What is a Payment Processor?

What a Payment Processor Does

A payment processor is the technology company that handles the mechanics of moving a card transaction from the merchant to the card-issuing bank and back again. When a customer taps their card at a terminal, types their details into a website, or enters their card number on a phone keypad, the payment processor is the engine that makes everything happen behind the scenes.

The processor takes the raw transaction data, encrypts it, routes it through the appropriate card network (Visa, Mastercard, etc.) to the issuing bank for authorisation, and returns the approval or decline to the merchant -- all within a few seconds. After authorisation, the processor also handles clearing (exchanging transaction details between banks) and settlement (moving the actual funds into the merchant's account).

How Payment Processing Works

To understand what a payment processor does, it helps to follow a transaction from start to finish.

• Capture: The merchant's payment system (terminal, website, virtual terminal, or phone payment platform) captures the customer's card details and sends them to the payment processor.
• Encryption: The processor encrypts the data to protect it during transmission across networks.
• Routing: The processor identifies the card brand and issuing bank from the card number (using the BIN) and routes the authorisation request through the correct card network.
• Authorisation: The issuing bank receives the request, checks the card is valid, verifies sufficient funds are available, runs fraud checks, and sends back an authorisation code (approved) or a decline code (rejected).
• Response: The processor relays the response back to the merchant's system, which tells the customer whether their payment was successful.
• Clearing: At the end of the business day (or at regular intervals), the processor compiles all authorised transactions into batch files and sends them to the card networks for clearing -- the formal exchange of transaction information between the acquiring and issuing banks.
• Settlement: The issuing bank transfers funds to the card network, which passes them to the acquiring bank, which deposits them (minus fees) into the merchant's account. This typically takes one to three business days.

Types of Payment Processors

Payment processors come in several flavours, and the distinction matters for businesses choosing their payment infrastructure.

Front-End Processors

Front-end processors handle the authorisation side of the transaction -- capturing, routing, and returning the real-time approval or decline. They focus on speed and reliability because even a second of delay at the point of sale can frustrate customers and lose sales.

Back-End Processors

Back-end processors handle what happens after authorisation: clearing, settlement, and the movement of funds between banks. These processors work in batch mode, processing large volumes of transactions at regular intervals throughout the day.

Full-Service Processors

Many modern processors handle both front-end and back-end processing, offering merchants a single relationship for the entire transaction lifecycle. Companies like Worldpay, Stripe, and Adyen operate as full-service processors.

Payment Processors and PCI DSS

Payment processors handle cardholder data at massive scale, which makes them prime targets for cyberattacks. As a result, payment processors must maintain PCI DSS compliance -- typically at Level 1, the most stringent level. They undergo annual on-site audits by Qualified Security Assessors and must demonstrate robust security controls across their entire infrastructure.

For merchants, using a PCI DSS compliant payment processor is not optional. The card brands require it. When evaluating processors, merchants should verify the processor's current PCI DSS certification and ask for their Attestation of Compliance (AoC).

Payment Processors and Telephone Payments

Telephone payments add complexity to the processor's job. Unlike an online transaction where data flows through a structured checkout form, telephone payments can arrive in different ways -- an agent typing details into a virtual terminal, a customer entering digits via DTMF tones, or an automated IVR system collecting card data without any human involvement.

The payment processor needs to accept transactions from all of these sources and process them identically. From the processor's perspective, the transaction data looks the same regardless of how it was captured -- it is a card number, expiry date, CVV, and amount. But the way the data is captured has enormous implications for the merchant's security and compliance.

When DTMF masking technology is used, the card data is captured from the caller's keypad input and sent directly to the payment processor via a secure, PCI DSS Level 1 certified channel. The data never passes through the merchant's systems, which means the merchant's environment does not need to meet the same processing requirements as if they were handling card data directly. This is one of the clearest examples of how the right technology can shift the compliance burden from the merchant to a certified specialist.

Choosing a Payment Processor

Selecting the right payment processor is a critical business decision. Here are the key factors to consider.

• Supported payment channels: Does the processor handle all the channels you need -- online, in-store, telephone (MOTO), mobile, and pay-by-link?
• Pricing structure: Processors charge in different ways -- flat fees per transaction, percentage-based fees, tiered pricing, or interchange-plus pricing. Understand the total cost, not just the headline rate.
• Reliability and uptime: Payment processing must be available around the clock. Ask about uptime guarantees and what happens during outages.
• Integration: The processor's API or integration approach should work with your existing payment gateway, virtual terminal, or point-of-sale system without requiring a complete rebuild.
• Settlement speed: How quickly does the processor settle funds to your account? Next-day settlement is increasingly common, but some processors still take two or three days.
• Reporting and analytics: Good reporting helps you understand your payment flows, identify trends, spot anomalies, and reconcile transactions efficiently.
• Security certifications: Verify the processor's PCI DSS Level 1 certification and ask about their broader security posture, including their approach to fraud prevention and data protection.

The Bigger Picture

Payment processors are the invisible infrastructure of modern commerce. Every time someone taps a card, clicks "pay now", or enters their details over the phone, a payment processor is working behind the scenes to make it happen. They process billions of transactions every year, moving trillions of pounds globally, and they do it so reliably that most people never think about them.

For businesses, choosing the right processor and ensuring it is properly integrated with your payment channels -- including telephone payments -- is fundamental to getting paid efficiently, securely, and in compliance with industry standards.