E-Commerce Transaction

An e-commerce transaction is a sale made online, in which a customer buys from a merchant through a website, mobile app or other internet channel and pays without being physically present. Payment is commonly made by card, but also by digital wallets, bank transfers, pay by bank, buy now pay later services and local payment methods. In card processing, an e-commerce transaction is a type of card-not-present transaction and is flagged with a specific indicator so that issuers and networks can apply the right rules.

E-commerce transactions are distinguished from in-store payments and from mail order/telephone order (MOTO) payments, where card details are given to the merchant by post or phone. They carry higher fraud risk than card-present payments, so they are subject to authentication requirements, different interchange rates and specific liability and dispute rules.

1. The customer enters card details or chooses a stored card or wallet at checkout.
2. The merchant's payment gateway encrypts the data and may run fraud screening.
3. If required, the customer is authenticated through 3-D Secure, often seamlessly and sometimes with a challenge in the banking app.
4. The gateway sends an authorisation request through the acquirer and the card network to the issuer, marked as an e-commerce transaction with its security level.
5. The issuer approves or declines; if approved, funds are held on the card.
6. The merchant captures the payment, immediately or when goods are shipped, and the transaction is cleared and settled.

Transaction indicators

Authorisation messages carry an electronic commerce indicator (ECI) value showing whether and how the cardholder was authenticated. Values differ slightly between networks, but they distinguish fully authenticated transactions, attempted authentication and non-authenticated e-commerce. The indicator affects whether the issuer accepts liability for fraud and can influence approval decisions. Other flags show whether the card was stored by the merchant, whether the payment is a recurring card transaction and whether a network token was used.

Authentication is central to e-commerce security. 3-D Secure 2 allows issuers to assess risk using data about the device, the purchase and the customer, approving most transactions without interruption and challenging only those that look risky. In the European Economic Area and the United Kingdom, strong customer authentication is mandatory for most customer-initiated online payments, subject to exemptions. Card scheme rules generally shift liability for fraud from the merchant to the issuer when a transaction is successfully authenticated, which gives merchants an incentive to use 3-D Secure even where it is not legally required.

Common threats include use of stolen card details, account takeover, card testing, triangulation fraud and friendly fraud. Merchants protect themselves with layered controls: address and security code checks, device fingerprinting, velocity rules, machine learning risk scores, manual review for high-risk orders and payment tokenization to reduce the value of stolen data. Card data must be handled in line with PCI DSS, and many merchants use hosted payment pages or tokenised fields so that card numbers never touch their own servers.

E-commerce card transactions usually attract higher interchange than in-store payments because of their greater fraud risk. Merchants also pay gateway fees, fraud tool costs and the cost of chargebacks, which are more frequent online. Cross-border e-commerce adds network cross-border fees and currency conversion, so international sellers often use local acquiring and offer local payment methods popular in each market. Conversion rates, meaning the share of customers who complete payment, are a key measure, and merchants balance security against friction to avoid losing sales at checkout.

Many e-commerce transactions use card details saved from earlier purchases. The first payment, in which the customer agrees to storage, is normally authenticated, and later payments are flagged as stored credential transactions. Where the merchant replaces the card number with a network token, the issuer keeps the token updated when a card is reissued, which reduces declines from expired cards. These practices improve approval rates and make one-click checkout possible, but they require clear customer consent and careful handling of the stored data.

Customers buying online often have rights to cancel, return goods and get refunds under consumer law, as well as chargeback rights through card schemes when goods do not arrive or are not as described. In the EU, distance-selling rules give consumers a cooling-off period for most online purchases. Disputes are more common in e-commerce than in face-to-face sales, so clear descriptions, delivery tracking and responsive customer service play an important part in managing them.