In a transaction, a buyer makes a payment to a seller in exchange for goods or services. As a starting point, let’s assume the payment is made in cash.
Cash keeps things simple. However, this requires the buyer carry cash around, and more crucially, the buyer may not yet have the amount in full. Credit cards address this issue, offering convenience through portability and access to credit.
Credit card transactions involve additional parties. There’s the credit card issuer, often referred to as the issuing bank. The funds must now be transferred to the seller's bank, referred to as the acquiring bank. Finally, an intermediary is needed to connect the two banks. For simplicity, assume a single entity, the payment processor, serves as the intermediary.
More parties means more fees. A transaction fee of ~3% is deducted from the payment, leaving the seller with 97 cents for every dollar. The majority of this fee (roughly two-thirds) goes to the issuing bank.
This convenience also introduces the risk of potential fraud. A fraudster using stolen credit cards might 'cash out' by impersonating a seller and processing fraudulent payments as a legitimate sale; this is known as seller fraud. The fraudster might masquerade as a buyer and acquire goods or services from a legitimate seller, known as buyer fraud. Another possibility involves compromising the seller's account and transferring funds to the fraudster's bank account instead, known as account takeover.
The payment processor may also bear responsibility for a well-intentioned seller's poorly-managed business. Imagine the seller selling concert tickets but unable to organize the concert. The buyers may be able to reverse the transaction but the seller may be out of funds. In this situation, the payment processor 'fronts' the payments to the seller, assuming the credit risk.
A buyer's request to reverse a transaction is known as a chargeback. It’s actually more akin to a ‘mini court case’ to determine which party should be on the hook for the loss. The issuing bank will ask the buyer for more details, then the acquiring bank will ask the seller for more details, and finally a determination will be made (who decides often depends on the type of dispute).
Consider another hypothetical scenario of starting a payment processing startup. Initially everything proceeds smoothly, but you soon notice fraudsters processing transactions with stolen credit cards. You hire someone to lead the operations team, going through every payment to make sure they’re legitimate. Over time, your payment volume increases. To manage the load, you hire a software engineer to create a case queue for flagging payments above $1,000 from IP addresses outside the US.