How does a payment gateway process a card payment? Step by step

A payment gateway processes a card payment by collecting the card details securely, authenticating the cardholder with 3-D Secure where needed, and sending an authorization request through the acquirer or processor and the card network to the issuing bank, which approves or declines it. Approved payments are then captured, cleared between acquirer and issuer, settled through the network and paid out to the merchant's bank account. The gateway is the merchant's entry point, the issuer makes the decision, and the network and acquirer move the messages and the money.

Who is involved in a card payment?

Five parties usually touch an online card payment, although one company can play several of these roles. Payment aggregator vs gateway vs processor explains how the roles get bundled into one contract.

How does a payment gateway process a card payment, step by step?

1. Collect and authenticate. The customer enters the card in a gateway-hosted page or hosted fields, or uses a saved token. If authentication is required or chosen, the gateway runs 3-D Secure, which EMVCo describes as a messaging protocol that exchanges data between the merchant, the card issuer and, in some cases, the consumer to authenticate the consumer and prevent card-not-present fraud. EMVCo: EMV 3-D Secure The outcome is frictionless or a challenge.
2. Authorize. The gateway sends the request to the acquirer or processor, which formats it for the network, commonly as an ISO 8583 message, and the network routes it to the issuer. Mastercard describes this stage as transporting authorization requests, responses, cancellations and advice messages to confirm the cardholder, the card and available funds. Mastercard: Switching explained An approval places a hold on funds; no money moves yet.
3. Capture. The merchant confirms the amount to collect, either at once (a sale) or later (authorize now, capture on shipment). Stripe's documentation notes that for most card networks the default authorization validity is 7 days for online payments, with extended validity of up to 30 days depending on the network; an uncaptured hold lapses. Stripe: place a hold on a payment method
4. Clear. The acquirer submits captured transactions to the network, which passes them to issuers. Mastercard defines clearing as the exchange of transaction details between acquirer and issuer so the transaction can be posted to the cardholder's account and the settlement position reconciled, and says it usually happens within one day for dual-message transactions. Mastercard: Chargebacks Made Simple
5. Settle. The network calculates each acquirer's and issuer's net position and transfers funds. In Mastercard's description, the issuer pays the acquirer the transaction value minus interchange, and the acquirer pays the merchant net of its discount. Mastercard: Chargebacks Made Simple
6. Fund. The acquirer or payment provider pays the merchant's bank account on its contracted payout schedule, after fees and any reserve. The merchant agreement sets this timing, not the gateway API.

What is the difference between authorization, capture, clearing and settlement?

Each step produces different evidence, and money moves only in the last two.

The practical consequence: an approval is not revenue, and a capture is not cash. Reconciliation has to match authorization, capture, settlement and bank credit as separate records.

What happens when a card payment is declined or times out?

A payment can be stopped by the gateway's own risk rules, a processor format check, the network or the issuer. Keep the source of the decision and the original reason code next to the status you show the customer, because "declined" alone does not tell operations who can fix it. Card decline codes and retry rules covers which declines are worth retrying.

A timeout is not a decline. If the gateway receives no response, the result is unknown and the issuer may have approved. Query the transaction or wait for the provider's notification before sending a new attempt, and reuse the same idempotency key on retries. If an order is cancelled after approval, release the hold through the provider's void or cancellation operation.

How do UK and EU rules change the flow?

In the EEA, PSD2 requires strong customer authentication (SCA) for electronic payments initiated by the payer, and Commission Delegated Regulation (EU) 2018/389 sets the technical standards and exemptions, including low-value and low-risk remote transactions identified through transaction monitoring. EUR-Lex: Regulation (EU) 2018/389 In the UK, the FCA states that payment service providers must apply SCA where a payment service user initiates an electronic payment transaction, and it expected full SCA compliance for e-commerce by 14 March 2022. FCA: deadline extension for SCA

That makes step 1 a regulated step for online card payments in those regions, and exemption choices affect both conversion and liability; see PSD2 SCA exemptions. Elsewhere, including the US, UAE and Saudi Arabia, check local regulation and scheme rules with your acquirer before deciding when to authenticate.

What should a merchant check with its gateway?

• Which acquirer and processor sit behind the gateway for each market and card brand.
• Whether authorization and capture are combined or separate, and how long holds last for your transaction types.
• How 3-D Secure is triggered, which exemptions are requested and who owns that logic.
• Whether decline sources and reason codes are passed through, not just a generic failure.
• How unknown results are resolved: status query, notification and idempotency.
• When settlement and funding happen, in which currency, and which reports prove them.

Choose a payment gateway with a responsibility map turns these questions into a selection exercise.

FAQ

Does the payment gateway decide whether a card payment is approved?

No. The issuing bank approves or declines. The gateway can reject a request on its own risk rules or a validation error, but it does not approve on the issuer's behalf.

How long does a card authorization hold last?

It depends on the network and transaction type. Stripe's documentation gives 7 days as the default for most networks' online payments, with extended holds of up to 30 days where the network allows them.

Is 3D Secure the same as authorization?

No. 3-D Secure authenticates the cardholder; authorization is the issuer's decision on the payment. A payment can pass authentication and still be declined.

When does the merchant actually receive the money?

After clearing, settlement and the acquirer's payout, on the schedule set in the merchant's acquiring or provider agreement.

What is the difference between a payment gateway and a payment processor?

The gateway is the merchant-facing entry point that collects and routes the payment; the processor connects to the card networks and handles the transaction messages. See aggregator vs gateway vs processor.