Credit card authorization is the real-time check that runs the instant you tap, swipe, insert, or submit your card number. In the one to two seconds before the terminal shows “approved,” your card details travel from the merchant through an acquiring bank and a card network to your issuing bank, which confirms the account is valid, verifies you have enough available credit, screens the purchase for fraud, and sends a response code back down the same chain. Approval doesn’t move money yet. It only reserves the funds and gives the merchant permission to complete the sale.
Who Is Involved in the Exchange
Four parties handle every authorization, and each has a specific job.
The merchant is the business accepting your card. To do that, the merchant maintains an account with an acquiring bank, sometimes called the merchant’s bank, which provides the equipment and processing relationship needed to accept card payments.
The card network — Visa, Mastercard, Discover, or American Express — is the routing layer. Networks don’t lend money or issue cards to consumers. They set the rules everyone follows and move transaction data between banks that may otherwise have no relationship with each other. Discover and American Express are partial exceptions, since they sometimes act as both the network and the issuer.
The issuing bank is your bank, the institution whose name is on your card. It owns the credit line and makes the final call on every purchase based on your balance, spending patterns, and fraud signals.
For online checkouts, one more piece sits in front of the merchant: a payment gateway that encrypts your card details and passes them securely to the processor. In-person card terminals handle that encryption function themselves.
What Data Gets Sent
The instant you present your card, the terminal pulls several data points and packages them for transmission. The primary account number, the long number on the front, identifies both your account and your issuing bank. Most cards carry 16 digits; American Express uses 15. The expiration date confirms the card hasn’t lapsed. The three- or four-digit security code (CVV or CVC) helps prove the person entering the number has the physical card.
How that data is captured depends on the payment method. An EMV chip generates a unique encrypted token for each transaction. A magnetic stripe transmits static data, which is why many retailers have stopped accepting swipes. Manual entry handles online and phone orders where the card isn’t physically present.
Alongside the card data, the terminal transmits the transaction amount, a merchant identification number that tells the network who is requesting the charge, and a merchant category code that classifies the type of business. All of this data is governed by PCI DSS, a set of security rules maintained by the Payment Card Industry Security Standards Council that any business handling card information must follow.1PCI Security Standards Council. Payment Card Data Security Standard (PCI-DSS) – PCI Security Standards Overview
The Authorization Sequence, Step by Step
Here is what actually happens in the second or two after you insert, tap, or submit your card.
- Step 1. The request is created. The merchant’s terminal packages your card data, the transaction amount, and merchant details into a standardized financial message format called ISO 8583, the messaging protocol used across the payment industry.2IBM. ISO8583 Messaging Standard
- Step 2. The message goes to the acquirer. The acquiring bank or its payment processor receives the request and identifies which card network to use based on the card number.
- Step 3. The network routes it to the issuer. The card network forwards the request to your issuing bank over its secure infrastructure.
- Step 4. Your issuer evaluates the request. Your bank checks your available credit, confirms the account is in good standing, and runs the transaction through fraud-detection algorithms. This all happens in milliseconds.
- Step 5. A response comes back. The issuer generates a response code and sends it back through the network to the acquirer and then to the merchant terminal. An approval triggers the sale. A decline prompts the cashier or website to ask for another payment method.
The response follows the same route in reverse. If anything breaks along the way, whether a network outage, an unrecognized merchant code, or a flagged account, the transaction stalls or declines.
Fraud Checks Running at the Same Time
Authorization is more than a balance check. Fraud-prevention tools run in parallel with the approval decision.
Address Verification Service
For online and phone orders, known as “card not present” transactions, merchants can use the Address Verification Service. When you type your billing address at checkout, AVS compares what you entered against the address your issuing bank has on file. The issuer returns a code indicating whether the street number, the zip code, both, or neither matched. A mismatch doesn’t always trigger an automatic decline, but it gives the merchant a signal to act on. Issuers in the United States and Canada are required to support AVS checks when merchants request them.
3D Secure Authentication
You may have seen an extra pop-up during an online purchase asking you to verify your identity with a one-time code or a biometric scan. That is 3D Secure, an authentication protocol branded as Visa Secure, Mastercard Identity Check, or American Express SafeKey depending on your card. Instead of relying only on card data, the issuer directly confirms that the person completing the purchase is the actual cardholder. Authenticated transactions shift fraud liability away from the merchant, which is why more online retailers use it.
Why Cards Get Declined
When your card is declined, the issuer returns a two-digit response code that explains why. The cashier or website usually just shows a generic “declined” message, but the underlying code is more specific.
- Code 00. Approved. Everything checked out.
- Code 05. Do not honor. The issuer rejected the transaction without providing a detailed reason. This is the most common decline and usually requires calling your bank to resolve.
- Code 12. Invalid transaction. Something about the request itself was malformed or unsupported.
- Code 14. Invalid account number. The card number doesn’t match any account on file, which can happen with a typo during manual entry.
- Code 41. Lost card. The issuer has flagged the card as reported lost and may instruct the merchant to retain it.
- Code 51. Insufficient funds. Your available credit or balance can’t cover the transaction amount.
If a decline doesn’t make sense, only your issuing bank can explain the specific reason and lift any blocks. Merchants and processors can see the code but can’t override the issuer’s decision.
Tap-to-Pay and Mobile Wallets
Tapping a phone or contactless card follows the exact sequence above, with one important twist: your real card number never reaches the merchant. The system uses tokenization. Your device or contactless chip generates a one-time-use token, a substitute number that only maps back to your real account inside the card network’s secure systems.3EMVCo. EMV Payment Tokenisation: What, Why and How
When you hold your phone near the terminal, near-field communication transmits the token along with a one-time cryptogram that proves the transaction is legitimate. The token travels from the terminal to the acquirer, through the network, and to your issuer along the same path as any other authorization. Your issuer translates the token back to your real account number, checks your balance and fraud indicators, and sends an approval or decline. Because the token can’t be replayed for another purchase, contactless payments are actually more secure than a traditional magnetic stripe swipe.
What the Hold on Your Account Means
An approved authorization doesn’t move money right away. It creates a temporary hold that reduces your available credit by the transaction amount. A $50 purchase on a card with a $1,000 limit drops your available credit to $950 even though the charge hasn’t officially posted yet. The hold reserves those funds for the merchant until the transaction is finalized.
Most holds from standard retail purchases clear within a day or two, once the merchant submits the transaction for settlement. A few industries produce longer or larger holds.
Hotels and Car Rentals
Hotels typically place a hold at check-in that covers your room rate plus an estimate for incidentals like minibar charges. That hold can be well above your actual bill. After checkout, the hotel submits the final charge, but the original hold may take anywhere from 24 hours to a full week to disappear from your available credit, depending on your card network’s rules. Visa allows holds to remain for up to 30 days. American Express caps them at seven. On a card with a modest credit limit, a hotel hold can temporarily eat up a large share of your available balance.
Gas Stations
Pay-at-the-pump transactions work differently from most purchases. The pump doesn’t know how much fuel you’ll buy when you insert your card, so it sends a pre-authorization for a set amount. That hold has recently been raised to $175 for Visa and Mastercard transactions. Once you finish fueling, the actual charge replaces the hold, but the release isn’t always instant. If you pump $30 of gas against a $175 hold, your available credit may show the larger reduction until the hold clears. Debit card users feel this more sharply because the hold ties up actual cash in a checking account rather than credit line capacity.
From Approval to Money Actually Moving
Authorization is only permission. The actual transfer happens during settlement, and it takes one more step from the merchant.
At the end of each business day, most merchants “batch out” their authorized transactions by bundling every approved sale and submitting the batch to their payment processor. The processor routes each transaction through the appropriate card network to the issuing banks, which release the held funds and transfer them to the acquiring bank. The acquiring bank then deposits the money, minus processing fees, into the merchant’s account. This settlement process typically takes one to three business days for domestic transactions, at which point the charge on your statement moves from “pending” to “posted.”
Timing matters. If a merchant waits too long to batch out, the hold on your account may expire before settlement occurs. When that happens, your available credit temporarily bounces back up before the final charge posts, which can look confusing on your statement.
Voids Versus Refunds
What happens when a sale needs to be reversed depends on whether settlement has already occurred. A void cancels a transaction before it settles. Because the money was only held and never actually transferred, voiding simply releases the authorization hold on your account. No funds change hands, and your available credit is restored within one to three business days.
A refund happens after the transaction has fully settled and the merchant has already received the funds. At that point the merchant must initiate a separate credit back to your card. Refunds create a new transaction flowing in the opposite direction and typically take three to five business days to appear on your statement. Merchants generally prefer voids when possible because refunds may trigger additional processing fees.
The practical takeaway: if you need to cancel a purchase, doing it the same day, before the nightly batch, usually results in a void. Waiting until the next day or later almost always means a refund.