sale plus a flat amount per transaction (often 30 cents). For a $100 purchase, the merchant might pay $2.30 to $3.30. For a $10 purchase, the flat fee makes up a larger share, so the merchant's total cost is proportionally higher.

Some merchants pass these fees to you by charging higher prices or adding a "convenience fee" at checkout. Others absorb the cost. A few merchants offer discounts if you pay by debit card or bank transfer instead of credit card, because those methods have lower fees. You will also see higher fees at small businesses and nonprofits than at large retailers, because large retailers negotiate lower rates based on their volume.

Merchants also pay for payment gateway software, which can cost $20 to $300 per month depending on the provider and features. This is why very small businesses sometimes use free or low-cost options like PayPal or Square, which charge per transaction instead of a monthly fee.

How encryption keeps your card number safe

When you enter your card number on a website, your browser encrypts it before it leaves your device. Encryption scrambles the information using a mathematical code that only the payment processor can unscramble. Even if someone intercepts the data while it travels across the internet, they see only gibberish.

The merchant's website itself does not store your full card number. Instead, the payment processor stores it in a secure vault and gives the merchant a token—a random string of characters that represents your card but is useless to a thief. If the merchant's database is hacked, the hacker gets tokens, not card numbers. Tokens can only be used by the payment processor that issued them, and only for transactions you have authorized.

Look for a padlock icon in your browser's address bar and a URL that starts with "https://" (not "http://"). These indicate your connection to the website is encrypted. However, encryption protects data in transit; it does not may provide the merchant is trustworthy. Always buy from merchants you recognize or that have reviews from other customers.

Chargebacks: disputing a payment with your bank

If you are charged twice for the same purchase, charged for something you did not receive, or charged by a merchant you did not authorize, you can file a chargeback with your bank. A chargeback is a formal dispute that tells your bank to reverse the charge and investigate. Your bank will contact the merchant and ask them to prove the transaction was legitimate. If the merchant cannot provide proof, your bank returns the money to you.

Chargebacks take time—usually 30 to 90 days—because your bank and the merchant's bank go back and forth exchanging documents. During that time, the charge remains on your account, but your bank may issue a temporary credit while they investigate. If the merchant provides proof that you authorized the purchase and received what you paid for, your bank will side with the merchant and the charge will stick.

Before filing a chargeback, try contacting the merchant directly. Many disputes are resolved faster that way. Ask for a refund in writing and keep a copy of your request. If the merchant ignores you or refuses, then file the chargeback through your bank's app or website, or call the customer service number on the back of your card.

Different types of web payments

Credit cards and debit cards are the most common web payment methods, but they are not the only ones. Digital wallets like Apple Pay, Google Pay, and PayPal store your card information securely on your phone or computer and send an encrypted token to the merchant instead of your actual card number. Bank transfers (also called ACH or direct debit) move money directly from your bank account to the merchant's account, with no card involved. Buy now, pay later services like Afterpay and Klarna let you split a purchase into installments, and they pay the merchant upfront on your behalf.

Each method has different fees for the merchant, different protections for you, and different speeds. Credit cards offer the most buyer protection through chargebacks and fraud liability limits. Bank transfers are cheapest for the merchant but offer less protection to you if something goes wrong. Digital wallets are faster because you do not have to type your information each time. Buy now, pay later services charge the merchant a higher fee but can increase sales because customers are willing to spend more when they can split payments.

What to watch for when paying online

Before you enter your payment information, check that the website is the real merchant, not a fake site designed to steal your data. Scammers create websites that look almost identical to popular retailers. Type the merchant's URL directly into your browser instead of clicking a link in an email or text message. Check the padlock icon and make sure the URL starts with "https://". Hover over links to see where they actually go before you click them.

Be cautious of websites that ask for unusual information, like your Social Security number or your mother's maiden name, before you pay. Legitimate merchants do not need this for a purchase. Be wary of prices that seem too good to be true—if a brand-new item costs 90% less than everywhere else, the site may be counterfeit or the item may not exist.

After you pay, save your receipt and confirmation number. If there is a problem later, you will need proof of the transaction. Check your bank statement within a few days to make sure you were charged the correct amount and only once. If you see a charge you do not recognize, report it to your bank immediately.

Frequently Asked Questions

Is it safe to save my card number on a website?

It depends on the website. Major retailers like Amazon and Target use encrypted vaults and tokens, so your full card number is not stored on their servers. Smaller or less secure websites may store it in ways that put it at risk. If you trust the merchant and they use a major payment processor (Stripe, Square, PayPal), it is generally safe. If you are unsure, do not save it—you can always type it in again next time.

Why did my payment get declined even though I have money in my account?

Your bank may have flagged the transaction as suspicious, especially if it is from a new merchant, a different country, or an unusually large amount. Call your bank's customer service number on the back of your card and ask them to approve the transaction. You can also try again in a few minutes—sometimes the block is temporary. If it keeps failing, ask the merchant if they can process it manually or offer a different payment method.

How long does it take for a refund to show up in my account?

If the merchant processes a refund immediately, it still takes 3 to 5 business days for the money to return to your account. This delay happens because the refund has to travel through the payment processor and your bank. Some banks show the refund faster if you use their app. If more than a week has passed, contact the merchant to confirm they issued the refund, and ask for the refund transaction ID.

What is the difference between a payment gateway and a payment processor?

The gateway is the form you see on the website where you enter your card number. The processor is the company behind the scenes that handles the transaction, contacts your bank, and moves the money. Some companies like Stripe provide both. Others specialize in one or the other. For you as a customer, the difference does not matter much—both are encrypted and secure.

Can I get my money back if I change my mind about a purchase?

That depends on the merchant's return policy, not on the payment method. Most merchants allow returns within 30 days if the item is unused. Some do not accept returns at all. Check the merchant's website before you pay. If you paid by credit card and the merchant refuses a legitimate return, you can file a chargeback with your bank, but this should be your last resort after you have tried to work it out with the merchant directly.