By Vision Card ServicesPublished Updated 9 min read
The tap feels like the payment. It is closer to the first two seconds of a conversation that carries on for several days, between four parties, most of whom you never see.
Authorisation is not payment. Knowing the difference explains almost every confusing thing a card account does — pending amounts that are wrong, refunds that take days, and holds that vanish on their own.
The four parties
Every card payment involves at least four: you, the merchant, the merchant's bank — the acquirer — and the bank that issued your card. A card scheme sits in the middle as the network they all speak across. Nothing about the transaction makes sense until you can see those four, because each confusing thing a card account does is one of them doing its job.
The merchant wants to know it will be paid. The acquirer wants to know the merchant is genuine. The issuer wants to know you are you, and that the money exists. The scheme's job is to carry those questions and answers in a form all of them understand, in under a second.
What actually leaves the card
The card does not hand over a static number. A chip — including the one a contactless tap uses — generates a cryptogram unique to that transaction, so intercepting it is close to useless: it will not authorise a second one. That mechanism is the reason counterfeiting a chip card is hard in a way that copying a magnetic stripe never was.Sources for this passage: EMVCo, the body behind chip and contactless specifications
A device wallet goes further and substitutes a token for the card number entirely, so the merchant never receives the real one. This is why paying with a phone is generally safer than paying with the card itself: a merchant breach that exposes stored card data does not expose yours.
Contactless adds one more control that people rarely notice — a per-transaction ceiling and a cumulative one. Tap enough times without a PIN and the terminal will insist on one. That is not a fault; it is the limit doing exactly what it exists for.
Authorisation: the two seconds
The terminal sends the transaction to the acquirer, which routes it through the scheme to your issuer. The issuer checks that the card is valid, that the cryptogram is right, that funds or credit are available, and — this is where fraud detection lives — that the transaction is consistent with how the account normally behaves.
That last check is a score, not a rule, and it is why an unusual but perfectly legitimate purchase is sometimes declined. Place, amount, merchant type and the sequence of recent transactions are all part of it. A first purchase in a new country at an unusual hour is exactly the shape of a compromised card.
The answer comes back and the terminal prints. What has happened at this point is a promise, not a movement of money: the issuer has agreed to pay and has reduced your available balance by that amount. Nothing has actually been transferred.
- Card validity and cryptogram checked
- Funds or credit available
- Behaviour scored against the account's normal pattern
- Answer returned in well under a second
Why the pending amount is sometimes wrong
Some merchants cannot know the final figure at the moment of authorisation. A hotel authorises an estimate covering the stay; a car hire firm adds a deposit; a fuel pump authorises a fixed amount before you have finished filling. This is a pre-authorisation, and it holds against your available balance until it settles at the real figure or expires.
This single mechanism explains most of the transactions people believe are errors. The hold at a hotel is not a charge. The pump that shows more than you spent will settle at what you spent. The frustrating part is the delay before the hold falls away, which is set by the merchant and the scheme rules rather than by your bank.
It also explains why your available balance and your statement balance disagree. One counts promises; the other counts completed transactions.
Clearing and settlement: the days nobody sees
At the end of the merchant's day, the authorised transactions are submitted for clearing. The scheme reconciles them between acquirer and issuer, interchange is calculated, and the money moves. Only now has a payment actually occurred, and it is typically one to three days after you tapped.
This is why a refund is not instant. A refund is a new transaction travelling the same road in the opposite direction, and it has to clear like any other. When somebody says the merchant has refunded but the money is not there, both statements are usually true at the same time.
It is also why the transaction description on your statement is often not the shop's name. What appears is the descriptor the merchant registered with its acquirer, which may be a parent company, a payment processor or a trading name from a decade ago. That mismatch is the single most common reason people believe they have been defrauded when they have not.
Where the protections sit
Different protections attach at different points. The cryptogram protects the card at the terminal. Encryption and the storage rules merchants must follow protect the data at rest and in transit, which is what the card industry's security standards are for.Sources for this passage: PCI Security Standards Council
Fraud scoring protects the authorisation decision. Scheme dispute rights — chargebacks — protect you after settlement, when goods do not arrive or a transaction was not yours. Each covers a different failure, which is why no single one is sufficient and why the phrase "my card is protected" is always worth a follow-up question.
Consumer protection obligations on card issuers in the United Arab Emirates sit alongside all of that, and are published by the regulator rather than by any individual provider — worth reading once so you know what you are entitled to before you need it.Sources for this passage: Central Bank of the UAE
What to do with this
Three practical consequences. First, check the merchant descriptor and the recurring list before concluding a transaction is fraudulent — most are not. Second, expect holds at hotels, car hire and fuel, and do not treat them as charges. Third, if something really is wrong, freeze the card first and gather the exact date, amount and descriptor; that is what makes a dispute quick rather than an argument.
And if you are choosing a card rather than querying one, the mechanics above matter less than where your money actually goes each month. That is a different question, and it is the one the card programme page is about.