Backend interview prep

Start Learning

Payment Processing Systems

Learn how modern payment processing systems work from a software engineer's perspective. This guide covers payment architecture, transaction lifecycle, payment gateways, acquiring and issuing banks, card networks, settlement, reconciliation, security, and enterprise payment processing workflows.

Introduction

Every day, billions of payment transactions occur worldwide.

Examples include:

  • Credit Card Payments
  • Debit Card Payments
  • UPI Transfers
  • ACH Payments
  • Wire Transfers
  • Online Shopping
  • Mobile Wallets
  • QR Payments
  • ATM Withdrawals
  • Bill Payments

Whenever a customer pays using a card or mobile application, multiple banking systems work together within a few seconds.

As a software engineer, understanding payment processing is one of the most valuable domain skills because payment systems require:

  • High Availability
  • Low Latency
  • Security
  • Scalability
  • Idempotency
  • Fault Tolerance
  • Regulatory Compliance

Learning Objectives

After completing this article, you will understand:

  • Payment Processing Fundamentals
  • Payment Ecosystem
  • Payment Gateway
  • Acquiring Bank
  • Issuing Bank
  • Card Networks
  • Authorization
  • Settlement
  • Reconciliation
  • Payment Security
  • Enterprise Payment Architecture
  • Real-world Banking Workflows

What is Payment Processing?

Payment Processing is the movement of money from a payer to a payee using secure financial networks.

Example

Customer

↓

Buy Product

↓

Merchant

↓

Bank

↓

Money Transferred

Payment Ecosystem

flowchart LR

Customer

Merchant

PaymentGateway

AcquiringBank

CardNetwork

IssuingBank

Customer --> Merchant
Merchant --> PaymentGateway
PaymentGateway --> AcquiringBank
AcquiringBank --> CardNetwork
CardNetwork --> IssuingBank

Major Components

Component Responsibility
Customer Makes Payment
Merchant Sells Product
Payment Gateway Accepts Payment
Acquiring Bank Merchant Bank
Card Network Visa, Mastercard
Issuing Bank Customer Bank
Core Banking Customer Account
Settlement System Transfers Funds

High-Level Architecture

flowchart TD

Customer

Website

PaymentGateway

PaymentService

FraudService

CoreBanking

CardNetwork

Settlement

Notification

Customer --> Website
Website --> PaymentGateway
PaymentGateway --> PaymentService
PaymentService --> FraudService
PaymentService --> CoreBanking
PaymentService --> CardNetwork
PaymentService --> Settlement
Settlement --> Notification

Payment Transaction Lifecycle

Every payment typically goes through these stages:

flowchart LR

Initiated

Validated

Authorized

Captured

Settled

Completed

Initiated --> Validated
Validated --> Authorized
Authorized --> Captured
Captured --> Settled
Settled --> Completed

Step 1 Customer Initiates Payment

Example

Product Price

↓

$200

↓

Click Pay

Merchant creates payment request.

Step 2 Payment Gateway

Payment Gateway receives payment request.

Responsibilities:

  • Validate request
  • Encrypt payment
  • Tokenize card
  • Authenticate customer
  • Route payment

Examples

  • Stripe
  • PayPal
  • Razorpay
  • Adyen
  • Authorize.Net

Payment Gateway Flow

flowchart LR

Customer

Merchant

Gateway

Validate

Bank

Customer --> Merchant
Merchant --> Gateway
Gateway --> Validate
Validate --> Bank

Step 3 Acquiring Bank

Acquiring Bank represents the merchant.

Responsibilities:

  • Receive payment
  • Verify merchant
  • Route transaction
  • Settlement

Step 4 Card Network

Examples:

  • Visa
  • Mastercard
  • American Express
  • RuPay
  • Discover

Responsibilities:

  • Route transaction
  • Security checks
  • Network authorization

Step 5 Issuing Bank

Issuing Bank owns customer's account.

Validates:

  • Card status
  • Available balance
  • PIN
  • CVV
  • Expiration
  • Fraud risk

Authorization Flow

flowchart LR

Customer

Merchant

Gateway

CardNetwork

IssuingBank

Approved

Customer --> Merchant
Merchant --> Gateway
Gateway --> CardNetwork
CardNetwork --> IssuingBank
IssuingBank --> Approved

Authorization Response

Example

Status

↓

APPROVED

Authorization Code

↓

894532

or

DECLINED

Payment Capture

Authorization reserves money.

Capture actually collects money.

Example

Hotel Booking

↓

Authorize Today

↓

Capture After Checkout

Settlement

Settlement transfers money.

flowchart LR

CustomerBank

CardNetwork

MerchantBank

Merchant

CustomerBank --> CardNetwork
CardNetwork --> MerchantBank
MerchantBank --> Merchant

Reconciliation

Banks verify:

  • Authorization
  • Settlement
  • Merchant Amount
  • Customer Debit

Everything must match.

Authorization

↓

Settlement

↓

Ledger

↓

Reports

Enterprise Payment Architecture

flowchart TD
    C["Customer"]
    G["API Gateway"]
    P["Payment Service"]
    F["Fraud Detection"]
    T["Tokenization"]
    A["Authorization"]
    S["Settlement"]
    L["Ledger"]
    N["Notification"]

    C --> G
    G --> P
    P --> F
    P --> T
    P --> A
    A --> S
    S --> L
    L --> N

Payment Status

INITIATED

VALIDATED

AUTHORIZED

CAPTURED

SETTLED

FAILED

REVERSED

REFUNDED

Failed Payment Flow

flowchart LR

Payment

Authorization

Failed

Retry

Success

Payment --> Authorization
Authorization --> Failed
Failed --> Retry
Retry --> Success

Refund Flow

flowchart LR

Customer

RefundRequest

Merchant

Gateway

Bank

Customer

Customer --> RefundRequest
RefundRequest --> Merchant
Merchant --> Gateway
Gateway --> Bank
Bank --> Customer

Payment Security

Payment systems use:

  • HTTPS
  • TLS
  • Tokenization
  • Encryption
  • PCI DSS
  • OAuth2
  • JWT
  • MFA
  • Device Fingerprinting

Tokenization

Instead of storing card numbers:

Card Number

↓

Token

↓

Safe Storage

Example

4111111111111111

↓

TKN-987654321

Fraud Detection

Checks include:

  • Device ID
  • IP Address
  • Location
  • Spending Pattern
  • Velocity Rules
  • Blacklisted Cards
  • Merchant Risk
  • Machine Learning Models

Idempotency

Duplicate payment requests should not debit customers twice.

Example Header

Idempotency-Key: 9dce1234-789a

Flow

flowchart LR

Request

CheckKey

ExistingTransaction

ProcessPayment

Request --> CheckKey
CheckKey --> ExistingTransaction
CheckKey --> ProcessPayment

Java Domain Model

public class Payment {

    private String paymentId;

    private BigDecimal amount;

    private String currency;

    private String status;

}

Payment API Example

POST /api/payments

Request

{
  "amount":250,
  "currency":"USD",
  "merchantId":"MER123"
}

Response

{
  "paymentId":"PAY12345",
  "status":"AUTHORIZED"
}

Settlement Batch

Banks usually perform settlement in scheduled batches.

flowchart LR

Payments

SettlementBatch

Bank

Merchant

Payments --> SettlementBatch
SettlementBatch --> Bank
Bank --> Merchant

Payment Monitoring

Monitor:

  • Success Rate
  • Failure Rate
  • Authorization Time
  • Gateway Latency
  • Fraud Detection
  • Settlement Delay

Tools:

  • Datadog
  • Grafana
  • CloudWatch
  • Splunk

Common Challenges

  • Duplicate payments
  • Gateway timeout
  • Partial failure
  • Settlement mismatch
  • Fraud
  • Network latency
  • Retry handling
  • Reconciliation failures

Best Practices

  • Always use HTTPS
  • Use idempotency keys
  • Encrypt sensitive data
  • Never store CVV
  • Tokenize card information
  • Implement retry with exponential backoff
  • Log transaction IDs
  • Use distributed tracing
  • Monitor payment latency
  • Reconcile settlements daily
  • Follow PCI DSS standards

Common Interview Questions

What is a Payment Gateway?

A Payment Gateway securely receives payment requests from merchants, validates them, encrypts sensitive data, and routes transactions to banks and card networks.

What is the difference between Authorization and Capture?

Authorization verifies funds and reserves the amount. Capture transfers the authorized funds to the merchant.

What is Settlement?

Settlement is the financial process of transferring funds from the issuing bank to the acquiring bank and ultimately to the merchant.

Why is Idempotency important?

Idempotency ensures duplicate requests do not result in multiple charges for the same transaction.

What is Tokenization?

Tokenization replaces sensitive card information with a non-sensitive token to improve security and reduce PCI DSS scope.

Summary

In this article, we explored modern Payment Processing Systems from a software engineering perspective.

We covered:

  • Payment ecosystem
  • Payment Gateway
  • Acquiring Bank
  • Issuing Bank
  • Card Networks
  • Authorization
  • Capture
  • Settlement
  • Reconciliation
  • Fraud Detection
  • Tokenization
  • Enterprise architecture
  • Java payment models
  • Security best practices

Payment processing is one of the most critical areas in enterprise banking. A solid understanding of transaction lifecycles, security, settlement, and distributed system design is essential for building scalable, secure, and reliable financial applications.