How Payment Rails Actually Work: From Card Swipe to Settled Funds
Payments Infrastructure · February 3, 2026 · 9 min read
Ask a shopper how a card payment works and you will hear something like: “I tap, the bank checks my balance, the shop gets the money.” Every clause in that sentence is wrong in an interesting way. The tap does not move money. The bank rarely checks a balance. And the shop gets the money somewhere between one and five business days later, minus a fee it probably could not explain if you asked.
Understanding what really happens is not academic trivia. Almost every hard problem in payments — chargebacks, reconciliation breaks, failed payouts, surprise fee lines, fraud liability — lives in the gap between the shopper’s mental model and the machinery underneath.
The four-party model
Card payments are built on what the industry calls the four-party model. Despite the name, five actors matter.
The cardholder holds a card. The issuer is the bank that gave them that card and that carries the credit or holds the deposit. The merchant wants to be paid. The acquirer is the merchant’s bank, the institution that is contractually on the hook to accept card transactions on the merchant’s behalf. And in the middle sits the network — Visa, Mastercard, and their peers — which is not a bank at all but a set of rules, a message format, and a switch that routes traffic between thousands of issuers and acquirers.
The network’s real product is not technology. It is the rulebook. Visa and Mastercard publish thousands of pages defining who is liable when something goes wrong, what evidence wins a dispute, how fees are calculated, and what data must appear in each message. Every processor, gateway, and orchestration layer you might buy is ultimately a wrapper around compliance with those rules.
Step one: authorization
When a card is tapped, dipped, or entered into a checkout form, the terminal or gateway assembles an authorization request. It carries the card credential, the amount, the currency, the merchant category code, and an increasingly large payload of contextual data: device fingerprint, address details, 3-D Secure results, merchant-assigned risk scores.
That request travels from the merchant to its acquirer or processor, into the network, and on to the issuer. The issuer runs it through its own decisioning stack — velocity checks, behavioural models, open-to-buy calculations, sanctions screening — and returns an approval or a decline, typically in a few hundred milliseconds.
Two things are widely misunderstood here.
First, an approval is not a payment. It is a promise plus a hold. The issuer sets aside the amount against the cardholder’s available credit or balance and commits to honour the transaction if the merchant presents it correctly. No funds have left any account.
Second, authorization holds expire. Depending on the merchant category and network rules, an authorization is valid for roughly seven to thirty days. Miss that window and the merchant must reauthorize — often at the cost of a fresh decline, because the card may have been reissued, the balance may have shifted, or the issuer’s model may simply have grown more cautious.
Step two: capture and clearing
Capture is the merchant saying, in effect, “I have delivered — bill it.” In retail, capture usually follows authorization within seconds. In e-commerce, it should follow shipment. In travel and hospitality, it can be weeks later and for a different amount than the original authorization.
Captured transactions are batched and submitted into clearing, the process by which the network takes the day’s presentments, calculates who owes what to whom, and produces the definitive record. Clearing files are where interchange is finally assessed, where the fee tiers you actually qualified for are determined, and where data quality quietly turns into money. A transaction missing enhanced Level 2 or Level 3 data on a commercial card does not fail — it simply downgrades to a more expensive interchange category, and the difference shows up on a statement nobody reads line by line.
Step three: settlement
Settlement is the only step where money genuinely moves, and it happens between banks, not between a shopper and a shop.
The network nets each participant’s position and instructs settlement across accounts held at settlement banks. Issuers pay acquirers the transaction value less interchange. Acquirers then credit merchants, less their own markup and the network’s assessment fees. Funds typically reach a merchant’s account one to three business days after capture, and longer for higher-risk categories where the acquirer holds a rolling reserve against future chargebacks.
This is why “instant payout” products exist and why they are priced the way they are. Nobody has made the underlying rails faster. Somebody has agreed to advance the money and take the timing risk in exchange for a fee — a lending product wearing a payments costume.
Where the money actually goes
For a typical card-not-present transaction in a developed market, the merchant discount rate breaks into three pieces.
Interchange is the largest share and goes to the issuer. It is set by the network, varies by card type, geography, channel, and data quality, and is not negotiable by the merchant. Premium rewards cards carry higher interchange, which is precisely how the rewards are funded.
Network assessments are relatively small, flat-ish fees that go to Visa or Mastercard for use of the switch and the rulebook.
Acquirer markup is the only genuinely negotiable component and the only part your processor keeps. On blended pricing this is invisible; on interchange-plus pricing it is explicit. The shift toward interchange-plus among mid-market merchants over the past decade has been driven almost entirely by finance teams discovering how much variance was hiding inside a single blended rate.
The reverse flow: refunds, disputes, chargebacks
Money also travels backwards, and the reverse paths are where operational pain concentrates.
A refund is a new transaction in the opposite direction. It clears and settles on its own timeline, which is why a shopper who was refunded on Friday may not see funds until Wednesday and will blame the merchant for the delay.
A dispute begins when a cardholder contacts their issuer. The issuer may resolve it internally or initiate a chargeback, pulling funds from the acquirer, which pulls them from the merchant, usually with a fee attached. The merchant can represent the transaction with evidence, and the case may escalate to network arbitration.
The economics here are asymmetrical by design. Networks and issuers optimise for cardholder trust, because cardholder trust is what makes the whole system usable. Merchants absorb the residual risk. That is the bargain implicit in accepting cards, and it is why fraud prevention at the merchant is a revenue function rather than a compliance chore.
Beyond cards
Cards dominate the conversation, but they are one rail among many, and each has a different shape.
ACH and SEPA move money in bulk between bank accounts cheaply and slowly, with the crucial property that ACH debits can be returned days later — making them fast-looking but slow-clearing. RTP, FedNow, and Faster Payments move funds in seconds with genuine finality, which removes settlement risk and simultaneously removes the merchant’s ability to reverse a mistake. Wires are expensive, irrevocable, and still the backbone of high-value B2B. Wallets such as Apple Pay and Google Pay are not rails at all but tokenised presentation layers riding on cards, while wallets like Pix, UPI, or Alipay genuinely are alternative rails with their own economics.
Choosing a rail is really choosing a risk profile: how fast, how reversible, how expensive, and who eats the loss when it goes wrong.
What practitioners should take away
Three habits separate teams that run payments well from teams that merely have payments.
They instrument every stage separately. Authorization rate, capture rate, settlement completeness, and dispute rate are different metrics with different owners. A team that tracks only “payment success” cannot tell a gateway outage from an issuer tightening its models.
They treat data quality as pricing strategy. Passing richer transaction data, using network tokens, sending accurate merchant descriptors, and reauthorizing intelligently all move basis points — quietly, at scale, without a single renegotiation.
And they design for reversal from day one. Refunds, partial captures, disputes, and failed payouts are not exceptions. They are ordinary states in a system where money moves days after the customer thinks it did.
The tap is theatre. The interesting part happens afterwards.