Tap, beep, done - about a second and a half. In that time the payment has been encrypted, sent to your provider, routed through Visa or Mastercard to the customer's bank, checked against their balance and fraud rules, and approved back down the same chain. Understanding that journey is the fastest way to understand what you're paying for - and where your money is between the tap and your bank account.
The cast: four parties in every payment
Every card payment involves the same four roles, whoever your provider is:
- The card machine (terminal): encrypts the card data and talks to your provider. It never stores the card number - that's the point of it.
- Your acquirer/payment provider (SumUp, Square, Dojo, Worldpay...): routes the transaction, takes the risk, and pays you out.
- The card scheme (Visa, Mastercard, Amex): the network in the middle, charging a small toll each way.
- The issuing bank (your customer's bank): says yes or no, and ultimately moves the money.
Authorisation: the two seconds
When the card taps, the terminal creates an encrypted request - amount, masked card details, merchant ID - and fires it to your acquirer, who passes it via the scheme to the issuing bank. The issuer checks funds, fraud signals and (for contactless) whether a PIN check is due, then returns approved or declined. The whole round trip typically takes one to two seconds.
Crucially, authorisation only reserves the money - nothing has actually moved yet. That's why a payment can occasionally show as 'pending' on a customer's app and later vanish: an authorisation that was never completed simply expires.
Settlement: where your money is overnight
At the end of the day the terminal 'batches' its approved transactions and submits them for settlement - the actual movement of money from issuing banks to your acquirer, minus interchange and scheme fees, and then to you, minus your provider's cut. That pipeline is why payout timing varies by provider: next business day is standard, same-day and weekend settlement are premium features.
It's also why your fee exists: the acquirer fronts fraud and chargeback risk, pays the wholesale costs, runs the infrastructure, and prices their margin on top. The margin is the only negotiable slice - the subject of our average fees benchmark.
Chip, PIN, tap and phone: what changes at the terminal
Chip-and-PIN and contactless are the same journey with different customer verification: the chip proves the card is genuine, the PIN (or the phone's Face ID for Apple/Google Pay) proves the holder is present. Contactless card taps are capped at £100 per transaction in the UK; phone wallets aren't, because the device itself authenticates the customer - the full detail is in our contactless limit explainer.
For you as the merchant, verified in-person payments are the safest kind: liability for most fraud sits with the bank, not you - one of several reasons card-present businesses see so few successful chargebacks.
FAQs
Does a card machine need internet?
Yes - via WiFi, ethernet or its own SIM. Authorisation is a live conversation with the customer's bank. Some providers queue limited offline payments and submit them later, but check the liability rules before relying on it.
How long does the money take to reach my account?
Next business day is the small-business standard; some providers offer same-day or weekend settlement. The delay is settlement processing, not your provider sitting on your cash for fun - though faster payouts are a genuine differentiator.
Does the card machine store card numbers?
No - modern terminals encrypt card data at the point of read and never hold it. That design is why PCI compliance for a typical small shop is mostly a questionnaire rather than an engineering project.
