E-commerce transaction is a purchase of goods or services agreed and paid for over the internet, through a website or app, with the payment instrument never physically presented to the merchant. In payments terms it is a card-not-present transaction, flagged in the authorization message so issuers can price the higher fraud risk. Behind it sit the merchant, its acquirer or PSP, the card network and the issuer: card details are tokenised, a 3-D Secure 2 check applies strong customer authentication under PSD2 unless an exemption is claimed, the issuer places a hold and the merchant captures on shipment. Payment plugins for Shopify or WooCommerce handle most small-merchant integrations. Fraud and chargeback rates run higher than at a terminal.
How do ecommerce payments work
Four parties sit behind even a simple online sale: the merchant, its acquirer (often reached through a PSP), the card network and the cardholder's issuer. The merchant never talks to the issuer directly; every message passes through the chain. Wallets, bank transfers and buy now pay later follow different paths, but cards still carry the largest share of online spend in most markets.
Ecommerce payment transaction process step by step
Take a €80 order from a German shop paid with a Spanish Visa card:
- The customer enters card details on the checkout page or in a hosted field, and the gateway tokenises them.
- The PSP runs a 3-D Secure 2 check. Under PSD2, strong customer authentication applies unless an exemption such as low value or transaction risk analysis is claimed.
- An authorization request goes via the acquirer and Visa to the issuer, which approves and places an €80 hold.
- When the parcel ships, the merchant captures the payment, a sequence explained under authorization and capture.
- Clearing and settlement follow, and a day or two later the merchant receives €80 minus interchange, scheme fees and the PSP margin.
The authorization message also carries an Electronic Commerce Indicator. For Visa, ECI 05 means the cardholder was fully authenticated, 06 means authentication was attempted and 07 means none took place. With 05 or 06, fraud chargeback liability generally shifts to the issuer; with 07 it stays with the merchant.
Ecommerce payment plugin explained
Most small merchants never integrate with a PSP's API directly. A payment plugin for Shopify, WooCommerce, Magento or PrestaShop adds the payment options to checkout, handles redirects for 3DS and wallets, and writes the order status back when a webhook confirms payment. Plugin quality matters: an outdated plugin that loads card fields into the merchant's own page can move the site into a heavier PCI DSS questionnaire.
E-commerce transaction risks
Fraud rates and chargebacks are higher online than at a terminal because the card is not verified physically. Refunds, partial captures and subscription retries add reconciliation work. For a buyer reviewing an online PSP, the mix of authenticated versus unauthenticated volume and the chargeback ratio by merchant category are among the first figures requested.