Card Payments and Merchant Acceptance

Introduction

Card payments are a central component of modern banking because they connect consumers, issuing institutions, merchants, acquiring institutions, payment networks, technology providers, and regulators. A card transaction appears simple to the customer—present a card, approve a payment, and receive a receipt—but the underlying process involves authorization, authentication, clearing, settlement, risk allocation, data security, and dispute management.

For banks, card payments are both a distribution channel and a source of fee income, customer data, credit exposure, fraud risk, and strategic differentiation. For merchants, acceptance infrastructure affects conversion, cost, cash flow, customer experience, and regulatory compliance. Postgraduate study therefore requires more than knowledge of card terminology: it requires analysis of the complete payment ecosystem and the incentives of its participants.

Learning Objectives

After completing this chapter, students should be able to:

1. Explain the roles of issuers, acquirers, merchants, cardholders, payment networks, gateways, processors, and payment facilitators.
2. Distinguish authorization, authentication, clearing, and settlement.
3. Explain EMV chip transactions, contactless payments, tokenization, and payment gateways.
4. Analyse merchant onboarding, POS architecture, interchange, merchant pricing, and chargebacks.
5. Evaluate card-product management, operational risks, governance requirements, and emerging developments.

1. The Card-Payment Ecosystem

A card transaction commonly involves the following parties:

• Cardholder: The individual or organisation using a payment credential.
• Issuer: The bank or regulated institution that issues the card or token and maintains the cardholder account.
• Merchant: The business accepting payment for goods or services.
• Acquirer: The institution that enables the merchant to accept card payments and receives transaction proceeds from the network for settlement to the merchant.
• Card network or scheme: The organisation that provides operating rules, message standards, routing, dispute procedures, and network connectivity. Examples include international and domestic schemes.
• Payment processor: A technical or operational provider that handles transaction messages, files, fraud tools, or settlement services for issuers and acquirers.
• Payment gateway: A technology layer that securely transmits an online payment request between the merchant environment and the processor or acquirer.
• Payment facilitator: An entity that enables sub-merchants to accept payments under an acquiring relationship, subject to applicable regulatory and network rules.

The term four-party model generally refers to the cardholder, issuer, merchant, and acquirer, with the network coordinating the relationship. In a three-party model, the same organisation may act as issuer, acquirer, and network. Real markets often contain hybrids, processors, aggregators, wallets, and local routing arrangements.

Transaction sequence

A typical purchase follows five related stages:

1. Initiation: The cardholder presents a physical card, mobile wallet, or card credential.
2. Authentication and data capture: The terminal or online service captures transaction data and, where required, verifies the cardholder.
3. Authorization: The issuer or its processor approves or declines the requested amount after checking account status, limits, fraud indicators, and authentication information.
4. Clearing: Transaction records are exchanged and reconciled. Financial and non-financial data are prepared for settlement.
5. Settlement: Net funds and fees are transferred among network participants, after which the acquirer credits the merchant according to the agreed schedule.

Authorization is not the same as settlement. An authorization may be reversed, expire, be completed for a different final amount, or be followed by a dispute. Hotels, car-rental companies, and fuel merchants commonly use an authorization hold followed by completion or adjustment.

Figure: Simplified authorization flow and subsequent response, clearing, and settlement path.

2. Issuing and Card-Product Management

Issuing begins with product design and continues through acquisition, underwriting, personalization, activation, servicing, renewal, and closure. A debit card normally accesses a deposit account; a credit card creates a revolving credit facility; a prepaid card accesses stored value or a funded account. Commercial cards may apply controls by employee, merchant category, geography, or transaction amount.

A product manager must define the target segment, value proposition, eligibility, pricing, benefits, limits, funding source, servicing model, and risk appetite. Important product decisions include:

• physical card, virtual card, or tokenized wallet credential;
• debit, credit, charge, prepaid, or hybrid functionality;
• domestic, international, or multi-currency use;
• rewards, instalment, travel, insurance, or cash-back benefits;
• customer fees, foreign-exchange margins, interest, and penalty policies;
• digital onboarding, instant issuance, replacement, and lifecycle controls.

A simplified contribution model is useful for managerial analysis:

Revenue may include interchange-related income, annual fees, interest, foreign-exchange income, and ancillary services. Expected loss is a risk estimate rather than a guaranteed future loss. The model is decision-useful only when the components are measured consistently over the same portfolio, period, and accounting basis; it is not a substitute for applicable accounting standards or regulatory capital calculations.

Card lifecycle management includes application, approval, production, delivery, activation, PIN or credential management, expiry, replacement, suspension, closure, and post-closure data retention. Strong controls are required when a card is lost, an account is compromised, or a customer requests a replacement. A replacement must not accidentally preserve a compromised credential, while recurring merchant relationships may require controlled account-updater processes.

3. Acquiring and Merchant Acceptance

Acquiring is the business of enabling merchants to accept cards and receiving transaction funds on their behalf. The acquirer assesses the merchant, assigns one or more merchant identifiers, configures accepted products and currencies, provides or connects terminals, manages settlement, monitors risk, and handles disputes.

Merchant onboarding

A sound onboarding process combines commercial due diligence with financial-crime and payment-risk controls. It normally includes:

1. legal-entity verification and beneficial-owner identification;
2. business activity, website, physical location, and licensing checks;
3. expected volumes, average ticket, peak seasons, countries, and currencies;
4. prohibited or restricted-business screening;
5. assessment of delivery time, refund policy, subscription terms, and customer support;
6. pricing, reserve, settlement, and chargeback terms;
7. technical testing, security validation, and production approval.

High-risk merchants may require rolling reserves, delayed settlement, transaction caps, enhanced monitoring, or specialist acquiring. Onboarding is not a one-time event. Continuous monitoring should identify sudden volume growth, unusual geographic patterns, excessive refunds, suspicious authorization attempts, or chargeback increases.

Merchant pricing and interchange

Merchant service pricing may contain interchange, network or scheme fees, acquirer processing costs, fraud and risk costs, gateway costs, taxes, and the acquirer’s margin. Interchange is generally a transfer price paid through the network from the acquirer side to the issuer side. Its rate may vary by card product, transaction type, merchant category, country, authentication, and regulatory caps.

A simplified merchant-cost identity is:

This is an analytical decomposition, not a universal invoice format. Some providers bundle components into blended pricing, while others use interchange-plus pricing. Regulation may cap or constrain interchange and surcharge practices, and network rules may impose additional requirements.

4. EMV, Contactless, and Tokenization

EMV refers to chip-card specifications developed by major payment organisations. Unlike a static magnetic stripe, an EMV chip generates transaction-specific cryptographic data. The terminal and card exchange data, apply transaction rules, and produce a cryptogram that helps the issuer determine whether the transaction is genuine and whether it may proceed.

EMV does not eliminate all fraud. It substantially changes counterfeit-card risk at compatible terminals, but lost-card, stolen-credential, card-not-present, merchant-compromise, social-engineering, and account-takeover risks remain. Liability allocation depends on applicable network rules, transaction conditions, authentication, and local law.

Contactless payment uses near-field communication between the card or device and the terminal. It may use EMV contactless protocols and usually supports rapid low-value transactions, subject to local limits and occasional requests for cardholder verification. A contactless transaction is not automatically risk-free: device security, token controls, transaction monitoring, and fallback handling remain important.

Tokenization replaces a primary account number with a payment token. The token may be restricted to a device, merchant, channel, or transaction environment. A token service provider maintains the relationship between token and underlying account credential. Tokenization reduces the value of data stolen from a merchant environment, but it does not remove the need for authentication, authorization, access control, secure key management, and incident response.

A useful distinction is:

5. POS Systems, Gateways, and E-Commerce Acceptance

A point-of-sale system includes the terminal, payment application, merchant software, connectivity, receipt function, and integration with inventory or accounting systems. A terminal may be attended, unattended, mobile, or integrated into a self-service machine.

The payment gateway is principally a secure communication and orchestration layer for online transactions. It may encrypt or tokenize data, apply fraud rules, route requests, manage retries, provide hosted payment pages, and return authorization results. The gateway is not necessarily the acquirer, network, or issuer.

An online transaction may involve the customer browser or app, merchant server, gateway, fraud engine, acquirer processor, network, and issuer. Reliability requires idempotency controls so that a timeout does not create duplicate captures. Merchants should distinguish a declined authorization from a technical timeout and should reconcile gateway records with processor settlement files.

Key acceptance metrics include authorization rate, conversion rate, average transaction value, payment latency, technical error rate, false-decline rate, refund time, chargeback rate, and settlement variance. Optimizing only authorization rate can be harmful if it increases fraud or costly disputes.

6. Authentication, Authorization, and Risk Management

Authentication asks whether the payment credential or customer is genuine. Authorization asks whether the transaction should be approved. They are related but distinct. Issuers may use customer history, merchant category, amount, location, device data, velocity, token information, and behavioural models.

Risk engines commonly combine rules and statistical or machine-learning models. A model may improve detection, but its output must be governed through data quality checks, validation, drift monitoring, explainability appropriate to the decision, human escalation, and controls against discriminatory outcomes. A fraud score should support—not silently replace—accountability for consequential decisions.

Strong customer authentication requirements vary by jurisdiction and transaction type. Exemptions may apply to low-value, recurring, trusted-beneficiary, or low-risk transactions, but exemptions are conditional and do not create a universal right to approve a transaction. Merchants and issuers must understand authentication indicators and liability consequences under applicable rules.

7. Chargebacks and Dispute Management

A chargeback is a reversal or recovery process initiated through a card scheme after a cardholder disputes a transaction or a transaction violates defined rules. It is not simply a customer refund. A refund is normally initiated by the merchant; a chargeback follows a formal dispute process.

Typical dispute reasons include unauthorized use, duplicate processing, incorrect amount, goods or services not received, defective or misdescribed goods, cancelled recurring transactions, and processing errors. The precise categories and deadlines are network- and jurisdiction-dependent.

The operational cycle generally involves notification, provisional debit or reserve action, merchant evidence, acquirer review, issuer or network decision, possible representment, and final resolution. Useful evidence may include authorization data, authentication indicators, delivery confirmation, usage records, customer communications, refund policy acceptance, and proof of cancellation handling. Evidence must be relevant, timely, authentic, and consistent with privacy requirements.

A basic chargeback rate can be expressed as:

The numerator and denominator must use the same period, transaction population, and counting convention. Some programmes measure chargebacks against sales transactions, while others use monetary value or a defined reporting window. Managers should monitor both frequency and financial loss, because a small number of high-value disputes may be more material than many low-value disputes.

Prevention is usually superior to repeated representment. Clear descriptors, accurate delivery information, visible cancellation processes, prompt refunds, duplicate-processing controls, and responsive customer service can reduce disputes. Excessive chargebacks can produce financial loss, monitoring programmes, reserve requirements, or termination of acquiring relationships.

8. Settlement, Reconciliation, and Financial Control

The acquirer receives network settlement positions and credits the merchant after deducting agreed fees, adjustments, reserves, refunds, and other amounts. Settlement may be same-day, next-day, or delayed depending on risk, geography, currency, and contract.

Reconciliation compares at least three populations: merchant-originated transactions, processor or gateway records, and bank settlement entries. Exceptions may arise from partial captures, reversals, offline transactions, late presentment, duplicate files, currency conversion, refunds, or chargebacks. A robust control environment uses unique transaction references, cut-off controls, maker-checker approval, automated exception queues, and ageing analysis.

Cross-border payments introduce additional complexity: exchange-rate timing, taxes, local acquiring requirements, sanctions screening, data-transfer restrictions, and mismatches between transaction currency and settlement currency. Treasury and operations teams must understand whether foreign-exchange conversion occurs at authorization, clearing, settlement, or merchant payout.

9. Governance, Regulation, and Security

Card acceptance is governed by a combination of law, regulation, network rules, contracts, and internal policy. Relevant obligations may include payment-services licensing, consumer protection, anti-money-laundering and counter-terrorist-financing controls, privacy law, electronic-transactions law, accessibility, outsourcing governance, and cybersecurity requirements. The exact framework depends on jurisdiction and institutional role.

Security programmes should apply least privilege, network segmentation, secure software development, vulnerability management, encryption in transit and at rest, key management, logging, incident response, penetration testing, vendor oversight, and secure disposal. Payment-card data should be minimized; storing sensitive authentication data after authorization is generally prohibited or tightly restricted under applicable security standards.

Governance questions include who may change merchant limits, who approves exceptions, how model decisions are reviewed, how outages are communicated, and how customer complaints are escalated. Convenience cannot justify opaque pricing, discriminatory declines, unfair dispute practices, or careless use of personal data.

10. Applied Case: Meridian Bank’s Omnichannel Acceptance Programme

This is an illustrative case. Meridian Bank serves small retailers through branches but is losing merchants to digital acquirers. Its existing terminals are expensive, online acceptance is fragmented, and reconciliation is largely manual. Chargebacks have increased after several merchants adopted subscription billing.

Problem

The bank must improve merchant conversion and settlement visibility without weakening onboarding, fraud, or compliance controls. It also wants to offer mobile acceptance and tokenized online checkout.

Analysis

A review finds four causes: slow manual underwriting, separate POS and gateway contracts, weak merchant descriptors, and no central dispute dashboard. The bank’s management also discovers that sales teams are rewarded for signed contracts rather than healthy, active merchants. This creates an incentive to overlook risk indicators.

Approach

Meridian establishes a risk-based onboarding workflow with automated legal-entity checks and manual review for higher-risk sectors. It adopts an integrated gateway and terminal platform, uses network tokenization for eligible digital wallets, and introduces a common merchant identifier across channels. It implements daily reconciliation between authorization, capture, settlement, refunds, and chargebacks. Subscription merchants must provide clear consent, renewal notices, cancellation controls, and transaction descriptors.

The bank redesigns incentives around active volume, net revenue, dispute-adjusted contribution, service availability, and compliance quality. A fraud model is deployed with documented validation, threshold review, and human escalation. Merchants receive dashboards showing settlement status and dispute deadlines.

Outcome

The programme reduces manual onboarding for standard-risk merchants, improves exception identification, and gives merchants a single view of in-store and online activity. The bank does not treat tokenization as a complete security solution; it retains strong access controls and incident procedures. Management also learns that acceptance growth without disciplined merchant monitoring merely transfers risk into future losses.

Learning points

1. Acceptance is a portfolio-management activity, not only a sales function.
2. Integration can improve customer experience while increasing concentration and operational risk.
3. Chargeback prevention depends on merchant practices as much as issuer fraud controls.
4. Incentives should include risk-adjusted and service-quality measures.
5. Tokenization, EMV, and machine learning are controls within a broader governance system.

11. Contemporary Developments and Strategic Issues

Digital wallets, account-to-account alternatives, real-time payments, biometric devices, softPOS, buy-now-pay-later products, and embedded finance are reshaping acceptance. Cards remain valuable because of global reach, consumer protections, credit functionality, established dispute processes, and mature acceptance infrastructure, but merchants increasingly expect orchestration across multiple payment methods.

Payment orchestration can route transactions among acquirers and methods, potentially improving resilience and authorization performance. However, routing creates governance questions concerning data sharing, regulatory responsibility, merchant transparency, and consistent dispute handling. Artificial intelligence can assist fraud detection, merchant underwriting, customer service, and dispute classification, but model risk, privacy, bias, adversarial manipulation, and accountability must be addressed.

Strategically, banks should evaluate acceptance products using total economic value rather than headline volume. Important questions include: Is growth profitable after fraud and disputes? Are merchants receiving reliable settlement? Are declines caused by genuine risk or poor data? Is the institution dependent on one processor? Can it recover from a network or cloud outage? Does the product serve small merchants fairly? These questions connect technology choices with financial resilience and public trust.

Best-Practice Checklist

• Separate issuing, acquiring, network, gateway, and processor responsibilities.
• Design products around lifecycle management and risk-adjusted economics.
• Verify merchants at onboarding and monitor them continuously.
• Use EMV, tokenization, encryption, authentication, and monitoring as complementary controls.
• Reconcile authorization, capture, settlement, refunds, and disputes.
• Maintain clear customer disclosures and accessible complaint channels.
• Govern algorithms through validation, monitoring, documentation, and human accountability.
• Test operational resilience, third-party dependencies, and incident response.
• Measure acceptance quality through conversion, fraud, disputes, profitability, and service reliability.

Chapter Summary

Card payments are coordinated through a complex ecosystem in which issuers provide credentials and funding, acquirers enable merchants and settlement, networks define rules and route messages, and gateways and processors provide technical infrastructure. A transaction moves through initiation, authentication, authorization, clearing, and settlement; authorization alone does not guarantee final payment.

EMV generates dynamic transaction information, contactless technology improves convenience, and tokenization limits exposure of underlying credentials. None removes the need for layered security and governance. Merchant acceptance requires risk-based onboarding, suitable pricing, continuous monitoring, reliable POS and gateway architecture, and disciplined reconciliation. Interchange is a transfer component within broader merchant pricing, while chargebacks are formal dispute processes requiring prevention, evidence, and operational control.

For postgraduate managers and banking professionals, the central lesson is that card payments must be managed as an integrated economic, technological, regulatory, and customer-service system. Sustainable growth depends on risk-adjusted profitability, resilience, fairness, data protection, and accountable innovation.

Key Terms

Acquirer: Institution that enables merchants to accept card payments and receives settlement for them.

Authorization: Issuer or processor decision approving or declining a requested transaction.

Card network: Organisation providing payment-routing infrastructure, operating rules, and dispute mechanisms.

Chargeback: Formal reversal or recovery process following a card transaction dispute or rule violation.

Clearing: Exchange and processing of transaction records before settlement.

Contactless payment: Near-field payment using a card, device, or wearable.

EMV: Specifications supporting chip-based payment transactions and dynamic cryptographic data.

Gateway: Technology layer that transmits and manages online payment requests.

Interchange: Transfer price generally paid through the network from the acquiring side to the issuing side.

Issuer: Institution providing the card or payment credential and maintaining the customer account.

Merchant category code: Classification used to identify a merchant’s business activity.

Payment facilitator: Entity enabling sub-merchants to accept payments under an acquiring arrangement.

POS system: Hardware and software used to initiate and process a payment at the point of sale.

Representment: Submission of evidence challenging a chargeback.

Settlement: Transfer of net funds among payment participants.

SoftPOS: Software-based acceptance that enables a compatible mobile device to act as a payment terminal.

Tokenization: Replacement of a payment account number with a controlled substitute credential.

Three-Domain Secure: Online authentication framework commonly used to reduce selected card-not-present risks.

Transaction cryptogram: Cryptographic value generated to support transaction authentication.

Payment processor: Provider handling transaction messaging, processing, files, or related operational services.

Review Questions

5 Short Answer Questions

1. Distinguish an issuer from an acquirer.
2. Why is authorization different from settlement?
3. What risk does tokenization address?
4. Identify two activities included in merchant onboarding.
5. What is the purpose of reconciliation in card payments?

5 Long Answer Questions

1. Explain the complete lifecycle of a card transaction from initiation through settlement.
2. Compare EMV, contactless payment, and tokenization in terms of function and risk reduction.
3. Analyse the components that may be included in merchant service pricing.
4. Explain the causes, process, and prevention of chargebacks.
5. Discuss the governance requirements for using machine learning in payment fraud management.

3 Analytical / Application Questions

1. A merchant has strong sales growth but rising refunds and chargebacks. Design a monitoring and intervention plan for its acquirer.
2. Compare interchange-plus and blended merchant pricing for a small retailer with volatile transaction volumes. Identify the information required before recommending either model.
3. A bank plans to launch a combined POS, gateway, and wallet-acceptance service. Evaluate the strategic benefits, operational dependencies, regulatory risks, and resilience controls it should consider.

Multiple Choice Questions with Answers

Question 1

Which participant normally maintains the cardholder’s account and makes the authorization decision?

A. Issuer

B. Acquirer

C. Merchant

D. Gateway

Correct Answer: A. Issuer

Question 2

Which sequence best represents the principal stages after a payment is initiated?

A. Settlement, authorization, clearing, authentication

B. Authentication and capture, authorization, clearing, settlement

C. Clearing, refund, authorization, settlement

D. Authorization, onboarding, tokenization, settlement

Correct Answer: B. Authentication and capture, authorization, clearing, settlement

Question 3

What is the principal security function of EMV chip transactions?

A. Guaranteeing that every transaction is approved

B. Replacing the need for customer authentication

C. Generating transaction-specific cryptographic data

D. Eliminating all card-not-present fraud

Correct Answer: C. Generating transaction-specific cryptographic data

Question 4

Interchange is generally a transfer price paid through the network from the:

A. Issuer side to the acquiring side

B. Merchant to the cardholder

C. Acquiring side to the issuing side

D. Network to the merchant

Correct Answer: C. Acquiring side to the issuing side

Question 5

Which activity is most appropriate for continuous merchant monitoring?

A. Checking only the merchant’s logo design

B. Reviewing unusual volume, refund, and chargeback patterns

C. Disabling all transactions above the average ticket

D. Replacing onboarding with annual advertising reviews

Correct Answer: B. Reviewing unusual volume, refund, and chargeback patterns

Question 6

A chargeback differs from an ordinary refund because a chargeback is:

A. Always initiated by the merchant

B. A formal dispute or recovery process under applicable rules

C. Only a technical failure at the gateway

D. A type of interchange fee

Correct Answer: B. A formal dispute or recovery process under applicable rules

Question 7

A merchant records 40 chargebacks from 20,000 transactions. Using the chapter’s rate definition, the chargeback rate is:

A. 0.02%

B. 0.2%

C. 2%

D. 20%

Correct Answer: B. 0.2%

Question 8

Which statement about a payment gateway is most accurate?

A. It is always the card issuer

B. It is principally a technology layer for transmitting and managing online payment requests

C. It independently sets all network rules

D. It guarantees that an authorization will settle

Correct Answer: B. It is principally a technology layer for transmitting and managing online payment requests

Question 9

Why is idempotency important in online payment processing?

A. It ensures a timeout or retry does not create unintended duplicate captures

B. It increases interchange rates automatically

C. It replaces merchant due diligence

D. It prevents every legitimate refund

Correct Answer: A. It ensures a timeout or retry does not create unintended duplicate captures

Question 10

Which measure best reflects risk-adjusted acceptance performance?

A. Gross transaction volume alone

B. Number of terminals installed alone

C. Volume considered together with fraud, disputes, profitability, and service reliability

D. Number of marketing impressions

Correct Answer: C. Volume considered together with fraud, disputes, profitability, and service reliability