Key points of this lesson, in order.
Card-Present vs Card-Not-Present Transactions
What you will learn
Your objective. By the end of this lesson, you will be able to explain card-present vs card-not-present transactions. A card-present transaction happens when the physical card is at the point of sale, for example when a cardholder inserts a chip card into a terminal in a shop and enters a PIN, or taps a contactless card on the reader.
Why it matters. A business analyst must map these outcomes in the requirements, because the checkout screen, the authentication step and the error messages all change with the authentication result, and the test cases must cover success, failure and abandonment at the authentication step.
Chapter objective: From card types to clearing and settlement
Key learning points
- Card-present transaction: physical card is at point
- Merchant never sees
- Why card-not-present transactions often
- Issuer accepts more liability for fraud
- Telephone order and recurring payments
- Customer consent design
Key terms
Interchange: A fee paid by the acquirer to the issuer for each card transaction, set by the card scheme. It compensates the issuer for handling the transaction, funding the interest free period and managing fraud...
Acquirer: A bank or licensed institution that processes card payments for merchants and receives transaction funds from card schemes on their behalf.
Mandate: An authorisation given by a debtor to a creditor to collect payments from the debtor account by direct debit.
Payment flow diagram showing Card-Present vs Card-Not-Present Transactions.
Practise this lesson
Exercise
Trace the card payment in this lesson through authorisation, clearing and settlement.
Use the four-party model and the stage timings in this lesson.
- What to do. State what happens at each stage, who pays whom, and when the merchant is actually credited.
Correct result. Authorisation holds the funds and returns a response code. Clearing sends the transaction in a batch file. Settlement moves the net amount between banks, and the acquirer credits the merchant after deducting interchange, scheme fees and its margin.
Why. A card payment is not one event. The customer sees it on Monday, the merchant gets it on Wednesday, and the difference is the clearing and settlement cycle.
Check your understanding
Practice question
Which of the following best describes card-present vs card-not-present transactions?
Takeaway and next step
What to remember
The merchant never sees the card, so the transaction relies on the data entered, on the cardholder address checks and on authentication, rather than on the physical chip.
Follow EUR 120 through every stage, from instruction to beneficiary credit, and note where it can stop.
Open the Payment Lifecycle Simulator →
Builds on "Types of Payment Cards and Their Services".
Transcript and full text
Show transcript
A card-present transaction happens when the physical card is at the point of sale, for example when a cardholder inserts a chip card into a terminal in a shop and enters a PIN, or taps a contactless card on the reader. The terminal reads the chip, the cardholder proves possession of the card, and the PIN or the tap proves the cardholder is present. A card-not-present transaction happens when the card is not physically read, for example when a cardholder types the card number, expiry date and security code into a website to buy goods for EUR 120. The merchant never sees the card, so the transaction relies on the data entered, on the cardholder address checks and on authentication, rather than on the physical chip. The risk difference between the two channels is large, and it explains why fees and controls differ. In a card-present transaction, fraud usually needs the physical card or a cloned copy, which is hard to obtain, so the fraud rate is low. In a card-not-present transaction, a stolen card number alone is enough to attempt a purchase, so fraud rates are much higher and issuers apply stronger checks. That is why card-not-present transactions often carry higher interchange fees, why merchants may pay more to accept them, and why an online EUR 120 purchase can be declined even when the same card works in a shop. The liability for fraud also shifts between merchant, acquirer and issuer depending on the channel and on whether authentication was used. Strong customer authentication changes the online flow by asking the cardholder to prove identity with two factors, such as a password plus a one time code sent to a phone, or a fingerprint on a mobile banking app. When authentication succeeds, the issuer accepts more liability for fraud, and the merchant gains protection against a later claim that the cardholder did not authorise the payment. When authentication is not used, the merchant carries more of the risk, and the issuer may decline the transaction. A business analyst must map these outcomes in the requirements, because the checkout screen, the authentication step and the error messages all change with the authentication result, and the test cases must cover success, failure and abandonment at the authentication step. Mail order, telephone order and recurring payments are also card-not-present, and each has its own rules. A mail order payment uses card details written on a form, and a telephone order payment uses details read out on a call, so both depend on the merchant handling card data safely and never storing the security code. A recurring payment, such as a monthly subscription of EUR 15, uses stored card details and a mandate from the cardholder, so the merchant can charge the card each month without asking again. A product owner should consider how the customer gives consent, how the mandate can be cancelled, and how a failed recurring charge is retried, because those details decide whether the subscription feels smooth or causes complaints and chargebacks.
A card-present transaction happens when the physical card is at the point of sale, for example when a cardholder inserts a chip card into a terminal in a shop and enters a PIN, or taps a contactless card on the reader. The terminal reads the chip, the cardholder proves possession of the card, and the PIN or the tap proves the cardholder is present. A card-not-present transaction happens when the card is not physically read, for example when a cardholder types the card number, expiry date and security code into a website to buy goods for EUR 120. The merchant never sees the card, so the transaction relies on the data entered, on the cardholder address checks and on authentication, rather than on the physical chip.
The risk difference between the two channels is large, and it explains why fees and controls differ. In a card-present transaction, fraud usually needs the physical card or a cloned copy, which is hard to obtain, so the fraud rate is low. In a card-not-present transaction, a stolen card number alone is enough to attempt a purchase, so fraud rates are much higher and issuers apply stronger checks. That is why card-not-present transactions often carry higher interchange fees, why merchants may pay more to accept them, and why an online EUR 120 purchase can be declined even when the same card works in a shop. The liability for fraud also shifts between merchant, acquirer and issuer depending on the channel and on whether authentication was used.
Strong customer authentication changes the online flow by asking the cardholder to prove identity with two factors, such as a password plus a one time code sent to a phone, or a fingerprint on a mobile banking app. When authentication succeeds, the issuer accepts more liability for fraud, and the merchant gains protection against a later claim that the cardholder did not authorise the payment. When authentication is not used, the merchant carries more of the risk, and the issuer may decline the transaction. A business analyst must map these outcomes in the requirements, because the checkout screen, the authentication step and the error messages all change with the authentication result, and the test cases must cover success, failure and abandonment at the authentication step.
Mail order, telephone order and recurring payments are also card-not-present, and each has its own rules. A mail order payment uses card details written on a form, and a telephone order payment uses details read out on a call, so both depend on the merchant handling card data safely and never storing the security code. A recurring payment, such as a monthly subscription of EUR 15, uses stored card details and a mandate from the cardholder, so the merchant can charge the card each month without asking again. A product owner should consider how the customer gives consent, how the mandate can be cancelled, and how a failed recurring charge is retried, because those details decide whether the subscription feels smooth or causes complaints and chargebacks.
Full lesson text (all scenes)
Completing a lesson updates your progress dashboard on the homepage.
Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.