Cards, Merchant Payments and Acquiring

Introduction

Payment cards are among the most important instruments in modern retail banking. They connect customers, merchants, banks, payment networks, processors and regulators through a highly coordinated system. A card transaction may appear simple to the customer—present a card, enter a personal identification number (PIN), or approve a mobile-wallet payment—but behind that action are processes for authentication, authorization, fraud control, clearing, settlement, dispute management and compliance.

This chapter examines the complete card-payment ecosystem. It distinguishes issuing from acquiring, explains the transaction life cycle, and introduces EMV, contactless payments, tokenization, payment gateways, interchange and chargebacks. It also explains the practical significance of the Payment Card Industry Data Security Standard (PCI DSS).

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the roles of issuers, acquirers, merchants, cardholders, processors and card schemes.
2. Describe card issuance and the authorization, clearing and settlement cycle.
3. Explain how EMV, contactless technology and tokenization reduce payment risk.
4. Distinguish payment gateways, payment processors and merchant acquirers.
5. Explain interchange, merchant service charges and chargebacks.
6. Apply PCI DSS principles to card-data protection.
7. Evaluate operational, regulatory, ethical and fraud-related risks in card payments.

1. The Card-Payment Ecosystem

A typical four-party card model contains four principal participants:

• Cardholder: The individual or organization authorized to use a card account.
• Issuer: The bank or financial institution that provides the card and maintains the cardholder’s account.
• Merchant: The business accepting the card for payment.
• Acquirer: The institution that contracts with the merchant, receives transaction information and arranges payment to the merchant.

Payment schemes or networks—such as international card networks and domestic payment switches—provide operating rules, messaging standards, routing and settlement arrangements. Processors may perform technical services for issuers or acquirers. A payment gateway securely transmits online payment information between a merchant and the acquiring or processing system.

In a simplified transaction, the cardholder requests payment, the merchant sends the request to its acquirer, the acquirer routes it through a payment network to the issuer, and the issuer returns an approval or decline. The later exchange of transaction records and movement of funds are called clearing and settlement.

The distinction between authorization and settlement is essential. Authorization is a decision about whether a transaction may proceed. Settlement is the subsequent financial process through which obligations are calculated and funds are transferred.

2. Card Products and Issuance

Banks issue several broad card categories:

The issuance process

Card issuance normally includes the following stages:

1. Application and customer identification: The institution collects identity, address, contact and, where required, beneficial-ownership information.
2. Know Your Customer and risk assessment: The bank assesses sanctions exposure, fraud risk, affordability and creditworthiness where credit is offered.
3. Product approval: The institution determines the card type, limits, fees, transaction controls and applicable terms.
4. Account and card creation: A primary account, card number, expiry date and security controls are generated.
5. Personalization: The physical card may be printed, encoded and linked to a PIN. Secure personalization facilities protect sensitive data.
6. Delivery and activation: The card is delivered through a controlled channel. Activation may require an ATM transaction, mobile-banking confirmation, call-centre verification or another strong customer-authentication method.
7. Lifecycle management: The issuer manages renewals, replacement, limit changes, suspension, blocking, closure and fraud monitoring.

The visible card number is not itself proof that the person presenting the card is entitled to use it. Security depends on a combination of card data, chip cryptography, PINs, customer authentication, transaction monitoring and merchant controls.

3. The Card-Transaction Life Cycle

3.1 Initiation and capture

The transaction begins when the customer presents a physical card, taps a contactless card or device, enters card details online, or selects a stored payment credential. The merchant’s point-of-sale (POS) terminal or online checkout captures transaction information such as amount, currency, merchant identity, date, card credentials and transaction type.

3.2 Authorization

The acquirer or its processor sends an authorization message through the relevant network to the issuer. The issuer may check:

• Whether the card is active, expired or blocked.
• Available balance or remaining credit limit.
• PIN, cryptographic data or other authentication results.
• Merchant category, country, currency and transaction amount.
• Velocity patterns, unusual location or device information.
• Fraud-screening scores and regulatory restrictions.

The issuer responds with an approval, decline or referral. An approval generally places a hold or reduces available credit, but it is not always a final transfer of funds. A merchant should not treat an authorization as a guarantee against every later dispute, fraud claim or processing error.

3.3 Clearing

After authorization, the merchant submits a batch or electronic record of completed transactions. Clearing involves exchanging transaction data, validating records, calculating obligations and applying fees, refunds and adjustments. Clearing files must be accurate and reconciled with merchant sales records.

3.4 Settlement

Settlement is the completion of payment obligations among participants. The network calculates net amounts payable by issuers and receivable by acquirers, often using multilateral netting. The acquirer then credits the merchant, subject to agreed funding timelines, reserves, fees and risk controls.

A simplified merchant funding relationship is:

Here, gross card sales are authorized and captured sales in the relevant period; refunds are amounts returned to customers; merchant fees include agreed acquiring and network-related charges; and adjustments include corrections, chargebacks and other permitted entries. The relationship is an operational simplification: actual settlement may involve separate currencies, reserve accounts, taxes, timing differences and scheme-specific entries.

3.5 Reconciliation

Reconciliation compares three records: the merchant’s sales system, the acquirer’s transaction report and the bank account statement. Differences may arise from duplicate submissions, missing transactions, late presentment, refunds, chargebacks, currency conversion or timing. Effective reconciliation identifies errors before they become financial losses.

4. EMV and Contactless Payments

EMV chip technology

EMV refers to a global technical framework originally associated with Europay, Mastercard and Visa. An EMV chip contains a secure application that can generate transaction-specific cryptographic data. The terminal and card exchange data, and the issuer or payment system validates the transaction information.

A magnetic stripe generally stores relatively static information. If copied, it may be reused more easily. EMV transactions are designed to make simple copying less useful because the transaction includes dynamic values. Chip technology does not eliminate all fraud: lost-card use, fallback to magnetic stripe, online card-not-present fraud, compromised terminals and social engineering remain possible.

The terminal may verify the card offline, request online issuer authorization, or use a combination of methods. The exact decision depends on card application parameters, terminal capability, risk settings, transaction amount and network rules.

Contactless payments

Contactless cards and devices use near-field communication (NFC) to communicate over a short distance with a compatible terminal. The customer taps rather than inserts the card. A contactless transaction can use EMV chip principles and dynamic cryptographic values.

For low-value transactions, a PIN or signature may not be requested, subject to local rules and cumulative risk controls. A terminal may occasionally request a card insertion and PIN to reset counters or provide stronger verification. Contactless convenience therefore depends on layered controls rather than the absence of authentication.

5. Tokenization and Digital Wallets

Tokenization replaces a sensitive payment credential, such as a primary account number (PAN), with a substitute value called a token. The token is meaningful only within a defined context, such as a device, merchant, payment network or wallet. A token service provider maintains the secure relationship between token and underlying account.

Tokenization differs from encryption. Encryption transforms data using a key and can generally be reversed by an authorized party. Tokenization substitutes a value through a controlled mapping system. Both may be used together.

In a digital wallet, the customer may authenticate the device with a passcode, biometric factor or other method. The merchant receives a token and transaction-specific data rather than the underlying PAN in many circumstances. If a token is stolen, its restricted use may limit its value; however, tokenization does not protect a customer whose device, account or authentication factor has been compromised.

Important token-management controls include provisioning authentication, device binding, token suspension, lifecycle updates when a card expires or is replaced, and monitoring for abnormal use.

6. Online Payments, Gateways and Acquiring

A payment gateway is a technology service that securely captures and transmits payment information from an online or physical merchant channel. It may support checkout pages, encryption, tokenization, fraud tools and routing.

A payment processor handles technical transaction messaging and operational processing. An acquirer is the financial institution or regulated provider that maintains the merchant relationship and assumes contractual and financial responsibilities under the scheme rules. One organization may perform several of these functions, but the concepts remain distinct.

An online card-not-present transaction usually involves:

1. Customer checkout and payment-data entry.
2. Gateway validation and secure transmission.
3. Optional customer authentication, such as 3-D Secure or a comparable framework.
4. Fraud and risk screening.
5. Authorization through the acquirer and network.
6. Confirmation to the merchant.
7. Capture, clearing, settlement and possible later dispute.

Merchants often choose between hosted payment pages, embedded fields, direct application programming interfaces (APIs) and payment links. Hosted pages can reduce the merchant’s exposure to card data, while direct integration may offer greater control but creates larger security and compliance responsibilities.

7. Merchant Acquiring and Pricing

Acquiring is a risk-bearing and service-intensive activity. The acquirer onboards merchants, verifies their business model, assigns merchant category codes, supplies or supports acceptance technology, routes transactions, funds merchants and manages disputes and fraud exposure.

The merchant service charge (MSC) is the amount deducted from a merchant’s card sales. It may contain several components:

• Interchange paid within the card ecosystem, commonly associated with issuer compensation.
• Network or scheme fees.
• Acquirer processing and service margin.
• Gateway, terminal, fraud, reporting or other service charges.

A simplified pricing identity is:

This is a conceptual decomposition, not a universal legal or accounting formula. Actual pricing varies by jurisdiction, card product, merchant risk, transaction type, volume, negotiated contract and regulatory caps.

For a transaction value of 10,000 monetary units, suppose the interchange component is 1.20%, network fees are 0.10%, acquirer margin is 0.50%, and other agreed charges are 0.20%. The total rate is:

The merchant fee is:

Thus, before other adjustments, the merchant receives 9,800 monetary units. The example assumes all components are percentage-based and ignores taxes, fixed fees, refunds, chargebacks and currency effects.

Acquirers must manage merchant credit risk. A merchant may receive funds before a customer dispute is resolved, while the acquirer remains responsible for scheme obligations. Reserves, delayed funding, transaction caps and monitoring may therefore be used for high-risk sectors.

8. Chargebacks and Dispute Management

A chargeback is a reversal or dispute process in which a transaction is challenged under applicable scheme rules. Common causes include unauthorized use, duplicate processing, non-receipt of goods, defective goods, incorrect amount, processing error or failure to provide a promised refund.

The typical process is:

1. The cardholder contacts the issuer or raises a complaint.
2. The issuer evaluates the claim and may initiate a dispute.
3. The acquirer notifies the merchant and may debit the merchant.
4. The merchant accepts the chargeback or submits evidence.
5. The issuer, acquirer or scheme evaluates the evidence under applicable rules.
6. The transaction is resolved, possibly with further representment or escalation.

Useful evidence may include delivery confirmation, customer communications, device and login information, refund records, transaction logs, terms accepted by the customer and proof of service. Evidence must be relevant, timely and handled lawfully; excessive collection of personal data creates additional risk.

Merchants should distinguish fraud disputes from consumer disputes. A customer may genuinely deny authorization, while another dispute may concern service quality or non-delivery. Strong customer authentication can reduce some unauthorized-use claims but does not automatically defeat every dispute.

9. PCI DSS and Card-Data Security

PCI DSS is an industry security standard for entities that store, process or transmit payment card data, and for organizations that can affect the security of the cardholder-data environment. It is not a substitute for national data-protection, banking or cybersecurity law.

Core PCI DSS practices include:

• Build and maintain secure network and system controls.
• Protect stored account data and avoid retaining unnecessary sensitive authentication data.
• Encrypt card data during transmission over open, public networks.
• Apply secure configurations and protect against malware.
• Maintain vulnerability-management and patching processes.
• Restrict access according to business need.
• Assign unique identities and authenticate users.
• Monitor and test security systems and processes.
• Maintain information-security policies, incident procedures and staff awareness.

The exact validation requirements depend on the entity’s role, transaction volume, region and applicable scheme or acquirer rules. Compliance is not a one-time certificate. It requires scope definition, control operation, testing, evidence and continuous improvement.

A practical first step is scope reduction. If a merchant uses a properly managed hosted payment page and does not receive card data into its own systems, its card-data environment may be smaller. Scope reduction does not remove responsibility: the merchant must select competent providers, manage integrations, protect accounts and verify that security controls remain effective.

Payment data should be classified. The PAN may be stored only when there is a documented business need and appropriate protection. Sensitive authentication data, such as certain authorization values, must not be retained after authorization under applicable PCI requirements. Access should be logged and reviewed, and incident-response plans should identify whom to notify and how to contain exposure.

10. Fraud, Risk and Governance

Card fraud may occur through counterfeit cards, stolen credentials, account takeover, merchant compromise, friendly fraud, phishing, malware, social engineering or collusion. Controls should be layered rather than dependent on one signal.

Important controls include:

• Chip and contactless cryptographic verification.
• PIN and strong customer authentication.
• Transaction limits and velocity rules.
• Device, IP, location and behavioral analysis.
• Merchant monitoring and category risk assessment.
• Tokenization and encryption.
• Real-time alerts and customer confirmation.
• Staff training and incident response.
• Independent testing and audit.

Artificial intelligence and machine-learning systems can identify unusual transaction patterns, but they require governance. Models may produce false declines, discriminate against legitimate customers, become less accurate as fraud changes, or rely on poor-quality data. Banks should monitor precision, false-positive rates, customer complaints, model drift, explainability and human override procedures. A fraud model should support—not replace—accountability and legal compliance.

Governance also involves customer fairness. Fees, foreign-exchange rates, recurring-payment terms, dispute rights and data uses should be communicated clearly. A bank should not make dispute procedures practically inaccessible or use fraud controls that systematically exclude legitimate customers without review.

11. Illustrative Case: A Retailer Moving to Omnichannel Payments

Background

GreenMarket is a medium-sized retailer operating ten physical stores and an online shop. It accepts debit and credit cards but uses separate systems for in-store and online transactions. Reconciliation is manual, online fraud is increasing, and customers report delayed refunds.

Problem

The retailer wants to introduce mobile-wallet acceptance, recurring online orders and a unified loyalty account. Management is concerned about PCI DSS scope, chargebacks and the cost of acquiring services.

Analysis

The separate systems create inconsistent customer records and make it difficult to match refunds to original transactions. Online transactions are card-not-present and therefore carry greater fraud and dispute exposure. Storing card numbers for recurring orders would increase security obligations. The retailer also lacks a formal chargeback-evidence process.

Approach and solution

GreenMarket selects an acquirer and gateway that support tokenization, hosted payment fields, EMV terminals, digital wallets and standardized reporting. Card numbers are not stored in the retailer’s own database. The retailer maps transaction identifiers across store, website and accounting systems, establishes daily reconciliation, and creates written procedures for refunds and disputes.

The retailer enables customer authentication for higher-risk online transactions and uses risk-based review rather than automatically declining all unusual purchases. Staff receive training on terminal tampering, refund controls and phishing. The acquirer provides merchant-category and fee reports, allowing management to compare transaction costs.

Outcome

The retailer reduces direct exposure to card data, improves refund traceability and obtains a more consistent view of sales. Chargeback responses become faster because delivery records, customer communications and transaction identifiers are linked. Some legitimate online orders are initially challenged by fraud rules, so the retailer reviews false declines monthly and adjusts controls.

Learning points

1. Technology selection affects compliance scope but does not eliminate merchant responsibility.
2. Authorization, settlement and reconciliation must be designed as connected processes.
3. Tokenization supports recurring payments but requires careful lifecycle management.
4. Chargeback prevention depends on operational evidence, not only fraud software.
5. Cost comparison should include fees, reserves, disputes, fraud losses and integration expenses.

12. Challenges and Contemporary Developments

Payment systems face several continuing challenges. Cross-border payments create currency, legal, sanctions and settlement complexity. Instant-payment schemes may reduce the time available for fraud detection. Mobile wallets increase convenience but introduce device, token-provisioning and platform risks. Open banking may provide alternatives to card payments while creating new questions about consent, authentication and liability.

Regulators and schemes increasingly emphasize strong customer authentication, operational resilience, data protection, third-party risk and transparent pricing. Digital identity, biometric authentication and behavioral analytics may improve security, but biometric information is particularly sensitive and cannot be treated as an ordinary password because it cannot easily be changed after compromise.

Banks and acquirers should design controls using a risk-based approach: identify threats, assess probability and impact, select preventive and detective controls, test them, monitor outcomes and improve continuously. Resilience planning should address processor outages, network failures, cyberattacks, terminal compromise, data breaches and inaccurate settlement files.

Best-Practice Checklist

A bank or acquirer should:

• Define responsibilities among issuer, acquirer, processor, gateway and merchant.
• Use secure issuance, activation, replacement and blocking procedures.
• Reconcile authorization, clearing, settlement and accounting records.
• Apply EMV, contactless and tokenization controls appropriately.
• Assess merchant business models and monitor unusual activity.
• Explain fees, refunds, recurring payments and dispute rights clearly.
• Minimize card-data storage and maintain PCI DSS controls.
• Test incident response and third-party continuity arrangements.
• Monitor fraud-model performance and customer impact.
• Review scheme rules, regulatory requirements and technology changes regularly.

Chapter Summary

Card payments are a coordinated ecosystem involving cardholders, issuers, merchants, acquirers, processors and payment networks. Issuance includes customer identification, risk assessment, personalization, activation and lifecycle management. A transaction moves through initiation, authorization, clearing, settlement and reconciliation; authorization permits a transaction but does not itself constitute final settlement.

EMV uses chip-based transaction data and cryptographic controls, while contactless payments use short-range communication and may apply transaction limits or additional verification. Tokenization substitutes restricted payment credentials and is central to many digital-wallet and recurring-payment models. Gateways transmit payment information, processors provide technical transaction services, and acquirers manage merchant relationships, funding and risk.

Merchant service charges may include interchange, network fees, acquiring margin and other charges. Chargebacks provide a structured dispute mechanism and require timely, relevant evidence. PCI DSS requires organizations in the card-data environment to protect systems, restrict access, monitor activity and maintain security processes. Effective card-payment management combines technology, operational controls, customer fairness, regulatory compliance, reconciliation and continuous risk monitoring.

Key Terms

Acquirer: Institution that provides card-acceptance services to a merchant and arranges merchant funding.

Authorization: Decision by the issuer or authorized system allowing or declining a proposed transaction.

Cardholder: Person or organization authorized to use a payment card.

Chargeback: Reversal or dispute process governed by applicable card-payment rules.

Clearing: Exchange and validation of transaction data and calculation of participant obligations.

Contactless payment: Payment using short-range communication, commonly NFC, between a card or device and terminal.

EMV: Technical framework for chip-based payment cards and transactions.

Gateway: Technology service that securely captures and transmits payment information.

Interchange: Fee or financial component exchanged within the card-payment system, commonly associated with issuer compensation.

Issuer: Institution that provides a card and maintains the cardholder account.

Merchant service charge: Amount charged to a merchant for card-acceptance services.

NFC: Near-field communication technology used for short-range contactless communication.

PAN: Primary account number associated with a payment-card account.

PCI DSS: Payment Card Industry Data Security Standard.

PIN: Personal identification number used as an authentication factor.

Processor: Organization providing technical or operational transaction-processing services.

Settlement: Financial completion of obligations among payment participants.

Tokenization: Replacement of sensitive payment data with a restricted substitute value.

Token service provider: Entity that manages token provisioning and the token-to-account relationship.

Three-party/four-party model: Different structural models for organizing card issuers, acquirers, merchants and networks.

Review Questions

Short Answer Questions

1. What is the difference between a card issuer and a card acquirer?
2. Why is authorization not the same as settlement?
3. State two advantages and one limitation of EMV technology.
4. What is tokenization, and how does it differ from encryption?
5. Identify four important PCI DSS security practices.

Long Answer Questions

1. Explain the complete life cycle of a card transaction from initiation to reconciliation.
2. Discuss the roles of gateways, processors and acquirers in online card payments.
3. Explain the components that may make up a merchant service charge.
4. Describe the chargeback process and the evidence a merchant may provide.
5. Evaluate the importance of layered fraud controls in card payments.

Analytical / Application Questions

1. A merchant receives approval for a transaction but later faces a chargeback for non-delivery. Explain why the authorization did not prevent the dispute and identify controls that could reduce future losses.
2. A retailer wants to store card numbers for recurring billing. Compare direct storage with tokenization and recommend an approach, considering security, PCI DSS scope and operational continuity.
3. An acquiring bank observes that a fraud model reduces fraud losses but produces many false declines for a particular customer group. What governance, fairness and performance actions should the bank take?

Multiple Choice Questions with Answers

Question 1

Which participant normally provides the card and maintains the cardholder’s account?

A. The issuer

B. The merchant

C. The gateway

D. The acquirer

Correct Answer: A. The issuer

Question 2

What is the primary purpose of authorization?

A. To calculate annual taxes

B. To decide whether a proposed transaction may proceed

C. To permanently settle all participant obligations

D. To print a replacement card

Correct Answer: B. To decide whether a proposed transaction may proceed

Question 3

Which technology uses transaction-specific cryptographic data to reduce the usefulness of simple card copying?

A. Magnetic stripe only

B. Paper voucher processing

C. EMV chip technology

D. Manual reconciliation

Correct Answer: C. EMV chip technology

Question 4

A payment token is best described as:

A. A substitute payment value restricted to a defined context

B. A merchant’s tax identification number

C. A customer’s PIN stored in plain text

D. A clearing-account balance

Correct Answer: A. A substitute payment value restricted to a defined context

Question 5

Which entity primarily maintains the merchant relationship in the traditional four-party model?

A. The cardholder

B. The issuer

C. The acquirer

D. The terminal manufacturer

Correct Answer: C. The acquirer

Question 6

A transaction has a value of 10,000 monetary units and total merchant fees of 2.00%. What is the fee, assuming no fixed charges or adjustments?

A. 20 monetary units

B. 200 monetary units

C. 500 monetary units

D. 2,000 monetary units

Correct Answer: B. 200 monetary units

Question 7

Which activity is part of clearing?

A. Exchanging transaction data and calculating obligations

B. Issuing a customer’s first card

C. Manufacturing a contactless antenna

D. Selecting a customer’s credit limit only

Correct Answer: A. Exchanging transaction data and calculating obligations

Question 8

What is a chargeback?

A. A routine card activation step

B. A reversal or dispute process under applicable payment rules

C. A type of contactless radio signal

D. A merchant’s advertising expense

Correct Answer: B. A reversal or dispute process under applicable payment rules

Question 9

Which practice is consistent with PCI DSS principles?

A. Retaining all sensitive authentication data indefinitely

B. Sharing administrator accounts among staff

C. Restricting access according to business need

D. Transmitting card data without protection on public networks

Correct Answer: C. Restricting access according to business need

Question 10

Why might an acquirer require a reserve from a high-risk merchant?

A. To guarantee unlimited customer credit

B. To manage potential future chargebacks and merchant-related losses

C. To eliminate the need for reconciliation

D. To replace EMV cryptography

Correct Answer: B. To manage potential future chargebacks and merchant-related losses