Field guide
Anatomy of a Checkout.
For anyone who wants to become a product manager for payments and checkout: here is what I’ve learned, put together in one place. When a shopper taps “Place order,” no money moves. What follows is a chain of promises, requests, and ledger entries across several companies, and this guide walks you through it one diagram at a time.
By Nagesh Koritala Last verified: November 2026 Your progress stays on this device.
What you’ll learn
By the end, you’ll be able to:
- Find what makes shoppers leave a checkout, fix each part of it, and measure whether a fix helped.
- Explain what happens after “Place order”: authorization, capture, clearing, and settlement, and when money actually moves.
- Choose between a void, a reversal, and a refund, and know what evidence wins a dispute.
- Tell an FPAN from a DPAN, an MPAN, and a network token, and label any card payment by channel, initiator, and credential.
- Know which PCI DSS questionnaire fits a checkout, and which US rules and laws apply to it.
The path
Thirteen lessons, in four parts.
Start at lesson 1 and follow the money, or jump to what you need this week. Each lesson has a diagram to step through.
Part 1
The checkout
What the shopper sees, and what to fix first.
Part 2
Follow the money
From the first hold to money in the bank.
Lesson 3: Authorization
The round trip from merchant to issuer, what an approval really means, and how long a hold lasts.
4 minutes · Done
Lesson 4: Payment states
The life of a payment as a state machine: created, authorized, captured, settled, refunded, and disputed.
4 minutes · Done
Lesson 5: Capture
Charging when goods ship: split shipments, partial captures, and reauthorization when a hold expires.
4 minutes · Done
Lesson 6: Clearing and settlement
When money actually moves between banks, and the layers of fees inside every card sale.
7 minutes · Done
Lesson 7: Cash capture
How finance proves every order was paid: matching deposits to orders, and working the exceptions.
4 minutes · Done
Part 3
After the sale
Returns, refunds, and chargebacks.
Part 4
Deep dives
Tokens, labels, codes, and compliance.
Lesson 10: Tokens and stored credentials
FPAN, DPAN, MPAN, network tokens, and PAR, and which card number travels on each hop.
19 minutes · Done
Lesson 11: Transaction types
Channel, initiator, and credential: how to label every card payment, with an interactive classifier.
7 minutes · Done
Lesson 12: Complete reference
Authorization types, validity windows, statuses, codes, declines, disputes, and monitoring, brand by brand.
23 minutes · Done
Lesson 13: Payments compliance
PCI DSS, the self-assessment questionnaires, and the US rules and laws that apply to checkout.
11 minutes · Done
Put it together
Practice and look-ups
Trace one order, spot failures, and look up any term.
Follow one order
A $480 order traced day by day: where the money sits, from the first hold to the refund.
4 minutes · Done
Where it breaks
Six common checkout failures, the symptom you will see in support tickets, and the design fix.
4 minutes · Done
Payments dictionary
Payment terms and abbreviations in plain language, searchable and filterable by topic.
Look up any time · Done
Before lesson 1
Three short primers.
Five minutes here makes every lesson easier: the three moments of a card payment, the US rules that shape them, and the companies involved.
Start with three words
If you remember nothing else, remember this. A card payment happens in three separate moments, and most checkout confusion comes from treating them as one.
The customer's bank agrees the funds are good and places a hold. Nothing has been paid.
The merchant asks to collect some or all of the held amount, usually when the goods ship.
Banks move the funds. The merchant's account is credited, minus fees, a day or more later.
How the US is different
This guide follows US rules. Six of them shape almost every lesson that follows, so start here.
No US law requires it. Merchants use it selectively, on risky orders, to shift fraud liability to the issuer.
Regulation II gives US merchants a choice of at least two unaffiliated debit networks, online too. The debit fee cap itself is back with the Federal Reserve after an October 2026 court ruling.
American Express and Discover often run their own network, issuing, and acquiring, with their own rules, codes, and dispute steps.
Credit card surcharges are allowed in most states within network caps (Visa 3%, Mastercard 4%), banned or limited in some, and never allowed on debit or prepaid cards.
ROSCA sets the federal baseline. State automatic-renewal laws, led by California, add disclosure, reminder, and online-cancellation rules.
Customers get about 120 days to dispute. For Visa disputes in the US, merchants may get as little as 9 days to respond.
Meet the cast
Every card payment passes through the same set of roles. Sometimes one company plays two roles (many payment providers act as gateway, processor, and acquirer at once), but the roles never disappear (with American Express, one company is often network, issuer, and acquirer at once). Tap each one.
Sources for this guide (51)
Card network rules change. Time limits, fees, and authorization windows here reflect published rules and provider documentation as of late 2026; confirm details with your processor before you build against them.
Sources
- Visa authorization and clearing time frame changes, April 2024 (TD Bank summary)
- Checkout.com: Visa authorization processing time frames
- Stripe: Place a hold on a payment method
- Revolut: Clearing windows by card brand
- Moov: Card-not-present best practices
- Adyen: Dispute timeframes
- Cybersource: Stored credential framework (CIT, MIT, standing instructions)
- VGS: DPAN vs MPAN
- Stripe: Apple Pay merchant tokens
- Google Pay: Payment data cryptography (PAN_ONLY and CRYPTOGRAM_3DS)
- Checkout.com: Google Pay authentication methods and liability shift
- Solidgate: Why the Apple Pay card number differs from the card
- Spreedly: Payment Account Reference (PAR)
- Visa: Authorization and reversal processing best practices
- Visa: Authorization framework time frames (2024)
- Visa: Declined transaction resubmission rules
- Visa: Dispute management guidelines for merchants
- Visa: VAMP fact sheet
- Visa: Account Updater FAQ
- Mastercard: Chargeback Guide, Merchant Edition
- Mastercard AN 5524: CIT and MIT indicators (via AIB Merchant Services)
- Mastercard Gateway: Cardholder and merchant initiated payments
- Adyen: Mastercard Transaction Link Identifier
- American Express: US Disputes Reference Guide
- American Express: International Merchant Regulations
- Adyen: Adjust authorisation (validity by brand)
- Apple: Merchant tokens (MPANs)
- Apple: Payment token format reference
- Apple: Merchant Token Notification Services
- Google Pay: Merchant-initiated transactions
- Google Pay: Token lifecycle management
- Stripe: PaymentIntent lifecycle
- Stripe: Refund object
- Stripe: Dispute object
- Stripe: Subscription object
- Stripe: Decline codes
- PCI SSC: Future-dated requirements of PCI DSS v4.x
- Report URI: SAQ A changes in PCI DSS 4.0.1
- SecureTrust: PCI DSS SAQ types
- Chargeback Gurus: Regulation II and card-not-present debit
- Baymard Institute: Cart abandonment rate statistics (updated September 2025)
- Baymard Institute: The current state of checkout UX (2025)
- Baymard Institute: Checkout optimization and average form fields (2024)
- Baymard Institute: Inline form validation
- Baymard Institute: Adaptive validation error messages
- Adobe: 2025 US holiday shopping season
- US Department of Justice: Guidance on web accessibility and the ADA
- W3C: Web Content Accessibility Guidelines (WCAG) 2.2
- Apple: Human Interface Guidelines, accessibility
- Stripe: How to increase checkout conversion
- Stripe: The checkout process, reducing friction
Ready when you are
Start with
the checkout itself.
Lesson 1 shows why shoppers leave a checkout, what to fix in each part of it, and how to tell whether a fix helped.
Questions about payments? Email me. I read every note.