Credit card authorization works as a rapid, encrypted conversation between four parties: the merchant, the merchant’s bank, the card network, and your issuing bank. In the one or two seconds between when you tap, swipe, or hit submit and when the terminal shows “approved,” your card details travel through that chain, your bank checks your available credit and runs fraud screens, and a response code travels back the same route. The sale only completes if your issuer says yes.
Authorization is just permission, though. It sets aside funds; it doesn’t move them. The actual transfer happens later, during settlement.
The Four Parties in the Chain
Every authorization involves at least four participants, and the sequence makes more sense once you know who they are.
The merchant is the business accepting your card. Every merchant has a relationship with an acquiring bank (sometimes called the merchant’s bank), which provides the account and infrastructure that lets the business accept cards in the first place. The acquirer is the merchant’s point of contact for everything payment-related.
The card network — Visa, Mastercard, Discover, or American Express — is the routing layer. Visa and Mastercard don’t issue cards or extend credit; they set the rules everyone follows and move transaction data between banks that may have no direct relationship with each other. Discover and American Express are exceptions that can act as both the network and the issuer.
The issuing bank is your bank, the institution that gave you the card and extended your credit line. When an authorization request lands, the issuer decides whether to approve or decline based on your balance, spending patterns, and fraud risk.
For online purchases, one more piece matters: the payment gateway. The gateway encrypts your card details at checkout and hands them off to the payment processor, which manages communication with the networks and banks. In a store, the physical card terminal handles that gateway function automatically.
The Authorization Sequence, Step by Step
Here is what actually happens in that one-to-two-second window after your card is presented:
- Step 1 — The request is built. The merchant’s terminal (or the online checkout) packages your card data, the transaction amount, and merchant details into a standardized financial message format called ISO 8583, the messaging protocol used across the payment industry.1IBM. ISO8583 Messaging Standard
- Step 2 — The acquirer receives it. The message travels to the acquiring bank or its payment processor, which reads the card number and figures out which card network the transaction belongs to.
- Step 3 — The network routes to your issuer. The card network forwards the request over its secure infrastructure to the bank that issued your card.
- Step 4 — Your issuer evaluates. Your bank checks your available credit, confirms the account is in good standing, and runs the transaction through fraud-detection algorithms. This assessment happens in milliseconds.
- Step 5 — The response comes back. The issuer generates a response code and sends it back through the network to the acquirer, then to the merchant terminal. Approval triggers the sale; a decline prompts the cashier or website to ask for another payment method.
The whole round trip retraces the same path in reverse. If anything breaks in that chain, a network outage, an unrecognized merchant code, a flagged account, the transaction stalls or declines.
What Data Actually Gets Sent
Several pieces of information are pulled from your card in a fraction of a second. The primary account number, the long number across the front, identifies your specific account and issuing bank. Most cards carry 16 digits; American Express uses 15. The expiration date confirms the card hasn’t lapsed. The three- or four-digit security code on the back (CVV or CVC) helps verify that whoever is entering the number actually has the physical card.
Alongside the card data, the terminal sends the transaction amount and a merchant identification number that tells the network who is requesting the charge. A merchant category code classifies the type of business, which can affect your card’s rewards rate or how the transaction is categorized on your statement.
How that data gets captured depends on the payment method. An EMV chip generates a unique encrypted token for each transaction. A magnetic stripe transmits static data, which is less secure and part of the reason many retailers have stopped accepting swipes. Manual entry handles online and phone orders where the card isn’t physically present.
All of this sensitive data is governed by PCI DSS, a set of security requirements maintained by the Payment Card Industry Security Standards Council. Any business that stores, processes, or transmits card data has to follow these protocols, which cover everything from encryption standards to network access controls.2PCI Security Standards Council. Payment Card Data Security Standard (PCI-DSS) – PCI Security Standards Overview
Fraud Checks Running in the Background
Authorization isn’t only about your balance. Several fraud-prevention tools run at the same time.
Address Verification Service
For online and phone orders (called “card not present” transactions), merchants can use the Address Verification Service. When you type in your billing address at checkout, the system compares what you entered against the address your issuing bank has on file. The issuer returns a code indicating whether the street number, the zip code, both, or neither matched. A full mismatch doesn’t always trigger an automatic decline, but it raises a flag the merchant can act on. Issuers in the United States and Canada are required to support AVS checks when merchants request them.
3D Secure Authentication
You may have seen an extra pop-up during an online purchase asking you to confirm your identity with a one-time code texted to your phone, or a biometric scan. That’s 3D Secure, an authentication protocol branded as Visa Secure, Mastercard Identity Check, or American Express SafeKey depending on your card. It adds a layer between the merchant and the issuer: instead of relying only on card data, the issuer directly confirms that the person completing the purchase is the actual cardholder. This shifts fraud liability away from the merchant for authenticated transactions, which is why more online retailers now use it.
What Decline Codes Mean
When your card is declined, the issuer sends back a two-digit response code explaining why. The cashier or website usually just shows a generic “declined” message, but behind the scenes the code is more specific:
- Code 00 — Approved. Everything checked out.
- Code 05 — Do not honor. The issuer rejected the transaction without providing a detailed reason. This is the most common decline code and often requires calling your bank to resolve.
- Code 12 — Invalid transaction. Something about the request itself was malformed or unsupported.
- Code 14 — Invalid account number. The card number doesn’t match any account on file, which can happen with a typo during manual entry.
- Code 41 — Lost card. The issuer has flagged the card as reported lost and may instruct the merchant to retain it.
- Code 51 — Insufficient funds. Your available credit or balance can’t cover the transaction amount.
If you see a decline you don’t understand, your issuing bank is the only party that can explain the specific reason and lift any blocks. Merchants and their processors can see the code but can’t override the issuer’s decision.
How Contactless and Mobile Payments Fit In
Tapping your phone or a contactless card follows the same authorization sequence, with one important difference: your actual card number never reaches the merchant. The system uses a process called tokenization. Your device or contactless chip generates a one-time-use token, a substitute number that maps back to your real account only within the card network’s secure systems.3EMVCo. EMV Payment Tokenisation: What, Why and How
When you hold your phone near the terminal, NFC (near-field communication) transmits that token along with a one-time cryptogram that proves the transaction is legitimate. The token travels from the terminal to the acquirer, through the card network, and to your issuer, the same path as any other authorization. Your issuer translates the token back to your real account number, runs its balance and fraud checks, and sends an approval or decline. Because the token is useless if intercepted (it can’t be replayed for another purchase), contactless payments are actually more secure than a traditional magnetic stripe swipe.
Authorization Holds and Settlement
An approved authorization doesn’t move money. It creates a temporary hold on your account and reduces your available credit by the transaction amount. A $50 purchase on a card with a $1,000 limit drops your available credit to $950 even though the charge hasn’t officially posted yet. The hold reserves those funds for the merchant until the transaction is finalized.
Most holds from standard retail purchases clear within a day or two, once the merchant submits the transaction for settlement. Some industries hold longer, and sometimes for more than the final charge. Hotels typically place a hold at check-in that covers your room rate plus estimated incidentals, and depending on the network the original hold can take anywhere from 24 hours to a full week to disappear from your available credit. Visa allows holds to remain for up to 30 days; American Express caps them at seven. Pay-at-the-pump gas stations work differently again, since the pump doesn’t know how much fuel you’ll buy. It sends a pre-authorization for a set dollar amount, which has recently been raised to $175 for Visa and Mastercard. Pump $30, and your available credit may still show the $175 reduction until the hold clears.
From Authorization to Settlement
At the end of each business day, most merchants “batch out” their authorized transactions: they bundle every approved sale and submit the batch to their payment processor. The processor routes each transaction through the appropriate card network to the issuing banks, which release the held funds and transfer them to the acquiring bank. The acquiring bank deposits the money (minus processing fees) into the merchant’s account. Settlement typically takes one to three business days for domestic transactions, at which point the charge on your statement moves from “pending” to “posted.”
Timing matters. If a merchant waits too long to batch out, the hold on your account can expire before settlement occurs. When that happens, your available credit temporarily bounces back up before the final charge hits, which can be confusing when you’re watching your statement.