A card payment is a cashless transaction in which a customer pays for goods or services using a debit, credit, or prepaid card instead of cash or bank transfer. Behind the scenes, the transaction moves through an authorization request from the merchant's acquirer to the card network and then to the issuing bank, followed by clearing and settlement between the banks. In India, this entire authorization flow typically completes within a couple of seconds.

To make a card payment online, select the card option at checkout, enter the card number, expiry date and CVV, and then complete the additional factor of authentication, usually an OTP sent to your registered mobile number. In India, two-factor authentication is mandatory for online card transactions under RBI rules, and saved cards are stored as tokens instead of actual card details for security. Once the OTP is verified, the transaction is authorized and the amount is debited from the card account.

Small merchants can accept card payments on phone using a SoftPOS or Tap-to-Phone application that turns an NFC-enabled smartphone into a contactless acceptance terminal, or by pairing a lightweight mPOS card reader with a merchant app. The merchant first needs to be onboarded by an acquiring bank or payment facilitator, after which contactless debit and credit cards can be accepted directly on the device. This is a low-cost alternative to a traditional POS machine for small businesses in India.

Card payments in India run over domestic and international networks such as RuPay, Visa and Mastercard, with every transaction passing through authorization, clearing and settlement between the merchant's bank and the cardholder's bank. When a card is tapped, swiped or used online, the acquiring switch routes an authorization request through the card network to the issuing bank, which approves or declines it in real time. Settlement of funds to the merchant's account typically follows on a T+1 or similar cycle.

Card payments usually go down when one link in the transaction chain fails, such as a card network outage, downtime at the issuing bank's authorization host, or connectivity issues at the acquiring switch or POS terminal. Scheduled maintenance windows at banks and networks can also cause temporary declines even when the card and account are perfectly valid. In most cases the transaction goes through once the affected system is restored, so retrying after some time usually works.

ISO 8583 is the international standard message format used to carry card transaction data between the POS or ATM, the acquiring switch, the card network and the issuing bank. It defines fields such as the primary account number, processing code, amount and response code, along with message types for authorization, reversal, and clearing. Almost every card transaction in India and globally is processed using ISO 8583 messaging, which makes it a core skill for payments professionals.

HSM stands for Hardware Security Module, a tamper-resistant hardware device that securely stores cryptographic keys and performs encryption within the card payment flow. It is used to validate and translate PIN blocks, generate and verify card security values, and protect sensitive data during ATM, POS and online transaction processing. Banks and processors in India deploy HSMs to meet RBI security requirements, and no card issuing or acquiring setup is complete without them.

A card issuing bank is the financial institution that provides the debit, credit or prepaid card to the customer and manages the underlying card and account. It is responsible for authorizing or declining transactions, setting limits, handling disputes and chargebacks, and billing the cardholder. It sits on the opposite side of the transaction from the acquiring bank, which onboards merchants — the issuer represents the cardholder while the acquirer represents the merchant.

To issue cards, a bank or fintech first needs a scheme partnership or BIN sponsorship from a network such as Visa, Mastercard or RuPay, along with regulatory approvals such as RBI authorization for prepaid instruments in India. The next step is setting up a card and account management system, a transaction switch for authorization, and clearing and settlement connectivity, either built in-house or taken from a card issuing platform. Once BIN allocation, key management and card personalization are in place, physical or virtual cards can be issued to customers.

The card issuing country is the country where the bank that issued the card is based, and it can be identified from the Bank Identification Number (BIN) at the start of the card number. It matters because domestic and cross-border transactions are processed differently, currency conversion and additional fees can apply outside the issuing country, and some decline rules and fraud checks are country-specific. A card issued in India, for example, is treated as a domestic card on Indian networks and as an international card everywhere else.

A card issuing platform is an end-to-end technology stack that lets banks, fintechs and consumer brands launch and manage debit, credit or prepaid cards without building the entire issuing infrastructure themselves. It typically covers card and account management, authorization processing, limits and spend controls, tokenization, and connectivity to card networks. In India, fintechs commonly use such platforms along with a partner bank to go live with cards faster and at a lower setup cost.

A card issuing API allows a fintech or product team to create and manage cards programmatically, with endpoints for card creation, activation, freezing, setting spend limits and fetching transaction history. The API layer sits on top of the issuing bank's card management system and the card network connection, so every action remains compliant and properly authorized. This is how most neobanks and expense management products offer instant virtual cards to their users.

Card issuing jobs span roles such as card product manager, payments business analyst, authorization and dispute operations specialist, card systems developer, and issuing solutions architect. These roles involve working with card management systems, ISO 8583 transaction processing, and network certifications for Visa, Mastercard and RuPay, along with regulatory compliance. Professionals who understand the full issuing lifecycle, from BIN setup to clearing and settlement, are in steady demand across banks and fintechs in India.

The ISO full form is the International Organization for Standardization, the global body that publishes standards used across industries. In card payments, the most widely used ISO standard is ISO 8583, which defines the message format for authorization and clearing of card transactions, while the industry is also gradually moving toward the ISO 20022 messaging standard. Understanding these standards is essential for anyone working on card switches, payment gateways or transaction processing systems.