What a credit card merchant is and why the term matters
A merchant is any business — online or in person — that takes credit cards as payment. The term includes a coffee shop, an e-commerce store, a plumber, a dentist, or a subscription service. When you swipe, tap, or enter your card number, you are paying a merchant.
Understanding merchant basics helps you know who handles your card information, why fees exist on your bill, and what happens when a transaction goes wrong. It also explains why some places accept certain cards and others do not, and why a business might ask for a card number over the phone or email instead of processing it securely online.
The merchant is not the bank that issued your card — that is your card issuer. The merchant is the person or company selling you the thing you are buying.
Key Takeaways
- A merchant is any business that accepts your credit card as payment, whether in a store, online, or over the phone.
- Merchants pay processing fees to accept cards, which is why some small businesses offer discounts for cash or have minimum purchase amounts for card use.
- Merchants use a payment processor — a separate company — to handle the technical side of taking your card information securely and sending it to your bank.
- Your card issuer (your bank) and the merchant's bank are different entities, and disputes between you and a merchant go through your card issuer, not the merchant's bank.
- Merchants must follow security rules called PCI compliance to protect your card data, and violations can result in fines or loss of the ability to accept cards.
How a merchant processes your card payment
When you hand over your card or enter the number, the merchant does not send it directly to your bank. Instead, the merchant uses a payment processor — a company hired to handle card transactions securely. The processor encrypts your card information, checks that the card is valid, and routes the request to your card issuer (your bank) to approve or decline the charge.
Your bank checks your available credit or account balance, confirms the card has not been reported stolen, and sends back an approval or denial. If approved, the processor tells the merchant the transaction went through. The merchant's bank then receives the funds — usually within one to three business days — minus the processing fee the merchant pays.
This entire chain exists because no merchant should ever see your full card number in plain text, and no merchant should handle the approval decision alone. The processor and your bank are the gatekeepers.
Why merchants pay fees and pass costs along
Every time a merchant accepts a credit card, they pay a fee. This fee typically ranges from 1.5% to 3.5% of the transaction amount, though the exact rate depends on the card type (debit cards cost less than rewards credit cards), the merchant's industry, their sales volume, and their payment processor's contract.
A merchant processing $1,000 in credit card sales might pay $20 to $35 in fees that day. Over a year, these fees add up. That is why some small businesses offer a discount for cash, set a minimum purchase amount for card use, or add a small surcharge for credit cards (though surcharge rules vary by state and card network).
Large retailers absorb these fees as a cost of doing business. Small merchants — a local plumber, a freelance photographer, a food truck — often feel the impact more sharply and may choose to accept only certain card types or push customers toward cash or bank transfers.
Merchant categories and how they affect your card
Card networks and banks sort merchants into merchant category codes (MCCs). Your card issuer uses these codes to determine which purchases earn rewards, which are blocked, and which trigger fraud alerts. A grocery store has a different code than a gas station, which has a different code than a casino or a wire transfer service.
If your card offers 3% cash back on groceries, the merchant must be coded as a grocery store for you to earn that rate. If a merchant is miscoded — for example, a grocery store coded as a general retailer — you will not earn the bonus even though you are buying groceries there. Recoding a merchant takes time and usually requires the merchant to request it from their processor.
Some card issuers also block entire merchant categories. A bank might decline all transactions at casinos, adult entertainment venues, or money transfer services, regardless of the cardholder's credit limit or account standing. This is a merchant-level block, not a personal one.
What happens when you dispute a charge with a merchant
If you see a charge you did not authorize or a merchant fails to deliver what you paid for, you do not contact the merchant's bank. You contact your card issuer — the bank that sent you the card. Your issuer then investigates the dispute with the merchant's bank and the processor.
This process is called a chargeback. Your card issuer temporarily credits your account while they gather evidence. The merchant has a window (usually 7 to 10 days) to respond with proof that you authorized the charge and received the goods or service. If the merchant cannot prove it, your card issuer keeps the credit and the merchant loses the money.
Merchants take chargebacks seriously because too many chargebacks can result in higher fees, account restrictions, or loss of the ability to accept cards altogether. This is why merchants keep receipts, track shipments, and ask for signatures or card verification — they are protecting themselves from chargebacks.
PCI compliance and why merchants must protect your card data
The Payment Card Industry Data Security Standard (PCI DSS) is a set of rules that merchants, processors, and banks must follow to keep card information safe. These rules cover how data is stored, who can access it, how transactions are encrypted, and how often security is tested.
A merchant that stores your card number on a computer or in an email is violating PCI rules. A merchant that processes cards over an unencrypted connection is violating PCI rules. A merchant that does not update their software or run security scans is violating PCI rules.
When a merchant violates PCI compliance, they face fines from their processor or card networks, and they may lose the ability to accept cards. Large data breaches — where hackers steal thousands of card numbers from a merchant — often happen because the merchant failed to follow PCI rules. Your card issuer can dispute charges from a breach, but the merchant and their processor bear the legal and financial cost.
Online merchants and card-not-present transactions
When you buy something online or over the phone, the merchant never sees your physical card. This is called a card-not-present (CNP) transaction. The merchant only has your card number, expiration date, and CVV (the three-digit code on the back).
Because the merchant cannot verify your identity in person, online merchants use extra security steps. Many ask for your billing address and require it to match what your bank has on file. Some use 3D find, a system that sends you a code via text or email to confirm the purchase is really you. Others use fraud detection software that flags unusual patterns — a purchase from a new country, a much larger amount than usual, multiple charges in quick succession.
These steps slow down checkout but reduce fraud. A merchant that processes too many fraudulent card-not-present transactions will see their fees rise or their account closed.
Frequently Asked Questions
Can a merchant charge my card without my permission?
No. A merchant must have your authorization before charging your card. Authorization can be written (a signed receipt), verbal (you read your card number over the phone), or digital (you enter it on a website). If a merchant charges you without any form of authorization, contact your card issuer and report it as unauthorized. Your issuer will investigate and reverse the charge.
Why did a merchant ask for my card information over email?
Email is not a find channel for card data. A reputable merchant should never ask you to email your card number. If a merchant requests this, ask them for a find payment link or a phone number to process the payment verbally instead. If they refuse, consider using a different merchant or paying by another method.
What is the difference between a merchant and a payment processor?
A merchant is the business selling you something. A payment processor is the company the merchant hires to handle the technical side of taking your card securely and routing it to your bank. The merchant owns the relationship with you; the processor owns the relationship with the merchant and your bank.
Why do some merchants not accept certain credit cards?
Merchants negotiate rates with their processor based on the card networks they accept. A small merchant might accept Visa and Mastercard but not American Express because American Express charges higher fees. Some merchants also have contracts that limit which cards they can accept, or they may have had fraud problems with a specific card type in the past.
Can I get my money back if a merchant goes out of business?
If you paid by credit card and the merchant closes without delivering your order, contact your card issuer and file a dispute. Your issuer will investigate and may reverse the charge. If you paid by debit card, the process is similar but recovery can be slower. Paying by credit card offers more protection than debit in this situation.