How does Mastercard work for online payments?
The shopper enters their card number, expiry date and security code, or pays with a saved card or a wallet that holds the card. The acquirer sends the authorisation request over the Mastercard network to the issuing bank, which approves or declines within seconds. The acquirer then settles the money to the merchant under its own agreement.
Online payments are often authenticated through Mastercard Identity Check, Mastercard’s programme built on EMV 3-D Secure. Most shoppers get a frictionless experience in the background. Some get a challenge, in which they give extra input such as a one-time passcode.
Saved cards can be tokenised. Mastercard’s card-on-file tokenisation replaces card numbers with tokens, and issuers send lifecycle notifications that help keep stored card details current. This suits repeat orders and subscriptions, where the merchant keeps a card on file.
Money can also flow back to cardholders. Mastercard Move is the network’s set of money movement products for personal payments, business payments and disbursements. Mastercard lists reach in 180 countries, nearly 10 billion endpoints and more than 150 currencies. Within it, Mastercard Send lets businesses pay out to card accounts, domestically and across borders, with funds typically arriving within seconds. Depending on the region, it can reach Mastercard and Maestro debit cards and some non-Mastercard cards, such as Visa debit.
Where and how do shoppers use Mastercard?
Mastercard is accepted at online checkouts worldwide. By the end of 2025 its customers had issued 3.7 billion Mastercard and Maestro-branded cards. In 2025 gross dollar volume grew 9% on a local currency basis to USD 10.6 trillion, cross-border volume grew 15% and switched transactions grew 10%.
Shoppers hold Mastercard credit cards, debit cards linked to a bank account, and prepaid cards. Online, they type the card number, use a card saved with the merchant, or pay with a wallet that holds the card. Debit is the larger share: at the end of 2025 Mastercard counted about 2.2 billion cards on its debit programmes and about 1.2 billion on its credit and charge programmes.
What rules and costs should merchants know?
Interchange is capped in the EU. Regulation (EU) 2015/751 limits interchange on consumer debit card payments to 0.2% of the value and on consumer credit card payments to 0.3%, and member states may set lower domestic caps. The UK kept the same caps for its own payments. For card-not-present payments between the UK and the EEA, the Payment Systems Regulator found that cross-border fees rose after Brexit, concluded that a price cap is the remedy, and is still working on the level of that cap. In January 2026 the High Court rejected a challenge by Visa, Mastercard and Revolut and confirmed that the regulator has the power to set it.
Surcharging is restricted. Under EU rules, traders cannot charge consumers extra for paying with a consumer card, in shops or online. Outside the EU, surcharging is governed by scheme rules and local law, so a merchant should check both with its acquirer before adding a card fee.
Strong customer authentication applies in the EEA. Online payments over EUR 30 need at least two authentication elements from different categories: something the shopper has, knows or is. Identity Check is how Mastercard payments meet this rule.
Card data must be protected. PCI DSS applies to any business that stores, processes or transmits cardholder data, and acquirers or card brands decide how a merchant proves compliance. Taking card details on a hosted payment page, or storing tokens instead of card numbers, reduces how much card data the merchant handles itself.
How would Omno handle Mastercard?
- One checkout: Mastercard would sit in the hosted checkout next to Visa, Apple Pay, Google Pay, local methods and crypto. Merchants with their own checkout would use Card Fields instead.
- Rules the merchant sets: Omno connects to acquirers and payment providers; it is not an acquirer and does not hold funds. Routing rules set by the merchant would choose the provider for each Mastercard payment, for example by currency, country or amount.
- Cascading: If a provider is unavailable or rejects the request, the payment would move to the next provider in the rule until one accepts.
- Status: The final status would reach the merchant by webhook.
What should merchants plan for?
Build Identity Check into every market where strong customer authentication applies, and test the challenge on mobile. Choose acquirers per country, including how co-badged domestic cards are processed. Keep tokens current by acting on issuer lifecycle updates. Keep delivery evidence and clear refund terms, because cards give shoppers full chargeback rights. Check surcharging rules before adding any card fee, and confirm settlement currency and timing with each acquirer.