Payments glossary: routing, declines and risk

Short, plain definitions of the terms payment teams use every day, from cascading and soft declines to BIN routing and chargeback ratios. Each entry gives the definition first, a worked example, and where the idea shows up in Omno.

3

3-D Secure: 3-D Secure is the card authentication protocol, maintained by EMVCo as EMV 3-D Secure, that lets the issuer verify the cardholder during an online payment, either silently from shared data or with a challenge such as a one-time passcode or biometrics.
3-D Secure exemption: A 3-D Secure exemption is a request to skip strong customer authentication on a card payment under one of the cases allowed by the PSD2 regulatory technical standards, such as low-value payments or transaction risk analysis, with the issuer making the final decision.

A

Account updater: An account updater is a card scheme service that passes new card numbers and expiry dates from issuers to merchants that store cards, so saved cards and recurring payments keep working after a card is reissued, renewed or closed.
Acquirer: An acquirer, or acquiring bank, is a licensed card scheme member that accepts card transactions on a merchant's behalf, sends them to the issuing bank for authorization and settles the funds to the merchant or its PSP.
Acquirer reference number (ARN): An acquirer reference number (ARN) is a 23-digit number that the acquirer attaches to a card transaction as it passes through the card scheme to the issuer, which banks use to trace a specific payment or refund between them.
Address verification service (AVS): Address verification service (AVS) is a card check in which the issuer compares the billing street address and postal code the customer entered with the address on file and returns a match result, which the merchant or provider can use to approve, review or decline the payment.
Alternative payment method (APM): An alternative payment method (APM) is any way to pay other than an international card scheme credit or debit card, such as e-wallets, bank transfers, instant payment schemes, vouchers, mobile payments and cash-based methods.
AML (anti-money laundering): AML (anti-money laundering) is the set of laws, controls and monitoring that stop criminal money from entering or moving through a business, covering customer due diligence, transaction monitoring, payment method controls and suspicious activity reporting.
Approval rate: Approval rate is the share of payment attempts that are authorized, calculated as approved transactions divided by all transactions submitted for authorization in a period, and is the main measure of how well a payment setup turns customer intent into revenue.
Authorization: Authorization is the issuer's real-time approval or decline of a card payment, in which it checks the card, the available funds and its risk rules and, if it approves, holds the amount on the customer's account until the merchant captures it.
Authorization reversal: Authorization reversal is cancelling a card payment before it settles, so the hold on the customer's funds is released and the charge drops off the statement, unlike a refund, which sends money back as a separate credit after settlement.

B

Bank transfer: A bank transfer is a payment the customer pushes from their own bank account to the merchant's or provider's account, by entering the account details and a reference in online banking or approving a prefilled request, with the order confirmed when the funds arrive.
BIN (bank identification number): BIN (bank identification number) is the first six or eight digits of a card number, which identify the card's issuer, brand, issuing country and type. Routing and risk rules read it before a payment is sent.
BIN routing: BIN routing is sending a card payment to a specific provider based on the card's bank identification number, the first 6 to 8 digits that identify the issuer, card brand, card type and issuing country.
Buy now, pay later (BNPL): Buy now, pay later (BNPL) is a checkout payment method in which a third-party lender pays the merchant for the order and the customer repays the lender in a few instalments, often interest free, after an instant credit decision.

C

Capture: Capture is the step that turns an approved card authorization into an actual charge, telling the issuer to take the held funds so the payment can be cleared and settled to the merchant, either straight away or later and for the full or a smaller amount.
Card scheme: A card scheme is the organisation, such as Visa, Mastercard, American Express, UnionPay or JCB, that sets the rules for card payments under its brand and runs the network that carries authorization, clearing and settlement between issuers and acquirers.
Card verification value (CVV): The card verification value (CVV) is the three- or four-digit security code printed on a payment card, also called CVC or CID, that the customer enters for online payments so the issuer can check that the person paying has the card.
Card-not-present (CNP): A card-not-present (CNP) payment is a card transaction where neither the card nor the cardholder is physically at the point of sale, as in online, in-app, phone and mail orders, so the card cannot be checked with its chip and more of the fraud risk falls on the merchant.
Cascading: Cascading is an automatic fallback that sends a payment to a different payment provider when the first one is unavailable or rejects it, so the customer can still complete the purchase.
Cash on delivery (COD): Cash on delivery (COD) is a way to pay for an online order in which the customer pays the courier, in cash or sometimes by card, when the parcel arrives, and the courier later passes the money on to the merchant or its payment provider.
Cash voucher: A cash voucher is a payment method in which the customer receives a reference number or barcode at checkout and pays it before it expires, in cash at a store, bank or agent, or through online banking, with the merchant notified once the payment is confirmed.
Challenge flow: The challenge flow is the 3-D Secure path in which the issuer asks the cardholder to actively prove who they are, with a one-time passcode, a banking app confirmation or biometrics, before the payment is authenticated.
Chargeback: Chargeback is the reversal of a card payment that the cardholder's issuer initiates after the cardholder disputes it, pulling the funds back from the merchant through the acquirer, usually with a fee, until the dispute is resolved.
Chargeback ratio: Chargeback ratio is the number of chargebacks a merchant receives in a period divided by its number of card transactions, and card schemes use versions of it, such as the Visa VAMP ratio, to place merchants and acquirers in monitoring programs.
Chargeback reason code: A chargeback reason code is the card network code an issuer attaches to a dispute to say why the cardholder contests the payment, such as fraud, goods not received or a cancelled subscription, which sets the evidence and deadlines for the merchant's response.
Checkout conversion rate: Checkout conversion rate is the share of customers who start checkout and finish with a successful payment, combining drop-off before payment, failed authentication and declined payments in one number.
Clearing: Clearing is the stage after authorization and capture in which the acquirer sends the final transaction details through the card scheme to the issuer, and the scheme applies fees and works out what each party owes before funds move in settlement.
Closed-loop payments: Closed-loop payments is the rule that refunds and payouts go back to the payment method or account the customer paid from, in their own name, so money cannot enter through one method and leave through another. It is a core control against fraud and money laundering.
Co-badged card: A co-badged card is a payment card that carries two or more payment brands, typically a domestic scheme and an international one such as Visa or Mastercard, so the same card can be processed on either network depending on which brand is selected.
Credential on file (COF): Credential on file (COF) is a customer's card or payment details stored by a merchant or its provider, with consent, for later payments, which card schemes split into customer-initiated and merchant-initiated transactions with specific rules for each.
Cross-border fee: A cross-border fee is an extra card scheme charge applied when the card's issuing country differs from the country where the payment is acquired, billed to the acquirer and passed on to the merchant on top of interchange and other scheme fees.

D

Data localisation: Data localisation is a legal requirement that certain data, typically personal data or payment transaction data, be stored or processed on systems inside a given country, sometimes with copies allowed abroad and sometimes not.
Decline recovery: Decline recovery is the set of methods that turn declined payments into approved ones, such as cascading to another provider, retrying with 3-D Secure, offering another payment method or retrying later, measured as the share of recoverable declines that end approved.
Device fingerprinting: Device fingerprinting is combining attributes of a customer's device and browser, such as user agent, language, time zone, screen size and IP address, into an identifier that helps recognise the same device across payments and accounts in fraud and authentication checks.
Digital wallet: A digital wallet is an app such as Apple Pay or Google Pay that stores a customer's cards and, for cards held on the device, pays with a device-specific token and a one-time cryptogram instead of the card number, so checkout takes a tap or a fingerprint.
Do not honor (response code 05): Do not honor is the generic issuer decline with response code 05, returned when the issuing bank refuses an authorization without giving a specific reason, often because of its own risk rules, the merchant category or unusual card activity.
Domestic card scheme: A domestic card scheme is a national card brand and network, such as mada in Saudi Arabia, Troy in Turkey, Meeza in Egypt or Humo in Uzbekistan, whose cards are issued by local banks and processed through an in-country switch, often alongside an international brand.
Dunning: Dunning is the process of recovering failed recurring payments, combining scheduled retries with reminders that ask the customer to update their card or pay another way, before a subscription is paused or cancelled.
Dynamic currency conversion (DCC): Dynamic currency conversion (DCC) is a service that offers a cardholder paying in a foreign currency the price in their own card currency at checkout, with the exchange rate and markup set by the merchant's provider instead of the card issuer, if the cardholder chooses it.

E

E-wallet: An e-wallet is an account with a payment provider that holds a stored balance, topped up by card, bank transfer or cash, which the customer uses to pay online by signing in or confirming in the provider's app, so the merchant never sees a card number.
Excessive retry fee: An excessive retry fee is a charge card schemes apply when a merchant keeps resubmitting a declined card payment beyond the scheme's limits, such as retrying a decline the issuer marked as final or exceeding a set number of attempts in 30 days.

F

Failover: Failover is automatically switching a payment to a backup provider when the primary provider is unavailable, times out or returns a technical error, so that a single provider outage does not stop payments.
False decline: A false decline is a legitimate payment from a genuine customer that gets refused, by the issuer, the provider's risk rules or the merchant's own fraud screening, because it looked risky or failed a check that did not reflect real fraud.
First-time deposit (FTD): A first-time deposit (FTD) is a customer's first approved payment into a newly opened account, the moment a registration becomes a paying customer. FTD conversion rate measures how often that happens, and online stores track the same moment as the first purchase.
Fraud screening: Fraud screening is checking each payment against rules, lists and risk models before or during authorization, to approve it, block it, send it to manual review or ask for 3-D Secure, based on how likely it is to be fraudulent.
Frictionless flow: The frictionless flow is the 3-D Secure path in which the issuer authenticates the cardholder from transaction and device data alone, without asking for a code or app confirmation, so the payment is authenticated with no extra step for the customer.
Friendly fraud: Friendly fraud is a chargeback filed by the genuine cardholder for a purchase they made or allowed, claiming fraud or non-receipt, whether by mistake, after forgetting the purchase or a family member's use of the card, or on purpose to get the money back.
FX markup: FX markup is the margin a payment provider, bank or card issuer adds on top of a reference exchange rate when it converts a payment, refund, payout or settlement from one currency to another, usually stated as a percentage above the mid-market or central bank rate.

H

Hard decline: A hard decline is an issuer refusal that will not succeed on retry with the same card details, such as a lost or stolen card, a closed account, an invalid card number or a transaction type the card is not allowed to make.
Hosted checkout: A hosted checkout is a payment page or widget, run by the payment platform rather than the merchant, where customers pay with cards, wallets and local methods. The platform handles card data, method display and provider redirects.

I

IBAN (international bank account number): An IBAN (international bank account number) is a standard format for identifying a bank account across borders, made of a two-letter country code, two check digits and the domestic account number, up to 34 characters, used for transfers, refunds and payouts.
Idempotency key: Idempotency key is a unique value a client sends with a payment or payout request so the server can recognise retries of the same request and return the original result instead of charging or paying out a second time.
Incremental authorization: An incremental authorization is a request to raise the amount of a card authorization that is already approved but not yet captured, used when the final total grows after checkout, such as a longer hotel stay, a car rental or an order with added items.
Instalment payments: Instalment payments are credit card purchases that the customer's issuing bank splits into several monthly charges, offered in markets such as Brazil, Mexico, Japan and Turkey, unlike buy now, pay later, where a separate lender funds the order.
Instant payment: Instant payment is an account-to-account credit transfer that settles in seconds, around the clock, through a national or regional scheme such as PIX in Brazil, SPEI in Mexico or SEPA Instant in the euro area, used for both pay-ins and payouts.
Interchange fee: Interchange fee is the fee the merchant's acquirer pays to the cardholder's issuer on each card payment, set by the card scheme by card type, region and merchant category, and passed on to the merchant as part of its card processing cost.
ISO 20022: ISO 20022 is an international standard for financial messaging that defines common business data and message formats, usually written in XML, used by SEPA schemes, high-value payment systems and cross-border bank payments to carry richer, structured payment data.
ISO 8583 response code: ISO 8583 response code is the two-character code an issuer or network returns in a card authorization response, such as 00 approved, 05 do not honor, 51 insufficient funds or 54 expired card, telling the merchant what happened and what to do next.
Issuer: Issuer, short for issuing bank, is the bank or institution that issued the customer's card or account, holds the customer relationship and decides whether to approve or decline each authorization, and it is the party a chargeback comes from.

K

KYB (know your business): KYB (know your business) is the due diligence a payment provider, acquirer or marketplace runs on a business customer, verifying its registration, directors, beneficial owners and activity before it can take payments or receive payouts.
KYC (know your customer): KYC (know your customer) is the process of identifying a customer, verifying that identity against reliable independent sources and understanding the relationship, which regulated businesses such as banks, payment providers and e-money issuers must complete before and during the relationship.
KYC levels: KYC levels are tiers of customer verification, from basic data checks to full identity and source-of-funds review, that set payment and payout limits. Higher tiers open up more providers, payout methods and larger amounts, according to the customer's assessed risk.

L

Liability shift: Liability shift is the card scheme rule that moves the cost of eligible fraud chargebacks from the merchant to the card issuer when a payment was successfully authenticated with 3-D Secure or, in some cases, a wallet cryptogram.
Local acquiring: Local acquiring is processing card payments through an acquirer in the same country as the card's issuer, so the card scheme treats each payment as domestic, which tends to raise approval rates and avoids cross-border fees.
Local payment method: A local payment method is a payment method used mainly in one country or region, such as Pix in Brazil, SPEI in Mexico, PSE in Colombia, mada in Saudi Arabia or domestic card and bank transfer systems in CIS markets, often preferred over international cards.

M

MCC 7995: MCC 7995 is the merchant category code card schemes use for betting and gambling, covering lottery tickets, casino gaming chips, off-track betting, wagers at race tracks and games of chance to win prizes of monetary value.
Merchant advice code (MAC): Merchant advice code (MAC) is a code Mastercard returns alongside a decline to tell the merchant what to do next, such as 01 update the card details, 02 retry later, 03 do not try again, 21 stop recurring payments, or 24 to 30 retry after a set time.
Merchant category code (MCC): Merchant category code (MCC) is the four-digit code an acquirer assigns to a merchant to classify what it sells, such as 5411 for grocery stores. Issuers, card schemes and providers use it for authorization, pricing and risk rules.
Merchant discount rate (MDR): The merchant discount rate (MDR) is the total percentage, sometimes plus a fixed amount, that a merchant pays its acquirer or PSP on each card payment, covering interchange, card scheme fees and the provider's own margin.
Merchant of record: The merchant of record is the legal entity that sells to the customer and is named on the transaction, taking responsibility for the payment, sales tax or VAT, refunds, chargebacks and compliance with card scheme and consumer rules.
Merchant underwriting: Merchant underwriting is the risk review an acquirer or payment provider carries out before giving a business a merchant account, assessing its business model, owners, processing and chargeback history and finances to decide whether, and on what terms, to accept it.
MID (merchant ID): MID (merchant ID) is the identifier an acquirer or payment provider assigns to a merchant account, used to route the merchant's transactions, apply its category and pricing, settle its funds and measure its chargeback and fraud ratios.
Mobile money: Mobile money is an electronic money account linked to a mobile phone number and run by a mobile network operator or another licensed provider, which customers fill and empty with cash at agents and use to pay, send and receive money from their phone.
Multi-currency pricing: Multi-currency pricing is showing and charging prices in the customer's local currency instead of the merchant's home currency, with the merchant or its provider handling conversion into the settlement currency, so the shopper pays exactly the amount they saw.

N

Network token: A network token is a replacement for a card number issued through the card scheme's token service, such as Visa Token Service or Mastercard MDES, that is bound to one token requestor, updated automatically when the card is reissued and used with a per-transaction cryptogram.

O

Open banking: Open banking is the regulated access that licensed third parties have, with the customer's consent, to a customer's bank account, either to read account information or to initiate a payment directly from the account instead of using a card.

P

Partial authorization: Partial authorization is an issuer approving only part of the requested amount, usually the available balance on a prepaid or debit card, instead of declining, so the merchant can collect the rest with another payment method or cancel the sale.
Payment facilitator (payfac): Payment facilitator (payfac) is a provider that signs merchants as sponsored sub-merchants under its own acquiring relationship and receives settlement on their behalf, so merchants can accept cards without their own direct acquirer contract.
Payment gateway: A payment gateway is the technical service that receives payment details from a merchant's checkout, passes them securely to a processor or acquirer for authorization and returns the result to the merchant.
Payment link: A payment link is a URL that opens a hosted payment page for a set amount or product, which a merchant sends by chat, email, SMS or on an invoice so the customer can pay without going through the merchant's own checkout.
Payment orchestration: Payment orchestration is a software layer that connects a merchant to many payment providers through one integration and decides, for each transaction, which provider processes it, with shared rules for routing, retries, reporting and payouts.
Payment service provider (PSP): A payment service provider (PSP) is a company that lets merchants accept and send payments by bundling a gateway, acquiring or aggregation, payment methods, settlement and often risk tools into one commercial contract.
Payout: Payout is a payment from a merchant to a customer or recipient, such as a refund to a bank account, cashback or a marketplace seller's earnings, sent to a card, bank account, wallet or instant payment account and funded from the merchant's balance.
PCI DSS: PCI DSS (Payment Card Industry Data Security Standard) is the security standard maintained by the PCI Security Standards Council for any organisation that stores, processes or transmits cardholder data, with the way compliance is validated set by card brands and acquirers.
Prepaid card: A prepaid card is a payment card loaded with funds in advance, not linked to a current account or a credit line, so the cardholder can spend only the balance on the card, online or in store, wherever its brand is accepted.
Primary account number (PAN): The primary account number (PAN) is the long number on a payment card, up to 19 digits and usually 16, that identifies the issuer and the cardholder's account, and is the core piece of cardholder data that PCI DSS requires merchants and providers to protect.
PSD2 (revised Payment Services Directive): PSD2 (revised Payment Services Directive) is Directive (EU) 2015/2366, the EU law that sets licensing, conduct and security rules for payment services, including third-party access to payment accounts and strong customer authentication.
PSP eligibility: PSP eligibility is the set of conditions that decide which payment providers are allowed to process a given transaction, such as supported country, currency, method, amount limits, customer verification level and licence scope, before any routing preference is applied.

Q

QR code payment: A QR code payment is a payment started by scanning a QR code with a phone, either a code shown by the merchant that the customer's banking or wallet app reads, or a code in the customer's app that the merchant scans, with the money moving over a bank, wallet or card rail.

R

Reconciliation: Reconciliation is matching every payment, refund, chargeback and fee in a merchant's own records against provider reports and the money that actually reaches the bank, so missing, duplicated or wrongly charged transactions are found and explained.
Recurring payment: A recurring payment is a charge the merchant takes on a schedule, such as a monthly subscription or a series of instalments, using payment details the customer agreed to store, with the first payment made by the customer and later ones started by the merchant.
Refund: A refund returns all or part of a captured payment to the customer as a new credit through the original payment method, after the original charge has gone through, unlike a reversal, which cancels the charge before it settles.
Representment: Representment is the merchant's formal challenge to a chargeback, in which the acquirer resubmits the transaction to the issuer with evidence that the payment was valid, such as proof of delivery, authentication data or the customer's agreement to the terms.
Request to pay: Request to pay is a messaging service in which a merchant sends a payment request to the customer's bank or payment app, and the customer reviews and approves it there, which then starts a bank transfer, often an instant one, for the requested amount.
Retrieval reference number (RRN): A retrieval reference number (RRN) is a 12-character reference carried in field 37 of ISO 8583 card messages, assigned when a payment is authorized and used by acquirers, issuers and processors to find that transaction again later.
Rolling reserve: Rolling reserve is a share of each payment, such as 10%, that a payment provider or acquirer holds back for a fixed window, such as 90 days, and then releases, to cover future chargebacks, refunds and fines from a merchant it sees as risky.

S

Sanctions screening: Sanctions screening is checking customers, business partners and payments against official sanctions lists, such as those published by OFAC, the EU, the UN Security Council and the UK, to stop dealings with designated people, companies and countries.
Scheme fees: Scheme fees are the charges card networks such as Visa and Mastercard levy on acquirers for using their network, including assessment, processing and cross-border fees and charges for excessive retries, which acquirers pass on to merchants.
SEPA Instant Credit Transfer (SCT Inst): SEPA Instant Credit Transfer (SCT Inst) is the European Payments Council's scheme for euro credit transfers that make funds available to the payee within ten seconds, at any hour of any day, between payment service providers across SEPA.
Settlement: Settlement is the transfer of funds from the payment provider or acquirer to the merchant's bank account for approved transactions, after fees, refunds, chargebacks and any reserve are deducted, on a schedule such as T+1 or weekly.
Smart routing: Smart routing is choosing which payment provider processes each transaction based on rules and data, such as card country, BIN, method, currency, amount, customer group and recent approval rates, instead of sending all traffic to one provider.
Soft decline: A soft decline is an issuer or provider refusal that may succeed if the payment is retried later, on a different route or with extra authentication, such as do not honor, insufficient funds or a request for strong customer authentication.
Soft descriptor: Soft descriptor is the merchant name and transaction detail shown on the customer's card or bank statement, often a fixed prefix plus a per-payment suffix, and a clear one helps customers recognise payments and reduces disputes.
Split payment: A split payment is a single customer payment whose amount is divided between several recipients, such as a marketplace and its sellers, either when the payment is processed or afterwards through transfers and payouts.
Strong customer authentication (SCA): Strong customer authentication (SCA) is the PSD2 requirement that electronic payments be authenticated with at least two independent elements from different categories, knowledge, possession and inherence, applied to most online card payments in Europe through 3-D Secure.
Super app: A super app is a single mobile app that combines everyday services such as shopping, payments, transfers, bill payments and credit on one account, so customers handle much of their daily spending in it and often prefer to pay with it online.

T

Token portability: Token portability is the ability to move stored card credentials from one payment provider's vault to another, so saved cards and recurring payments keep working after a merchant changes or adds providers, without customers entering their card details again.
Tokenization: Tokenization is replacing a card number or other sensitive payment credential with a non-sensitive token that can be stored and reused for later payments, while the real data is kept in a secure vault by the token provider.

U

USSD payment: A USSD payment is a payment made through a numbered text menu that the customer opens by dialling a short code on a mobile phone, which runs over the operator's network on any handset, without a smartphone or an internet connection.

V

VAMP (Visa Acquirer Monitoring Program): VAMP (Visa Acquirer Monitoring Program) is Visa's global program that measures fraud, disputes and card-testing levels on card-not-present payments each month and requires acquirers and merchants above its thresholds to take corrective action, with possible fees.
Velocity check: A velocity check is a fraud rule that counts how often something happens in a time window, such as payments per card, cards per customer account or attempts per IP address in an hour, and blocks or reviews activity above a set limit.
Virtual card: A virtual card is a card number, expiry date and security code issued without a plastic card, often for a single use or with spending controls, which consumers use for online shopping and businesses use to pay suppliers.

W

Webhook: Webhook is an HTTP request a payment platform sends to the merchant's server when a transaction changes status, such as approved, declined or paid out, and in payments it is the authoritative record that the merchant's ledger should act on.
Webhook signature: A webhook signature is a cryptographic value, usually an HMAC calculated with a shared secret over the request body and a timestamp, that a payment provider sends with each webhook so the receiving server can confirm the message is genuine and unaltered.