How does Visa work for online payments?
The shopper enters their card number, expiry date and security code, or pays with a saved card or a wallet that holds the card. The merchant’s acquirer sends the authorisation request over the Visa network to the bank that issued the card. The issuer approves or declines, and the answer comes back in seconds. The acquirer later settles the money to the merchant under its own agreement.
Many online payments add an authentication step through 3-D Secure, which Visa runs as Visa Secure. Visa describes it as a secure exchange of data between merchant and issuer before authorisation. Low-risk payments are authenticated in the background with no extra step. If a payment looks risky, the issuer asks the shopper to confirm, usually with a one-time code or a biometric check. Visa reports about 45% less fraud on authenticated e-commerce payments and a 9% lift in approval rates for payments authenticated through Visa Secure.
Saved cards can be replaced with tokens. The Visa Token Service substitutes Visa card numbers with tokens, so a merchant that keeps cards on file for repeat orders or subscriptions does not need to store the real number.
Visa also moves money the other way. Visa Direct sends funds to cards, accounts and wallets, and Visa lists more than 18 billion reachable endpoints in more than 195 countries and territories and more than 150 currencies. Visa lists business-to-consumer and government-to-citizen payments among its uses, so a merchant can pay money out to a shopper’s card.
Where and how do shoppers use Visa?
Almost everywhere. Visa reports about 5 billion payment credentials as of June 2025, more than 175 million merchant locations and about 14,500 financial institutions. It processed 329 billion transactions in the 12 months to September 2025. Shoppers use Visa credit cards, debit cards linked to a bank account, and prepaid cards. Online, they type the card number, use a card saved with the merchant, or pay through a wallet that holds a Visa card.
In some markets a Visa card is co-badged with a domestic scheme. Saudi Arabia’s mada cards are one example. Which network processes the payment then depends on the acquirer’s setup.
What rules and costs should merchants know?
Interchange is capped in the EU. Regulation (EU) 2015/751 limits the interchange fee on consumer debit card payments to 0.2% of the value and on consumer credit card payments to 0.3%. Member states may set lower caps for domestic payments. The UK kept the same caps in its own version of the regulation. For card-not-present payments between the UK and the EEA, the Payment Systems Regulator found that cross-border fees rose after Brexit, concluded that a price cap is the remedy, and is working on the level of that cap.
Surcharging depends on the market. Under EU rules, traders cannot charge consumers extra for paying with a consumer card, in shops or online. In the US, Visa allows a surcharge on credit cards only. The merchant must notify its acquirer at least 30 days before starting, keep the surcharge at or below its merchant discount rate or 3%, whichever is lower, and disclose it at the point of entry, at checkout and on the receipt. Debit and prepaid cards cannot be surcharged, and some states prohibit or limit surcharging.
Strong customer authentication applies in the EEA. For online payments over EUR 30, shoppers need at least two authentication elements from different categories: something they have, something they know or something they are. 3-D Secure is how card payments meet this rule.
Card data has its own standard. PCI DSS applies to any business that stores, processes or transmits cardholder data, and acquirers or card brands decide how a merchant proves compliance. Taking card details on a hosted payment page, or storing tokens instead of card numbers, reduces how much card data the merchant handles itself.
How would Omno handle Visa?
- One checkout: Visa would sit in the hosted checkout next to Mastercard, Apple Pay, Google Pay, local methods and crypto. Merchants with their own checkout would use Card Fields instead.
- Rules the merchant sets: Omno connects to acquirers and payment providers; it is not an acquirer and does not hold funds. Routing rules set by the merchant would choose the provider for each Visa payment, for example by currency, country or amount.
- Cascading: If a provider is unavailable or rejects the request, the payment would move to the next provider in the rule until one accepts.
- Status: The final status would reach the merchant by webhook.
What should merchants plan for?
Plan for 3-D Secure in every market where it applies, and test the challenge flow on mobile. Decide which acquirers should process Visa in each country, including co-badged domestic cards. Keep evidence of delivery and clear refund terms, because cards carry full chargeback rights for shoppers. Check surcharging rules before adding any card fee, and confirm settlement currency and timing with each acquirer.