Payments glossary

A card-network authentication protocol that shifts fraud liability from the merchant to the issuer when a cardholder is verified.

The current EMVCo authentication standard, sending 100+ data elements to the issuer for risk-based, mostly frictionless customer verification.

Fraud where a challenge was passed (e.g. via phishing or SIM swap) yet the transaction is later disputed; liability may still sit with the issuer under scheme rules.

Cryptogram returned by 3DS authenticating the transaction to the issuer, evidencing liability shift when passed intact to authorisation.

Issuer-side component in a 3DS flow that decides frictionless vs challenge, issues cryptograms, and enforces SCA rules.

Fraud where an attacker gains control of a customer's merchant account (loyalty balance, saved cards) via credential stuffing or phishing.

A scheme service that automatically updates stored card numbers and expiry dates when an issuer reissues a card.

US batch bank-transfer system for debits and credits, settling in one to three business days at very low per-transaction cost.

The licensed bank or financial institution that holds the merchant's MID and settles card transactions on the merchant's behalf.

SCA exemption applied by the acquirer using its own fraud rates, letting eligible transactions bypass 3DS challenges under EUR 500.

The acquirer's own fee added on top of interchange and scheme fees, usually quoted in basis points plus a per-transaction cash amount.

An issuer service that compares the billing address submitted with a transaction against the cardholder's address on file.

BNPL provider (Clearpay in UK) offering interest-free Pay in 4 instalments; merchant fees typically 4-6% with instant settlement.

Ant Group's cross-border wallet aggregator giving merchants access to Alipay, Kakao Pay, GCash, Touch 'n Go, and other Asian wallets through one integration.

Any non-card payment method, wallets, bank transfers, BNPL, vouchers, accepted at checkout.

Successive EU Anti-Money Laundering Directives extending scope to crypto, tightening UBO thresholds, and adding criminal liability for compliance failures.

The regulatory regime that obligates payment institutions to detect and report suspicious activity.

Apple's wallet using DPAN network tokens and device biometrics; qualifies as SCA in the EEA and carries scheme-defined liability shift equivalents.

Final, binding dispute stage where Visa or Mastercard rule on liability; loser pays scheme filing fees of USD 500 or more plus the disputed amount.

Small scheme fee (typically 12-14 bps) that Visa and Mastercard levy on every acquiring transaction to fund network operations.

Real-time issuer check confirming a card is valid and funds are available; results in an approval code, decline, or referral response.

Flat scheme fee (a few pence per attempt) charged for each authorisation message regardless of approval, driving up costs on retry-heavy portfolios.

The reservation of funds on a cardholder's account after a successful authorisation; expires after the scheme's decision-time window if not captured.

Ratio of approved authorisations to total attempts; the single most important lever on card revenue and the primary KPI of a good orchestration setup.

AVS response where street or postcode fails to match the issuer's file; a common decline reason and standard fraud-rule input.

UK bank debit scheme with a three-day clearing cycle and a Direct Debit Guarantee that lets payers reclaim disputed collections without evidence.

Belgian domestic scheme (80%+ debit-card share) offering QR-based app payments alongside physical card acceptance.

The first 6–8 digits of a card number, identifying the issuer, country, scheme, and product type.

Submitting authorisations or captures in a scheduled bundle rather than in real time; still standard for card-present clearing and legacy back-office flows.

Licensed principal member sponsoring a fintech's card programme onto Visa or Mastercard rails, holding scheme liability and compliance oversight.

A single flat rate (e.g. 2.9% + 30¢) charged on all card transactions regardless of underlying interchange.

Mastercard's compliance programme policing prohibited or misrepresented merchant activity, from illegal content to transaction laundering.

Short-term instalment credit offered at checkout by providers like Klarna, Clearpay, and Affirm; regulated as consumer credit in the UK from 2026.

The step where an authorised transaction is submitted for settlement, converting a hold into a cleared debit against the cardholder's account.

An authorisation response refusing to fund a transaction, returned by the issuer with a reason code.

The network operating a card brand's rules, interchange, and settlement (Visa, Mastercard, American Express, Discover, JCB, UnionPay).

Fraud pattern where bots probe stolen card numbers with small authorisations to identify live cards for resale or downstream fraud.

A PCI-DSS-compliant store of tokenised card credentials that lets a merchant charge a card again without holding the PAN.

The 3- or 4-digit code printed on a card, used to prove the cardholder physically holds the card.

Verifi network delivering pre-dispute notifications so merchants can refund before a Visa chargeback is filed, keeping the transaction off the dispute count.

A transaction initiated by the cardholder in real time, typically the first charge that establishes credential-on-file.

French domestic scheme co-badged with Visa or Mastercard on most French cards; French merchants must offer CB routing choice under EU rules.

Retrying a declined transaction on a second acquirer or scheme to recover authorisation, subject to scheme rules on retry frequency and reason codes.

3DS2 outcome where the issuer prompts the cardholder for an additional factor (biometric, OTP, banking app) before approving the transaction.

A forced reversal of a card payment initiated by the cardholder's issuing bank.

Third-party product reimbursing merchants for approved orders that later chargeback as fraud, in exchange for a percentage of protected volume.

Monthly ratio of disputes to sales, calculated per MID; the primary metric governing entry to VAMP, ECP, and other monitoring programmes.

The merchant-facing payment surface, the form, hosted page, or SDK where the customer enters payment details.

The scheme process reconciling captured transactions between acquirer and issuer, producing the net position that settles between banks.

EMVCo-standard scheme wallet (Visa, Mastercard, Amex, Discover) letting shoppers check out with a stored profile across participating merchants.

Card carrying two scheme brands (e.g. Cartes Bancaires + Visa) letting merchants or cardholders choose the routing network; mandated in France and Belgium.

Business-issued card (corporate, purchasing, small business) attracting higher interchange but eligible for Level 2/3 rate reductions on qualifying data.

Visa rule (in force since April 2023) letting merchants defeat 10.4 disputes by proving two prior undisputed transactions from the same cardholder across matching data points.

NFC-based tap-to-pay flow with EMV cryptogram protection; scheme limits (GBP 100 in UK, EUR 50 in EEA) trigger periodic SCA under PSD2.

A commercial card issued to employees for expenses, typically carrying higher interchange and stricter authorisation rules than consumer cards.

Regulatory framework paired with AML, requiring monitoring and reporting of transactions suspected of funding terrorist activity.

Card drawing on a revolving line of credit issued to the cardholder, generally attracting higher interchange than debit and carrying different dispute rights.

A card transaction where the issuer country differs from the acquirer country, attracting higher interchange and scheme fees.

Failed card verification value check; strong fraud signal and, for card-not-present, a common trigger for issuer decline or soft-decline responses.

The 3- or 4-digit code on the back of the card used to prove possession during card-not-present transactions; scheme rules forbid post-auth storage.

The trading name shown to cardholders on statements, typically limited to 25 characters and required to match the checkout brand to avoid disputes.

Card drawing directly on a bank account; typically attracts lower interchange than credit and is often the largest volume category in EU markets.

Authorising a card at order time and capturing funds later (up to seven days for Visa, 30 days for travel/rental), keeping the auth hold on the cardholder's line.

EMVCo framework letting merchants or wallets perform SCA on the issuer's behalf using device biometrics, honoured under FIDO-based scheme programmes.

Identifying a browser or app by 100+ passive signals (canvas, fonts, WebGL, TLS) to link sessions across cards and detect anomalies without cookies.

Scheme-run server (Visa DS, Mastercard DS) routing 3DS authentication requests from MPI to the correct issuer ACS.

Any cardholder-initiated challenge to a transaction, covers retrieval requests, chargebacks, pre-arbitration, and arbitration.

National card network (CB, Dankort, Bancontact, Elo, mada) operating on locally issued cards, usually cheaper and higher-approval than international schemes.

The process of retrying failed subscription payments and notifying customers to update their card before churning them.

Offering foreign cardholders to pay in their home currency at the point of sale, with the merchant/acquirer earning an FX margin regulated by scheme rules.

Two-digit code returned by 3DS indicating the authentication outcome; determines whether liability sits with the merchant, acquirer, or issuer.

Regulated entity issuing e-money under PSD2/EMD2; central to wallet, marketplace, and neo-bank set-ups and subject to safeguarding rules.

Brazilian domestic scheme accepted alongside Visa and Mastercard; strong penetration in issuing but limited cross-border reach.

The chip standard (Europay, Mastercard, Visa) enabling secure card-present authorisation via dynamic cryptograms rather than static magstripe data.

Automated brute-force of PAN, expiry, or CVV combinations against a merchant's checkout; Visa's VAAI Score now scores merchants on exposure.

Mastercard Ethoca and Visa Rapid Dispute Resolution feeds letting merchants refund a transaction pre-chargeback (typically within 24h) to avoid a scheme dispute.

First-tier Mastercard ECP status triggered at 100+ chargebacks and a 1.5% chargeback-to-transaction ratio in a calendar month.

Secondary acquirer used when the primary declines or is unavailable, giving merchants processor redundancy and higher aggregate approval rates.

A legitimate transaction refused by issuer or merchant risk rules; industry estimates put global losses in the tens of billions annually.

UK real-time bank transfer scheme (24/7, up to GBP 1 million per payment) used for payouts, Open Banking payment initiation, and Pay by Bank flows.

US Federal Reserve real-time payments service launched 2023, competing with TCH RTP for instant credit push at up to USD 500,000.

Submitting a clearing message without a matching authorisation, typically used for voice-authorised transactions; carries elevated dispute risk.

3DS2 outcome where the issuer authenticates the cardholder purely from device and transaction data, with no challenge shown to the customer.

A chargeback filed by a real cardholder for a transaction they actually made, often because they don't recognise the descriptor or want a refund without contacting the merchant.

The schedule (daily, weekly, monthly) on which an acquirer pays a merchant, net of fees, reserves, and refunds, into their nominated bank account.

Currency conversion applied to a cross-currency transaction, by the merchant, acquirer, or cardholder's bank.

The spread an acquirer, gateway, or DCC provider adds to the interbank rate when converting a cross-currency transaction, typically 100-350 bps.

EU/UK data-protection law governing processing of personal data (including cardholder data outside the PCI perimeter) with fines up to 4% of global turnover.

German bank-transfer payment method (retired in June 2024 for standalone use, folded into Wero) that redirected shoppers to online banking to authorise a payment.

Post-arbitration mechanism where an acquirer requests reimbursement from the issuer outside the formal dispute cycle, typically for amounts below scheme minimums.

Google's wallet using scheme network tokens on Android; provides device or challenge biometrics counted as SCA under PSD2.

Payout model where the acquirer funds the full transaction amount and invoices fees separately; preferred by larger merchants for reconciliation clarity.

A terminal decline (e.g. lost/stolen, pickup card, invalid account) that must not be retried.

Tamper-resistant device used by acquirers, issuers, and P2PE providers to store keys and perform cryptographic operations on card data.

Second-tier Mastercard ECP status triggered at 300+ chargebacks and a 3.0% ratio, carrying materially higher monthly fines.

A merchant whose vertical, business model, or chargeback profile makes standard acquirers reluctant to board them.

Dominant Dutch bank-redirect payment method (60%+ of NL ecommerce) settled via SEPA Instant, now migrating to the pan-European EPI Wero scheme.

Higher, unregulated interchange applied when card and merchant sit in different regions (e.g. US cardholder buying from UK merchant); often 1.15% to 1.65%.

The fee paid by the acquirer to the issuer on every card transaction, set by the schemes.

Techniques (Level 2/3 data, correct MCC, network token, right BIN routing) that qualify transactions for lower interchange categories.

Transparent acquirer pricing model that passes interchange and scheme fees through at cost with a fixed processor markup on top.

Fully unbundled pricing exposing three components: interchange (paid to issuer), scheme fees (paid to Visa/Mastercard), and acquirer markup.

Subscription cancellations caused by payment failures (expired cards, insufficient funds, soft declines) rather than deliberate customer decisions.

Third-party reseller of acquiring services, typically taking commission on portfolio volume; contractually distinct from a PayFac.

Modern XML-based financial-messaging standard used by SEPA, RTP, SWIFT gpi, and CBPR+; enables richer remittance and structured payment data.

The message standard underlying scheme authorisation and clearing exchanges; defines transaction types, response codes, and data element positions.

The bank that issues a payment card to a cardholder and authorises or declines transactions on it.

Two-digit ISO 8583 response (05 Do Not Honour, 51 Insufficient Funds, 54 Expired Card) explaining why an issuer refused an auth; drives retry logic.

SCA exemption applied by the issuer's ACS based on its risk view of the transaction, often the origin of frictionless approvals on higher tickets.

The first six to eight digits of the PAN identifying the issuing bank and product; formerly called BIN and used for routing, fraud, and BIN-lookup logic.

Buy-now-pay-later provider offering Pay in 3/4, Pay in 30, and financing; scheme fee-free but with 3-6% merchant discount and refund liability rules.

Onboarding due diligence on a legal entity: incorporation, licences, UBOs, sanctions, and business model, mandated for acquirers under AML rules.

Regulated identity-verification of the merchant (KYB) and, where relevant, the merchant's customers (KYC).

Routing eligible transactions (often domestic debit) via the cheapest available network; mandated in Australia for merchant choice on dual-network cards.

Line-item transaction data (item code, quantity, unit price, freight) required to earn the lowest commercial-card interchange tiers.

Scheme rule moving fraud liability from merchant to issuer once 3DS authentication succeeds, defended by ECI 05 (Visa) or ECI 02 (Mastercard) flags.

Processing transactions via an acquirer domiciled in the cardholder's country to lift approval rates 5-15 points and avoid cross-border interchange.

PSD2 SCA exemption for transactions under EUR 30, capped at five consecutive or EUR 100 cumulative unauthenticated transactions per card.

Saudi Arabian domestic debit scheme mandated for local card acceptance; typically co-badged with Visa or Mastercard on the same PAN.

Two-sided platform aggregating third-party sellers; scheme rules treat marketplaces as merchants of record with distinct dispute and settlement obligations.

Mastercard programme with two tiers (ECM at 100 disputes and 1.5% ratio, HECM at 300 disputes and 3.0% ratio) that fines merchants monthly until remediated.

Mastercard-maintained database of merchants terminated by acquirers for fraud, laundering, excessive chargebacks, or bankruptcy; entries persist for five years.

Four-digit ISO 18245 code used by card schemes to classify a merchant's business.

The total blended percentage a merchant pays their acquirer per transaction, comprising interchange, scheme fees, and acquirer margin.

A unique identifier issued by an acquirer that ties transactions to a specific merchant account.

Client-side or server-side component orchestrating the 3DS message flow with the DS and ACS on behalf of a merchant or PSP.

Funds held back by the acquirer (rolling, upfront, or capped) as security against chargeback and fraud risk.

Two tokenisation models: PSP vaults store PAN cryptographically for one merchant; network tokens are scheme-issued, portable, and auto-updated by issuers.

A charge initiated by the merchant against a previously stored credential, without the cardholder present.

EU regulation (in force 2024/2025) licensing crypto-asset service providers and stablecoin issuers, aligning them with payments AML and safeguarding rules.

Mobile point-of-sale set-up combining a smartphone or tablet with a Bluetooth card reader for card-present acceptance on the move.

Accepting and settling in multiple currencies via local acquiring or MCP, avoiding cross-border and FX fees on presented-currency transactions.

Payout model where the acquirer deducts fees, refunds, and chargebacks from gross transactions before funding; the merchant receives one net figure.

A scheme-issued token that replaces the PAN end-to-end and is automatically updated when the underlying card is reissued.

Short-range radio protocol carrying contactless card, wallet, and phone tap payments between the mobile device or card and the terminal.

Rare case where the same institution is both issuer and acquirer, allowing internal netting and often better approval and pricing than schemes-routed traffic.

Cross-border payment where only one of the merchant or issuer is in the EEA; SCA does not strictly apply but issuers may still challenge for risk.

UK/EU regulatory framework mandating banks expose account and payment APIs to licensed third parties, enabling Pay by Bank and account-based checkouts.

Masking all but the first six and last four digits of a PAN in receipts and logs, mandated by PCI DSS and most privacy regimes.

Refunding less than the original transaction amount; may be issued multiple times up to the original captured sum.

Provider (India-specific term, similar to PayFac) that aggregates small merchants under a single acquiring relationship, regulated by RBI in India.

Master merchant onboarding sub-merchants under a single MID with sponsorship from a full acquirer; regulated boarding, transaction, and monitoring rules apply.

A technical layer that encrypts card data, forwards authorisation requests to an acquirer, and returns the result to the merchant.

PSD2-regulated service where a licensed provider initiates a bank transfer on the payer's behalf, used for Pay by Bank and Open Banking checkouts.

A platform layer that lets a merchant connect to multiple acquirers, APMs, and risk tools through one integration and route transactions intelligently.

The orchestration layer deciding which acquirer or APM handles each transaction, using rules on cost, BIN, currency, geography, and historical approval.

A vendor that provides payment-acceptance technology, gateway, vaulting, reporting, sometimes acquiring, under one contract.

Singapore instant bank-transfer scheme routing payments via mobile number, NRIC, or UEN, widely accepted at QR checkouts.

The transfer of settled funds from acquirer to merchant bank account, cadence governed by the funding cycle and any reserve holdbacks.

The Payment Card Industry Data Security Standard, the scheme-mandated framework for handling cardholder data.

PCI DSS validation form (SAQ A through D) whose scope depends on how the merchant handles card data; A applies to fully outsourced iframe/hosted flows.

Brazilian instant-payment scheme operated by the central bank; free for consumers, low-cost for merchants, and dominant in Brazilian ecommerce since 2022.

Hardware-based encryption of cardholder data at the terminal, decrypted only at a PCI-listed HSM, shrinking the merchant's PCI scope to SAQ P2PE.

Identifying customers holding prominent public functions, their families, and close associates, who require enhanced due diligence under AML rules.

Second dispute cycle where the issuer challenges the merchant's representment, giving the acquirer a final chance to accept liability or escalate to arbitration.

Card funded in advance rather than drawing on credit or bank balance; treated as debit for interchange but often flagged higher-risk for fraud.

The 13-19 digit card number embossed on a card, tokenised in PCI-compliant flows to prevent storage of raw cardholder data.

Scheme member licensed to issue or acquire directly, entitled to a BIN or ICA range, and responsible for compliance across its downstream programmes.

The EU's Payment Services Directive 2, which mandates SCA, opens banking APIs, and reshapes payment liability.

EU/UK PSD2 requirement that EEA-issued cards used at EEA merchants complete SCA unless an exemption applies; enforced by issuers via 3DS challenges.

Successor to PSD2 (Payment Services Regulation and PSD3) tightening SCA, fraud liability, IBAN name-checking, and open finance access; in EU legislative process.

Scheme-defined code identifying the grounds for a chargeback (e.g. Visa 10.4 for cardholder-not-authorised, 13.1 for goods not received) that dictates the evidence required to defend it.

Matching gateway, acquirer, and bank records to isolate discrepancies (missing captures, unclear fees, timing gaps); a core finance workflow for scale merchants.

A merchant-initiated transaction charging a stored credential on a fixed or variable schedule, requiring initial CIT with SCA plus MIT flagging thereafter.

A post-settlement reversal returning funds to the cardholder; scheme rules require refunds to route to the original card where possible.

Capped rates set by the EU Interchange Fee Regulation (0.2% consumer debit, 0.3% consumer credit) and UK equivalents; commercial cards and inter-regional traffic are exempt.

The merchant's response to a chargeback, with evidence that the original transaction was valid.

A pre-chargeback inquiry from the issuer asking the merchant for transaction details.

Rules that re-attempt a declined transaction across time windows, acquirers, or authentication levels to recover revenue.

A percentage of each transaction held by the acquirer for a fixed period (e.g. 10% for 180 days) to cover chargeback risk.

US real-time payment rail run by The Clearing House; instant, credit-push only, USD 1 million limit, with growing merchant use for payouts.

UK/EU rule requiring EMIs and PIs to segregate customer funds in dedicated safeguarding accounts or insured against insolvency; strengthened under 2026 UK rules.

Screening customers, UBOs, and counterparties against OFAC, UN, EU, and HM Treasury sanction lists during onboarding and ongoing monitoring.

Fees charged by Visa and Mastercard (or another scheme) to acquirers and issuers on every transaction.

Mastercard term for representment: the merchant's rebuttal transaction re-submitting the disputed charge with compelling evidence.

The legal entity contracting with the buyer, holding chargeback and tax liability; central to marketplace, SaaS, and cross-border set-ups.

B2B variant of SEPA DD; no debtor refund right for authorised collections, giving merchants stronger protection but requiring mandate pre-registration with the debtor's bank.

Standard SEPA Direct Debit variant, D-1 pre-notification; consumer chargeback window is 8 weeks for authorised debits, 13 months for unauthorised.

Pan-European bank debit scheme (Core and B2B variants) letting merchants pull EUR-denominated payments from customer accounts under a signed mandate.

Real-time euro credit transfer scheme (up to EUR 100,000, 10-second confirmation) becoming mandatory for EEA PSPs during 2025.

The transfer of funds from the acquirer to the merchant's bank account, net of fees and reserves.

The currency in which an acquirer pays a merchant, potentially different from the transaction currency and requiring FX conversion.

Acquirer-provided file (typically daily) listing captures, refunds, fees, and net funding; the ground truth for merchant reconciliation and revenue recognition.

Algorithmic selection of an acquirer or MID per transaction to maximise approval rate, minimise cost, or both.

A transient decline (e.g. insufficient funds, do-not-honour, generic) that can usually be recovered with retries.

The merchant name and contact info shown on the cardholder's statement.

Accepting contactless payments on a merchant's own NFC-enabled smartphone, without a separate terminal; certified under EMVCo's SPoC and MPoC standards.

Elevating a transaction from frictionless to a challenge when the issuer's risk engine, the acquirer, or SCA rules require an extra factor.

PSD2 requirement that customer-initiated electronic payments in the EEA and UK be authenticated with two of: knowledge, possession, inherence.

Recurring product/service billing model; scheme rules require pre-notification, clear cancellation, and MIT flagging for post-trial charges.

Global bank messaging network used to instruct cross-border wire transfers; slower and more expensive than schemes, but the default for large B2B settlements.

Fabricated identity blending real and false PII to open accounts, secure credit, and season cards before cashing out; a top loss vector in card issuing.

Funding cycle where an acquirer pays out merchant proceeds one business day after transaction capture; T+2 and T+3 cycles are also common.

Replacing sensitive card data with a non-sensitive surrogate value that can be stored and reused without PCI scope.

Processing prohibited or third-party sales through an unrelated merchant's MID; a top BRAM violation drawing Mastercard fines from USD 25,000 upward.

PSD2 exemption from SCA for low-fraud acquirers on transactions under EUR 500, calibrated to portfolio fraud rates measured quarterly.

FATF Recommendation 16 requiring transmission of originator and beneficiary details on payments above thresholds; extended to VASPs under MiCA.

Fraud pattern where users repeatedly sign up for free trials using synthetic identities or single-use card numbers to avoid the paid conversion.

SCA exemption where cardholders whitelist a merchant with their issuer, exempting subsequent transactions from strong authentication.

Natural person(s) owning or controlling 25%+ of a legal entity, whose identity acquirers must verify and screen during KYB.

Self-service card terminals (fuel pumps, parking, ticket machines) subject to specific scheme rules on decision-time windows and auth amounts.

India's real-time A2A payment system routing VPA-based transfers via banks; over 12 billion transactions per month in 2024.

Visa's umbrella programme monitoring acquirer portfolios for excessive fraud and disputes, replacing legacy VDMP and VFMP thresholds from 2025.

Fraud rule capping the number of attempts per card, IP, device, or email in a rolling window (e.g. 3 auths/card/hour) to blunt card testing and abuse.

Legacy Visa programme that placed merchants exceeding a 0.9% dispute ratio and 100 monthly disputes into escalating remediation tiers.

Legacy Visa programme flagging merchants whose fraud-to-sales ratio exceeded 0.9% and $75,000 monthly fraud volume.

Visa programme scrutinising merchants in regulated verticals (gambling, adult, pharmaceuticals) for licence, content, and boarding compliance.

Cancelling an authorisation before capture, releasing the hold with no clearing message; only possible within the auth window.

Tencent's in-app wallet embedded in WeChat; essential for reaching Chinese consumers via QR, mini-programs, and cross-border H5 flows.

European Payments Initiative wallet built on SEPA Instant, replacing giropay and iDEAL flows across DE, FR, BE, and NL from 2024 onwards.