Difficulty: Medium
Correct Answer: Customer enters payment details on a secure page, the payment gateway encrypts and forwards the data to the acquiring bank, the card network and issuing bank authorise or decline the transaction, and the merchant receives an approval response followed later by settlement
Explanation:
Introduction / Context:
Online electronic payments are at the heart of e commerce. When a customer pays with a credit card, debit card, or digital wallet on a website, several parties cooperate behind the scenes. Understanding the basic flow of data and authorisation helps developers design secure checkout processes and answer conceptual questions in interviews. This question asks which step by step description most accurately reflects a standard electronic payment procedure.
Given Data / Assumptions:
Concept / Approach:
In a typical card payment, the customer enters card number, expiry date, and security code on a secure HTTPS page or in a hosted payment form. The payment gateway encrypts these details and sends a transaction request to the acquiring bank. The acquirer routes the request through the card network Visa, Mastercard, etc. to the issuing bank, which verifies available funds, fraud risk, and other checks. The issuing bank sends back an approval or decline code through the network and acquirer to the payment gateway, which then notifies the merchant site in real time. Later, in the settlement step, approved transactions are batched and actual funds are transferred to the merchant account.
Step-by-Step Solution:
Step 1: The customer confirms the order and is presented with a secure payment page with HTTPS and often additional verification like 3D Secure.
Step 2: The customer enters payment details or authorises a digital wallet, which sends a token or encrypted data.
Step 3: The payment gateway receives these details over an encrypted channel and forwards a transaction request to the acquiring bank.
Step 4: The acquiring bank passes the request to the relevant card network, which contacts the issuing bank for authorisation.
Step 5: The issuing bank approves or declines the transaction and the response travels back through the network, acquirer, and gateway to the merchant, who displays success or failure to the customer.
Verification / Alternative check:
Industry diagrams and documentation from payment providers all show this multi step pathway: browser or app, gateway, acquirer, network, issuer, and then back. None of them recommend sending card data by email or manual re entry, because such practices violate security standards like PCI DSS. This confirmation supports the sequence described in option a as the correct one.
Why Other Options Are Wrong:
Option b describes sending card details via plain email, which is highly insecure and not a standard or acceptable procedure. Option c and option d are unrealistic and ignore mandatory roles of payment gateways, acquirers, and card networks. They also misunderstand the role of the central bank, which is not involved in individual e commerce transaction settlement in that direct way.
Common Pitfalls:
Many people underestimate the importance of gateways and acquiring banks, assuming that money flows directly from the cardholder to the merchant. Another pitfall is ignoring the distinction between authorisation immediate approval or decline and settlement later fund transfer. Developers should build applications that respect these stages and never store raw card data insecurely.
Final Answer:
The typical electronic payment flow is that the customer enters payment details on a secure page, the payment gateway encrypts and forwards data to the acquiring bank, the card network and issuing bank authorise or decline, and the merchant receives an approval response followed later by settlement.
Discussion & Comments