Julia Kagan is a financial/consumer journalist and former senior editor, personal finance, of Investopedia.
Updated August 29, 2023 Reviewed by Reviewed by Thomas J. CatalanoThomas J Catalano is a CFP and Registered Investment Adviser with the state of South Carolina, where he launched his own financial advisory firm in 2018. Thomas' experience gives him expertise in a variety of areas including investments, retirement, insurance, and financial planning.
An authorized transaction is a debit or credit card payment for which the merchant has received approval from the card-issuing bank. In most cases today, the authorization process is electronic and virtually instantaneous.
Although credit and debit card transactions are often completed in a matter of seconds, the infrastructure that makes that possible involves a number of players, including the individual merchant, the financial institution that issued the card, and their payment processing companies and networks.
The process begins when the purchaser presents their payment card or card number to the merchant. Today that generally means swiping or inserting (also known as dipping) their physical card in a merchant's card reader or entering their card details in an online merchant's checkout system. Many cards also allow for contactless payments, in which the user simply taps their card (or mobile device) on a merchant's terminal or waves it over one.
Once the relevant information has been gleaned from the card, it is transmitted to the merchant's bank (also called the acquiring bank), which serves as the lead facilitator on the transaction.
Most merchant banks work with a processor network, such as Visa or Mastercard, which allows the merchant to accept a variety of cards from different issuers. When a transaction has been initiated, the payment processor contacts the cardholder's financial institution, also called the issuing bank, to request approval for it.
The issuing bank ensures that the cardholder has the funds in their account (in the case of a debit card) or enough available credit (in the case of a credit card) to cover the charge. They may also have certain checks in place to help prevent fraudulent charges—a process variously known as authentication, validation, or verification.
In the course of the transaction, the cardholder may be required to enter a PIN number or provide their signature. In online or phone transactions, sometimes called card-not-present transactions, the cardholder may be asked for their card's validation code, a three- or four-digit number that appears on the card.
Once the issuing bank approves the charge, the processor informs the merchant bank, which confirms the charge, allowing the merchant to complete the transaction.
Again, all of this happens virtually instantaneously unless there is some sort of glitch, such as a computer network being down due to a power failure or other issue.
The merchant bank also serves as the settlement bank. Once the transaction has been authorized, it will arrange for the funds to be deposited in the merchant's account—a procedure sometimes referred to as capture.
As mentioned, another important step in credit and debit card transactions is authentication, also referred to as validation or verification.
While authorization checks whether the cardholder has enough money or credit in their account to pay the merchant, the goal of authentication is to determine whether the cardholder is who they say they are. It is primarily intended to protect the cardholder, card issuer, and merchant from fraudulent charges.
Debit and credit cards have a number of built-in features for authentication purposes.
The latest widely available technology is EMV chips, the small, square microchips that are embedded on the front of most cards. These chips contain the "information required to authenticate, authorize, and process transactions," as Visa puts it. That includes the cardholder's name and account number.
Many cards today also have magnetic stripes on the back. An older technology, they contain much the same information as the chips but are considered more vulnerable to identity theft. Thieves can surreptitiously insert a device called a skimmer in an ATM, gas pump, or other card reader to capture the card's information, which they can then use to run up fraudulent charges.
The next new thing is likely to be the use of biometrics, such as facial recognition and fingerprint scanning, to authenticate transactions.
If a transaction cannot be authorized, it will be declined, and the merchant will not proceed with it. A card can be declined for many reasons, including:
No, having your card declined will not affect your credit score. It may, however, be worth a call to your card issuer to find out why the card was declined, just in case there is something going on with the account that you're unaware of.
Credit and debit cards today typically have three-or-four digit validation codes, also known as CVV, CV2, or CVV2 codes, to provide an extra level of security in transactions where the physical card is not present. Even if a criminal has obtained someone's card number, they won't be able to supply the validation code if they're asked for it.
Many debit and credit cards today still have both technologies because not all merchants have yet installed terminals that are capable of reading chip cards. But stripes are gradually being phased out. Mastercard, for example, has announced that, "By 2029, no new Mastercard credit or debit cards will be issued with a magnetic stripe."
The major reason that chips are considered more secure is that, unlike magnetic stripes, they generate a unique, one-time code for each transaction instead of transmitting the actual card number. While thieves might be able to steal that code, they would not be able to use it additional times.
When you make a purchase or payment the bank card system will list this date as the transaction date. Transactions move into the pending category as the electronic authorization process proceeds. The posting date is the day that the purchase or payment is added or deducted from your account balance.
While it happens so quickly that many cardholders may be unaware of it, transaction authorization is a complex process involving multiple players. If your card fails to pass the test and is denied, it's worth finding out why so it doesn't happen again.