A point of sale transaction is the moment a customer pays for goods or services and the sale becomes a recorded financial event. Behind every tap, chip insert, or swipe, a chain of electronic messages travels between the merchant’s terminal, two banks, and a card network to verify funds and later transfer the money. The whole exchange usually finishes in two to three seconds, and it happens billions of times a day across restaurants, retail stores, online checkouts, and self-service kiosks.
How the Authorization Flow Works
It starts when you present payment at checkout. The terminal reads your card data through a chip, a contactless tap, a magnetic stripe swipe, or manual entry of the card number. The terminal packages that data into an authorization request and sends it to the merchant’s bank, called the acquiring bank.
The acquiring bank routes the request through the card network (Visa, Mastercard, and others) to your bank, called the issuing bank. Your bank checks whether the account has enough funds, whether the card is active, and whether anything about the transaction looks fraudulent. That back-and-forth typically finishes in two to three seconds.
If everything checks out, your bank sends back an authorization code. The code places a temporary hold on the purchase amount in your account, reserving those funds for the merchant. The terminal displays an approval, and you walk away with your purchase. If your bank declines, the terminal shows a generic error indicating insufficient funds or a security block, without exposing your account details to the merchant.
When the Money Actually Moves
Authorization doesn’t move money. It reserves it. At the end of each business day, the merchant sends all approved transactions to its acquiring bank in a batch. The acquiring bank forwards these through the card networks to the respective issuing banks, which then transfer the funds. The merchant typically sees the money in its account within one to three business days, though some processors offer same-day or next-day funding for an additional fee.
What Happens When the Internet Drops
Internet outages don’t necessarily shut down a POS system. Many modern terminals support an offline mode that stores transaction data locally when the connection drops. Once connectivity returns, the system uploads the queued transactions for processing. This “store and forward” approach keeps checkout lines moving during brief outages, though it carries some risk for the merchant since the card can’t be verified against the issuing bank until the system reconnects.
Types of POS Transactions
Transactions fall into categories based on how the payment data reaches the network, and the distinction matters because it affects both security risk and the fees the merchant pays.
Card-Present Transactions
These happen when a physical card or device is at the terminal. There are three main methods:
- Chip (dip): inserting the card into a reader that communicates with the EMV chip. The chip generates a unique, one-time cryptogram for each transaction, making the data useless to anyone who intercepts it.
- Contactless (tap): holding a card or phone near the reader. This uses near-field communication (NFC) to transmit encrypted payment data wirelessly over a very short range.
- Magnetic stripe (swipe): sliding the card through a reader that captures data from the stripe. This is the oldest and least secure method because the stripe holds static data that can be cloned.
Mobile Wallets
Apple Pay, Google Pay, and Samsung Pay add a layer called tokenization on top of contactless technology. Instead of transmitting your actual card number, the wallet replaces it with a one-time digital token. If a merchant’s system is breached, the stolen token is worthless because it can’t be reused. From the merchant’s side, a mobile wallet payment looks like a standard contactless transaction.
Card-Not-Present Transactions
When you buy something online, over the phone, or through a virtual terminal, the card never physically interacts with a reader. The buyer or a merchant’s employee manually enters the card number, expiration date, and security code. With no chip cryptogram or NFC encryption confirming the card is physically there, these transactions carry higher fraud risk. Merchants pay more in processing fees to compensate for that risk, and additional verification layers like 3D Secure may require multi-factor authentication before the purchase goes through.
Self-Service Kiosks
Self-checkout lanes and ordering kiosks are POS terminals designed for customers to operate directly. The hardware usually includes a touchscreen, barcode scanner, card reader, and receipt printer. Retail self-checkout units also incorporate cash-handling mechanisms and bagging areas. Fast-food ordering kiosks dedicate most of their real estate to a large touchscreen and a payment terminal. Some functions available to regular cashiers, like processing certain refunds or overrides, are locked behind employee login credentials on these systems.
Biometric Payments
A small but growing number of retailers accept payment through biometric identification. Palm-vein recognition, used at over 500 Whole Foods locations through Amazon One, reads the vein pattern beneath your skin’s surface. Pay-by-face systems, deployed at more than 380 quick-serve restaurant locations through companies like PopID, identify you through a facial scan linked to a payment method you registered in advance. Both approaches eliminate the need to carry a card or phone.
What POS Transactions Cost the Merchant
Every card transaction costs the merchant money. The total processing fee has three components: interchange (paid to the card-issuing bank), assessment (paid to the card network), and the processor’s markup. For a typical credit card transaction, interchange alone runs roughly 1.5% to 2.5% of the sale plus a per-transaction flat fee. Debit card interchange is substantially lower, especially for regulated banks. Add the network assessment and processor markup, and a merchant’s all-in cost for accepting a credit card usually lands between 2% and 3.5% of the transaction.
Card-not-present transactions cost more. Processors typically charge a higher per-transaction flat fee for keyed-in or online payments compared to in-person chip or tap transactions, reflecting the greater fraud risk. The difference varies by processor but commonly adds 10 to 25 cents per transaction on top of the card-present rate.
Credit Card Surcharges
Some merchants pass their credit card costs to customers by adding a surcharge at checkout. Card network rules set the ceiling. Visa caps surcharges at 3% of the transaction, and Mastercard allows up to 4%. Merchants can only surcharge up to their actual cost of acceptance if that is lower than the cap. A handful of states prohibit surcharges entirely, and surcharging debit card transactions is not allowed anywhere in the country. If a merchant does surcharge, it must appear as a separate line item on the receipt.
What You See on Your Receipt
Federal law restricts what can appear on a printed receipt. Under the Fair Credit Reporting Act, no business that accepts credit or debit cards may print more than the last five digits of the card number or the expiration date on any electronically printed receipt provided at the point of sale.1Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports The rule applies specifically to electronically printed receipts. It does not cover handwritten records or physical card imprints. Willful violation exposes the business to statutory damages of $100 to $1,000 per affected consumer, plus potential punitive damages and attorney’s fees.2Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
Behind the customer receipt, the POS system generates an internal record capturing the date, time, terminal number, itemized list of products, payment method, tax collected, and a sequential transaction number. Those logs create an audit trail that lets a business trace any individual sale back to its source data or forward to a daily total, and the trail must also account for voids, cancellations, and gaps in sequential numbering.
If a POS Transaction Wasn’t Yours
When a POS transaction involves a debit card or other electronic fund transfer, the Electronic Fund Transfer Act caps consumer liability for unauthorized charges based on how quickly you report the problem. Notify your bank within two business days of learning your card was lost or stolen, and your maximum liability is $50.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Wait longer than two business days and your exposure rises to $500. If an unauthorized transfer appears on your statement and you fail to report it within 60 days of the statement date, you could be on the hook for the full amount of any transfers that occur after that 60-day window.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Check your statements regularly. The speed of your report directly controls how much you can lose.