Customer Initiated Transaction (CIT)

A customer initiated transaction (CIT), also called a cardholder initiated transaction, is a card payment that the cardholder actively starts and takes part in. Typing card details into a checkout page, picking a saved card in an app, paying by phone with a digital wallet and tapping a card at a till are all CITs. Because the cardholder is present, the payment can be authenticated, for example with a one-time code or a fingerprint.

The term matters most for card-on-file transactions, where the networks' stored credential rules split payments with saved cards into CITs and merchant initiated transactions (MITs). A CIT is the one in which the cardholder acts; an MIT is the one in which the merchant charges while the cardholder is absent. Every series of MITs begins with a CIT, in which the cardholder agrees to future charges.

Picture a bookshop where you keep an account. When you walk in, pick a book and say "put it on my card", you are starting the payment yourself, even though the shop already has your card details. The shop can glance at your face, ask you to sign, or ask a security question. That is a customer initiated payment.

If, instead, the shop posts you a new book every month and charges your card without you saying anything, the shop has started the payment. The difference is simply who is in the room and making the decision at that moment. When the customer is there, the bank can ask them to prove who they are. When they are not, the bank has to rely on what the customer agreed to before.

• First-time payments. The cardholder enters card details for a one-off purchase and does not save them. This is an ordinary card-not-present or card-present sale with no stored credential involved.
• Initial stored credential CIT. The cardholder pays, or verifies the card for a zero amount, and agrees that the merchant may store the card. The message is flagged as the first use of a stored credential, and its approval returns the network transaction identifier that later MITs will quote.
• Subsequent CIT with a stored credential. The cardholder chooses a saved card, as in one-click checkout or a ride-hailing booking. It is flagged as using a stored credential, but because the cardholder acted, it is still a CIT, not an MIT.

Since the cardholder is present, a CIT can be authenticated, and in some places must be. In the European Economic Area and the UK, strong customer authentication under PSD2 and the UK's equivalent rules applies to CITs unless an exemption such as low value, a trusted beneficiary or transaction risk analysis is used. Online, the usual tool is 3-D Secure; in stores, a cardholder verification method such as a PIN or a phone biometric does the same job. Some platforms use delegated authentication, where a wallet or merchant authenticates on the issuer's behalf under an agreed scheme.

Successful authentication generally shifts fraud liability from the merchant to the issuing bank for fraud-related chargebacks. This is why the initial CIT that sets up a subscription or saved card is so important: if it is authenticated, the issuer has a strong record that the real cardholder agreed, and the later MITs inherit that standing in practice, though liability on each MIT is still governed by the network's rules.

Merchants must not present CITs as MITs or the reverse. Labelling a saved-card checkout as an MIT to avoid authentication breaks network rules and, in Europe, the authentication requirements. Labelling a true MIT as a CIT confuses the issuer, which may expect authentication that cannot happen and decline the charge with a soft decline asking for it. The networks monitor flag accuracy and can charge fees to acquirers whose merchants get it wrong. Accurate flags also help approval rates, because issuers' fraud detection models score a known returning customer differently from a new one. In practice, the flag is set by the merchant's checkout or payment gateway software, so most errors come from integration choices rather than from deliberate misuse, and acquirers often review flag data when approval rates fall.

• Visa
• European Banking Authority