How Online Card Payments Work

By James Whitfield, Payments Specialist · Updated 2026-08-08

The Basic Steps: How Online Card Payments Work

Most people never stop to think about what happens between clicking "pay" and seeing "order confirmed." But understanding how online card payments work makes it a lot easier to trust virtual cards, spot fraud early, and choose the right payment tool for freelance work, ad spend, or everyday shopping.

Here's the online card payment process broken down in plain terms:

1. A shopper enters card details at checkout.
2. The merchant's payment gateway encrypts and sends that data to an acquiring bank.
3. The acquiring bank routes the request through a card network (Visa, Mastercard, etc.).
4. The card network forwards it to the issuing bank, which approves or declines it.
5. The response travels back the same path, and the merchant gets a yes or no in under two seconds, typically.

That's really the whole thing. Everything else - tokenization, 3D Secure, settlement - is just detail layered on top of this core chain.

How Card Authorization Works

Authorization is the moment a bank checks whether a payment should go through. It's the heart of how card authorization works, and it happens almost instantly.

When someone submits a payment, the issuing bank runs a few checks: is there enough balance or credit, does the billing info match, is the transaction pattern unusual, and does the fraud score fall within an acceptable range. If everything checks out, the bank sends an approval code. If not, it sends a decline, sometimes with a reason code the merchant can interpret.

This is also where a card payment gateway explained in simple terms matters. The gateway is just the software layer that connects a merchant's checkout page to the acquiring bank. It doesn't make decisions - it packages and forwards data securely, then relays the response.

Issuing Bank vs Acquiring Bank: Who Does What

This distinction trips up a lot of people, so it's worth spelling out clearly.

So issuing bank vs acquiring bank really comes down to whose money is on which side of the transaction. The issuer represents the cardholder. The acquirer represents the merchant. Neither one talks directly to the other - they always go through the card network.

Payment Tokenization and 3D Secure Explained

Two security layers show up constantly in modern card payments, and both matter for anyone using a virtual card online.

Payment tokenization replaces the actual card number with a randomly generated token during transmission and storage. Merchants and even some payment gateways never see the real card number - only the token, which is useless if intercepted. This is a big reason virtual card online payments feel safer for online shopping and recurring subscriptions.

3D Secure is the extra verification step - a one-time code, a banking app prompt, or a biometric check - that confirms the person paying is actually the cardholder. It's often what triggers that "verify your payment" pop-up during checkout. 3D Secure explained simply: it shifts liability and cuts down fraud by adding a second identity check beyond the card number itself.

Together, tokenization and 3D Secure are why the card network authorization flow today looks nothing like it did a decade ago - it's layered, fast, and mostly invisible to the end user.

Card Settlement Process: Getting Paid

Authorization only reserves the funds. The money doesn't actually move until settlement.

The card settlement process usually happens in a batch, once or twice a day. The merchant's acquiring bank submits all approved transactions to the card network, which clears them with the various issuing banks. Funds then move from the cardholder's issuing bank to the merchant's acquiring bank, minus interchange and network fees. This is also how credit card processing works on the backend - authorization is real-time, settlement is batched.

For the cardholder, this whole process is invisible. They see "paid" the moment authorization succeeds, even though the actual bank-to-bank money movement can take a day or two behind the scenes.

How Virtual and Stablecoin-Funded Cards Fit In

Here's where it gets interesting for crypto users, freelancers paid in USDT or USDC, and digital nomads juggling multiple currencies.

A virtual card works exactly like the flow described above - checkout, authorization, network routing, settlement - but the card itself isn't physical plastic. It's a set of card details (number, expiry, CVV) issued digitally, usable online, in-store via Apple Pay or Google Pay, or typed in manually at checkout. For a deeper look at that mechanic, see How Virtual Cards Work and the broader primer on What Is a Virtual Card?

Stablecoin card payments add one more step before authorization even begins: converting a crypto balance into spendable card value. With a platform like WaldenPay, a user loads USDT (TRC20) or USDC (ERC20/TRC20) into an account wallet, and that balance funds a virtual card - typically ready in about 5 minutes, with a standard 5% top-up fee and a one-time card issue fee. From that point forward, the card behaves like any other card in the card network authorization flow. The merchant, the acquiring bank, and the card network have no idea the underlying value started as crypto - they just see a standard authorization request and respond the same way they would to a bank-issued card.

This is really the answer to how do virtual cards work online when crypto is involved: the crypto-to-card conversion happens once, upfront, and everything downstream - authorization, tokenization, 3D Secure, settlement - runs through the same rails as traditional plastic. Nothing about the checkout experience changes for the merchant, which is exactly why these cards work at the 150M+ merchants that already accept Visa or Mastercard.

It's worth being clear about one thing: using a crypto-funded card is a privacy tool, not an anonymity tool. Loading and spending are still subject to AML checks and applicable regulations. For a full breakdown of what that means for security, see Are Virtual Cards Safe?, and for cost details, Crypto Card Fees Explained covers exactly what gets charged and when.

FAQ

What's the difference between authorization and settlement?

Authorization is the real-time check that approves or declines a transaction and reserves the funds. Settlement is the actual movement of money between banks, which usually happens in batches within a day or two after authorization.

Do virtual cards use the same authorization process as physical cards?

Yes. Virtual cards run through the identical card network authorization flow - checkout, gateway, acquiring bank, network, issuing bank, and back. The only difference is how the card was issued and funded, not how it's processed at checkout.

Is a stablecoin-funded card riskier than a regular card?

Not inherently. Once the crypto balance is converted and loaded, the card behaves like any other card during checkout, with the same tokenization and 3D Secure protections. The added considerations are around fees, conversion timing, and regulatory compliance rather than checkout security.

Why did my payment get flagged for extra verification?

That's usually 3D Secure kicking in - an added identity check triggered by the issuing bank or card network based on transaction size, location, or risk scoring. It's a normal part of how online card payments work today, not a sign something is wrong.