Debit card processing works by moving money electronically from a customer’s checking account to a merchant’s bank account through a chain of five parties: the cardholder, the merchant, the merchant’s acquiring bank, the cardholder’s issuing bank, and a card network that connects the two banks. The transaction happens in two phases. Authorization, the part the customer sees, finishes in one to two seconds. Clearing and settlement, when the money actually moves, takes one to three business days. Along the way, each participant takes a small fee, and federal rules set both the maximum interchange large banks can charge and the deadlines for disputing an unauthorized charge.
The Five Parties in Every Transaction
The cardholder starts the purchase with a physical card, a digital wallet, or a card number typed online. The merchant captures that data through a point-of-sale terminal or online checkout. The acquiring bank, sometimes called the merchant bank, holds the merchant’s commercial account and receives the settlement funds. The issuing bank holds the cardholder’s checking account and approves or declines each transaction based on available funds. Card networks — Visa, Mastercard, and PIN-debit networks like STAR, Pulse, and NYCE — route the messages between the two banks, set the interchange fee schedules, and write the operating rules everyone follows.
Many merchants sign up for processing through an independent sales organization rather than directly with an acquiring bank. ISOs are third-party sales companies registered with Visa and Mastercard and sponsored by an acquiring bank. They sell, install, and support merchant accounts, bundling hardware, software, and processing into one package, and earn residual commissions based on monthly volume. That commission structure sometimes encourages higher markups. Merchants with the volume to negotiate directly with an acquirer or a large processor can often cut costs by skipping the ISO layer.
Authorization: The First Two Seconds
When a customer taps, swipes, or inserts a card, the terminal packages the card number, expiration date, transaction amount, and (for PIN transactions) the encrypted PIN into an authorization request. That request travels from the terminal to the acquiring bank, which forwards it through the appropriate card network to the issuing bank.
The issuing bank runs three checks at high speed: Is the account open? Is the card valid? Are there sufficient funds? If all three pass, it returns an approval code and places a hold on the purchase amount. If any fails, it returns a decline code. Common decline codes include insufficient funds, expired card, incorrect CVV, and the vague “do not honor,” which usually means the issuer has flagged the card for a temporary hold. The whole round trip normally finishes in one to two seconds.
That approval code is a digital promise: the issuing bank has reserved those funds for this specific sale. The customer walks away with a receipt or an order confirmation. But no money has moved.
PIN-Based vs. Signature-Based Routing
Debit cards can be processed two ways, and the choice affects both security and cost. A PIN-based, or “online debit,” transaction requires the cardholder to enter a PIN at the terminal. It routes over a PIN-debit network like STAR or Pulse, and funds are debited almost immediately. A signature-based, or “offline debit,” transaction routes over Visa’s or Mastercard’s network, just like a credit card purchase, and relies on the cardholder’s signature or the card’s chip for verification. Settlement takes slightly longer because it follows the credit clearing path.
For merchants, each method carries a different fee structure. PIN-debit interchange is typically a flat per-transaction fee. Signature-debit interchange is a percentage of the sale plus a smaller flat fee. For a Visa signature debit transaction at an unregulated issuer, interchange runs around 0.80% of the sale plus a per-item charge; Mastercard’s equivalent runs somewhat higher. Which is cheaper depends on your average ticket size.
Clearing and Settlement: Where the Money Actually Moves
At the end of the business day, the merchant’s terminal or payment software bundles the day’s approved transactions into a single file called a batch and sends it to the acquiring bank. During clearing, the card network reconciles each transaction between the acquiring bank and the issuing bank, confirming final amounts and any adjustments.
Settlement follows. The issuing bank transfers the actual cash to the acquiring bank to cover the day’s sales. The acquiring bank then deposits the net amount into the merchant’s account after subtracting interchange fees, network assessments, and its own processing markup. The cycle typically takes one to three business days, depending on the processor’s agreement and whether the batch was closed on time. Forgetting to close a batch, or closing it late, can delay funding and sometimes trigger higher interchange rates because the networks penalize stale authorizations.
What Each Transaction Costs
Every debit card transaction generates three layers of cost.
- Interchange fees are paid to the issuing bank. This is the largest component. Signature debit at unregulated issuers runs roughly 0.80% to 1.05% of the sale plus a flat per-item fee; PIN debit is usually a smaller flat amount per transaction.
- Network assessment fees are paid to the card network for maintaining the system. These are small, typically a few basis points of volume plus a per-transaction charge.
- Processor markup goes to the acquiring bank, ISO, or payment processor for handling the account, providing the terminal or gateway, and managing settlement. This is the only piece a merchant can negotiate.
The Durbin Amendment Cap
The Durbin Amendment, part of the Dodd-Frank Act, limits interchange fees charged by large issuers. Any bank (together with its affiliates) holding $10 billion or more in assets is a “covered issuer,” and its interchange fee on each debit transaction cannot exceed a 21-cent base component plus 0.05% of the transaction value. Issuers that meet certain fraud-prevention standards can add 1 cent per transaction.1Federal Register. Debit Card Interchange Fees and Routing On a $50 purchase at a covered issuer, the maximum interchange fee works out to roughly 24.5 cents. Banks with assets below $10 billion are exempt and can charge higher interchange, which is why the identity of the card’s issuing bank affects the merchant’s cost.2eCFR. 12 CFR Part 235 – Debit Card Interchange Fees and Routing
The Federal Reserve proposed lowering the cap in late 2023 and has been reviewing public comments, but as of early 2026 the original cap remains in effect. If a final rule is adopted, both the base component and the ad valorem component would decrease, and the Fed would begin updating the cap every two years based on issuer cost data.3Federal Reserve. Federal Reserve Board Extends Comment Period on Interchange Fee Proposal
Pricing Models Merchants Get Billed Under
How your processor packages those three cost layers into a bill varies, and the model determines how easy it is to spot overcharges.
- Interchange-plus pricing passes through the actual interchange fee and network assessment on each transaction, then adds a fixed markup (for example, 0.15% + $0.05 per transaction). Because you see the real interchange cost on your statement, it’s the most transparent model and usually the cheapest at any meaningful volume.
- Tiered or bundled pricing sorts transactions into categories like “qualified,” “mid-qualified,” and “non-qualified,” each with a flat rate. A standard card swipe might land in the cheapest tier while a rewards card or keyed-in transaction gets bumped up. The simplicity is appealing, but the processor decides which tier each transaction falls into, and the categorization is rarely in the merchant’s favor.
- Flat-rate pricing applies a single rate to everything, such as 2.6% + $0.10 per transaction regardless of card type. Most small-business platforms price this way. It’s easy to understand, but you overpay on every debit transaction because debit interchange costs far less than the blended rate.
Most merchants start on tiered or flat-rate pricing because it’s simple. Switching to interchange-plus once monthly volume crosses a few thousand dollars is usually worth the effort. Even if you don’t switch, ask your processor for a statement in interchange-plus format. The line-item detail will show how much markup you’re actually paying.
Merchant Routing Rights
The Durbin Amendment doesn’t just cap interchange. It also gives merchants the right to choose how debit transactions are routed. Every debit card must be enabled on at least two unaffiliated payment networks, and no issuer or network can block a merchant from directing a transaction to whichever network it prefers.2eCFR. 12 CFR Part 235 – Debit Card Interchange Fees and Routing In practice, a Visa-branded debit card also carries a PIN-debit network like STAR or Pulse, and the merchant’s terminal can send the transaction to whichever network charges less.
Many merchants don’t realize they have this option, or their terminal software defaults to the signature network without asking. If you process a high volume of in-person debit transactions, configuring your terminal to prefer PIN-debit routing can meaningfully reduce interchange costs. Your processor should be able to enable “least-cost routing” in the terminal settings.
When a Transaction Goes Wrong
Two different dispute regimes apply, depending on which side of the counter you’re on.
Chargebacks: The Merchant Side
A chargeback happens when a cardholder disputes a transaction and the issuing bank reverses the charge, pulling funds back out of the merchant’s account. The processor imposes a per-dispute fee, typically between $20 and $100, regardless of whether the merchant wins or loses. The real damage often goes beyond the fee: lost merchandise, staff time, and the risk of landing in a card network’s monitoring program if your chargeback rate climbs too high.
When a merchant believes a chargeback is illegitimate, the formal response is called representment. The issuing bank notifies the acquiring bank, which notifies the merchant. The merchant then has a limited window (Visa allows 30 days) to submit a rebuttal with evidence: signed delivery confirmations, IP logs, communication records, or proof that the cardholder used the product. If the card network sides with the merchant, the funds come back. If not, the chargeback stands, and escalation to arbitration starts at several hundred dollars in fees. Missing the response deadline means an automatic loss, even on a clearly fraudulent dispute.
Unauthorized Charges: The Consumer Side
Debit cards carry weaker fraud protections than credit cards, and the difference matters because unauthorized charges hit your checking account balance directly. Under federal Regulation E, your liability depends on how quickly you report the problem.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning the card was lost or stolen: maximum liability is $50.
- Report between 2 and 60 days: liability rises to $500.
- Report after 60 days from the date your bank sends the statement showing the unauthorized charge: liability is unlimited. The bank can hold you responsible for every dollar stolen after that 60-day window.
Visa and Mastercard both offer voluntary “zero liability” policies that go beyond the federal minimum, generally shielding cardholders from any loss on unauthorized transactions reported promptly. Those are network policies, not law, and a bank can invoke the federal limits if the network’s conditions aren’t met.
Once you report an unauthorized transaction, the bank must investigate and reach a decision within 10 business days. It can extend the investigation to 45 days, or 90 days for point-of-sale debit card transactions, but only if it provisionally credits your account within those first 10 business days so you have access to the funds while it works.5eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If the bank ultimately finds no error, it can reverse the provisional credit, but it must give you written notice explaining the findings. Report unauthorized debit charges immediately: every day you wait increases both your legal exposure and the practical difficulty of recovering the money.
Security and Reporting Obligations for Merchants
Any merchant that accepts debit or credit cards must comply with the Payment Card Industry Data Security Standard (PCI DSS), maintained by Visa, Mastercard, and the other major card brands. It governs how card data is captured, transmitted, and stored, and it applies regardless of business size, though the compliance steps scale with transaction volume. Most small and mid-sized merchants demonstrate compliance by completing a Self-Assessment Questionnaire. Large merchants processing millions of transactions annually undergo a formal on-site audit by a qualified security assessor.
Card brands and acquiring banks impose fines that range from $5,000 to $100,000 per month for ongoing non-compliance, but a data breach at a non-compliant merchant is the bigger risk: forensic investigation costs, mandatory card reissuance fees charged by every affected issuing bank, and potential customer lawsuits. The cleanest way to limit PCI scope is to keep card data off your own systems entirely, using a terminal or gateway that handles all sensitive data on the processor’s infrastructure.
Separately, payment processors are required to report merchant receipts to the IRS on Form 1099-K when a merchant exceeds both $20,000 in gross payments and 200 transactions in a calendar year.6Internal Revenue Service. Publication 1099 General Instructions for Certain Information Returns – 2026 The form reports gross volume before refunds, chargebacks, and fees are subtracted, so the number on your 1099-K will be higher than what actually landed in your bank account. Keep detailed records of those deductions so you can reconcile the difference on your tax return. And if you fail to give the processor a valid Taxpayer Identification Number, or the IRS notifies the processor that your TIN is incorrect, the processor must withhold 24% of each payment and remit it to the IRS as backup withholding.7Internal Revenue Service. Topic No. 307, Backup Withholding Getting your TIN on file correctly from day one avoids that cash-flow hit entirely.