Is online payment with credit card equal to giving merchant whole wallet to take the money we agreed upon?

Question

I'm curious about how the credit cards work.

When you do a bank transfer it is you who tells your "bank account" what amount to send and where to send it. When you pay with credit card it seems reverse. You give all required card details to merchant so he can take from your account the billed amount.

Is this how it works? I always thought that this is the case but I talked recently about this process with someone and it seemed crazy to him. He is sure that the dollar amount is also part of the process (meaning the bank would allow only this amount to be charged by mechant) and that merchants coundn't technically be able to charge more. Isn't the sale amount just some number that is simply entered to some payment processing machine but is not part of the specific transaction from technicall POV like with the bank transfer example and ergo merchant technically can charge whatever amounts he wants regardless of "online website cart amount" when confirming payment?

Answer 1

Yes, technically they can. Nobody is stopping me as a software engineer from showing you a different price to what I'll eventually command the payment processor to take from your bank account.

You are safeguarded if 2FA or 3D Secure is triggered, because the bank would send you an authorisation code you need to enter to complete the transaction. The message containing the code would also state the amount that I plan to take from you.

To answer your question, technically it's possible. The card processor would drop me in no time as @littleadv stated above and I would be legally liable but it's still technically possible.

---

Just to be clear; @littleadv criticisms in the comments below are correct. You're asking 2 different questions and I'm only answering one of them.

It's not the same as giving your merchant your wallet even though it is technically possible to charge you whatever amount I want regardless of what I'm displaying. I'm only answering the question: "...merchant technically can charge whatever amounts he wants regardless of "online website cart amount" when confirming payment?"

The answer to that is: yes I can.

Answer 2

Is online payment with credit card equal to giving merchant whole wallet to take the money we agreen upon?

No, it is not. To clarify: you're not giving access to cash (=wallet), you're not even giving access to your bank account. You're giving access to your credit line, which is protected by multiple layers of legal and contractual obligations before you need to pay any actual money.

Isn't the sale amount just some number that is simply entered to some payment processing machine but is not part of the specific transaction from technicall POV like with the bank transfer example

No, it is not.

When you agree to a transaction, you agree to a specific set of details: what you're getting, how you're getting it, how much you're paying for it and how you're paying for it. When you click "I Agree", or sign your signature, or enter your PIN at the POS - that is what you're agreeing to.

The transaction amount is transmitted to your issuer as part of the authorization request (that's how you see "pending" transactions). Charging over the authorized amount leaves the merchant vulnerable for charge-backs.

merchant technically can charge whatever amounts he wants regardless of "online website cart amount" when confirming payment?

That is called "fraud" or "theft". Your wallet can be stolen from you, either by force or through fraud. Credit cards, however, have strong fraud protections, both contractual and legal, and you can demand money be returned to you if you didn't agree to the charge (this is called "charge back"). Merchants who do this would be dropped by their processors in no-time.

Answer 3

I upvoted @littleadv, but let me add a few thoughts:

When you make a credit card purchase, you give your card number and you also agree to the amount of the transaction. I don't know the detailed mechanics of how the bank processes the transaction -- and I'm sure it varies between banks and over time anyway. But even if it's possible for the vendor to change the amount after you've agreed to and process the transaction, that would be fraud. The credit card companies are very strict about fraud because they want to protect their reputation as a safe way to do business. If vendors could just change the price or create new transactions without your approval and get away with it, people would quickly decide that credit cards were way too dangerous and wouldn't use them. And if they weren't, you could sue the vendor and/or have them charged with a crime.

I had one time that someone made a fraudulent charge to a credit card I had. I called the credit card company and they reacted quickly and decisively. They refunded the charge. They cancelled the card and sent me a new card with a new number. And for the next month or so, every charge that came in against the old number, they sent me a form with details of the charge and asked me to indicate if it was valid or not. Apparently they held up payment to vendors until I approved each charge because I got a call from one vendor reminding me exactly what I had bought and when and asking me to approve it so they could get their money.

I suppose a credit card is more dangerous than cash because it is possible to create fraudulent transactions or to doctor a transaction. Whereas with cash, you hand them the money or you don't. But in practice they're very safe. I'd be careful about giving my credit card number to some random vendor selling shady products, but besides that, not a big deal.

Later Thoughts

Could a vendor tell the credit card company a higher number than what you agreed to? Yes. But just because a charge was posted on your account doesn't mean you're forced to pay that amount. If it's fraudulent, you can dispute it.

Just like, suppose you are paying cash. The clerk says, "That will be $18". You hand him a $20 bill. He puts the bill in his pocket and says, "So, that will be $18." You say, "But I just handed you a twenty." He replies, "No you didn't." Etc.

Or you pay with a check. You write "$100" as the amount. The store changes it to "$199".

Regardless of how you pay, someone could send you a fraudulent bill for services he never performed.

Etc. For any form of payment, there are thousands of ways someone could try to cheat you. Ultimately, your defense is that you could sue them or have them charged with fraud. Or warn others that they have cheated you and ruin their reputation.

Answer 4

As nicholaswmin mentions in his answer there are no 'technical' software protections against this, instead the protections are largely legal:

Unlike for a physical wallet:

• your bank and the merchant's bank have a record of the actual amount of money taken
• the merchant's bank knows exactly who they are
• in the case of a dispute with a 'card not present' transaction, the credit card processor places the burden of proof on the merchant to prove that the transaction was legitimate, and the banks involved will ensure that the customer is reimbursed, and chase the merchant up for the money.

Answer 5

You're allowing the merchant to send an invoice

While the merchant can technically charge an arbitrary amount, they have no unilateral ability to receive that amount, and this is a key difference from "giving them your wallet". They are not taking money from the card, they are sending an "invoice" to the issuing bank and expecting that this will be paid.

If everything goes well, it is effectively the same as if they had just took the money, however, in case of disputed or fraudulent transactions the difference becomes meaningful. If a fraudster takes your cash money from your wallet, you would need to seek redress from the fraudster directly, and if they have spent all the money, there is nothing to return. If a fraudulent merchant issues fraudulent card transactions, then your bank doesn't pay them, or if they have paid, they get compensated in full by the acquiring bank (merchant's bank) even if the fraudster has ran away with the money, so the risk profile is substantially different - sufficiently so, that you can safely ignore this risk.

The risk of making fake charges does exist, but it's handled by banks offering merchant accounts, as all the costs of fraud like this would be on them, not on the cardholders.

Also, many specific methods of payments (e.g. chip&PIN authorization, 3D Secure verification for online payments) do add explicit validation by the customer of the transaction including its amount.

Answer 6

Two keywords you might be looking for are authorization and settlement.
Stripe has a detailed explanation of the process.

Briefly:

• The merchant could save your credit card details for later reuse.
  Doing so without your consent violates many laws and contracts, but there's no technical obstacle against it once you've submitted all your card details.

• For a given transaction, a merchant can submit a higher amount for settlement than authorization.

• The merchant can only settle once per transaction (to my understanding).

• The money taken from your credit card isn't "your" money that's being taken; it's the issuer's processor's money.
  You don't lose that money if you successfully dispute the transaction; the issuer processor will lose it instead (if they can't recoup it from the vendor). (Edit: Thanks to comment for correcting.)

Answer 7

Here's the 'happy' flow of what happens:

1. You -> Visa: "I want an account where I can use your money to buy things, and I will pay you back at a later date with interest for the convenience"
2. Visa -> You: "Here's your card, you can have up to $A that you owe us, you must make a minimum payment every month, and every month we will add B% of your balance in interest. We might also want you to pay an annual fee for this convenience."
3. Merchant -> Visa: "I want to give customers the convenience of paying with a credit card."
4. Visa -> Merchant: "Sure, here's an account. We will charge a fee to you for this convenience. You must make sure you don't abuse this and that all charges are valid and we'll process the payment and give you money and worry about getting it from the customer later."
5. You -> Merchant: "I would like to buy with my credit card, here are the details."
6. Merchant -> Visa: "A customer wants to use your card to make a purchase for $C. Here's a credit card number, expiration date, billing zip code, and CV2 to prove they gave us their information to make the purchase."
7. Visa -> Merchant: "Ok, we recognize this customer, and their account is in good standing. $C will not put them over the limit. We authorize this transaction. Here's an authorization code tied to the transaction. Contact us again when the transaction is absolutely complete and settle the transaction."
8. Merchant -> Visa: "I want to settle the transaction, it is complete and there were no changes after authorization (i.e. tip at a restaurant) so the final amount is indeed $C.
9. Visa -> Merchant: "Ok, everything seems to be in order, we will add this amount minus our transaction fee to the amount we owe you and pay you on schedule."
10. Visa -> Customer (through text, online statement, or printed statement at the end of the month): "You charged $A at 'Merchant' on this date, that was added to your balance so you now owe us that as well as interest."
11. Customer -> Visa: "I've seen my bill and don't notice anything out of the ordinary. I will make my monthly payment on schedule."
12. Visa -> Merchant: "Here's the money we owe you for the transactions you've processed through us."

So you're looking at something happening in steps 6 or 8. The problem with just 'taking money' is that there are references and authorizations for everything and the customer will see the amount. Also no money actually changes hands at that instant.

The problem would be at step 11. If the customer sees something funny like the amount isn't what they thought it was they can dispute the transaction. When this happens, Visa will deduct that amount plus something like $20 from the amount they give you in step 12 so you may never see the money, and will in fact owe Visa money for trying to process a transaction that Customer didn't approve.

The reason Customer doesn't dispute normal transactions is that they did in fact order something and click on the button or signed something (as in a restaurant) that they agreed to pay the amount. Merchant can provide evidence to Visa that you did in fact authorize the transaction and if it convinces Visa, the amount will be added back to your credit card bill. If Customer tried this a lot to get goods for free then Visa would probably close their account, while still trying to recoup the debt from them.

Merchants get better rates if they provide more information on more transactions, and if they have lower charge-back rates. Merchant trying to defraud a single customer like this will likely get them nothing and actually cost them money. If they try to do this on a large scale then they will quickly be shut down and someone could end up in jail.

This is simplified of course. Visa is actually a processing network (or it could be MasterCard, Discover, American Express, or whatever), you actually have an account with a Bank, and there's probably a layer between for the Merchant as well.

If you're thinking of doing this on a very small scale, like setting up a Stripe account and using a single stolen credit card to charge as much as you can and ride off with the money, you likely will never see it. There are all kinds of metrics these companies watch, and a single large purchase for a new Merchant will likely take quite a long time before you see the money. It will probably set off flags at the bank as well and the transaction might be denied at step 6 as suspicious with Visa calling or texting Customer about suspicious activity and your Merchant account being closed very fast indeed.

Answer 8

When a merchant receives an order, they send a message to the credit card message, who then routes it to the issuing bank. This message includes the card number, CVV, and transaction amount. The issuing bank then decides whether to authorize the transaction. The merchant can indeed include whatever amount they want in the message, independent of how much is communicated to the customer (although there are exceptions, such as 3D Secure).

Isn't the sale amount just some number that is simply entered to some payment processing machine but is not part of the specific transaction from technicall POV like with the bank transfer example

I'm not sure what you mean by this. The passing the message around and sending responses is the transaction, as far as credit cards are concerned, so it doesn't make sense to ask whether the amount is a number that is entered, but not part of the transaction.

The analogy with a bank account isn't quite accurate, as the money isn't taken from your account, it's taken from the account of the issuing bank. The issuing bank then bills you, and if the transaction is fraudulent, then you can dispute the charge. In cases of fraud, the money is taken from either the issuing bank or the merchant's bank, not from your bank account.

Answer 9

In the modern era of fraud prevention and 2FA, credit card transactions are processed by the payment processor.

Payment processors are few notably trustworthy entities. When you make an online purchase, the following happens:

1. The merchant website requests the payment processor to open a transaction for $X.XX amount
2. Your browser is redirected to the payment processor using a unique URL linked to the purchase
3. The payment processor clearly displays the required amount on the dedicated webpage
4. A second payment processor could be involved in case of 2FA. After you confirm, you could be redirected to a third party website that is linked to your bank
5. During 2FA, the bank mobile app/sms will likely read back the due amount to you
6. Your browser is redirected to the merchant with a new token that the merchant can use to verify the payment and deliver goods

As said on this webpage, technically everything is possible, but not necessarily feasible.

Displaying the due amount on a POS hardware device doesn't necessarily guarantee that the displayed amount will be transmitted over the wire, etc.

In the retrocomputing era (say, 1996...) it was common to enter credit card details on merchant website without HTTPS encryption. That's why you had to trust the merchant in that era

Answer 10

Besides the legal aspect that other answers provided, many sites do now offer technical protection for the purchase: during payment, after you input your card information, they refer you to an authorization website from your own bank, who issued you the card, where you can verify the amount and authorize the transaction by any means defined by your bank. I have seen this happen with a credit card from a Brazilian bank (MasterCard), where I had to input my PIN, and with a debit card from a Portuguese bank (VISA), where I was required to follow up from my phone, with steps that includes SMS 2FA.

So, there is at least one widespread online payment protocol by major credit/debt card brands that do enforces authorization. Maybe it is not as common as the "trust/stick" based protocol, but there is.

Answer 11

Answering from the POV of a software engineer who has developed integrations for online payments with a couple of diferents payment systems (both direct with banks and through third-party systems like Paypal).

Depending on the payment system the web site is connected to, it is indeed possible to take the credit card info entered by the client, and charge a different amount that what is shown on screen.

Now, how is this different from giving them your wallet and expect the best? In other words, what prevents merchants to just take as much as they want from your CC?

If they are honest, it's the same thing that prevents them to do any other sort of frauds: their honesty. They just want to sell and have happy clients, not to mention there are numerous ways for the clients to claim and prove that the merchant made a fraudulent charge which could end very, very bad for the merchant.

If they are dishonest, what prevents them to do this is simply that it's too much hassle. To be able to connect to an online payment system, they need to go through a whole legal process, sign a lot of documents, and certificate their website with the payment system issuer to show that it is safe, it is not deceitful to the clients, and that the information they record from the client and the credit card (if any) is stored securely and won't be misused. Why go through all this to charge a little more during a transaction, when they could simply forge a fake online payment page, get all the info from your credit card, and then use it the way they want before you even realize your credit card was compromised?

By the way, this last scenario happens all the time, and it's part of the "phishing" practices that make authorities, banks, credit card issuers, your family and friends, and even random strangers from the internet, tell you to double check if the site is legitimate before entering any kind of sensible information.

---

Now, at the beggining of the answer, I mentioned that this actually depends on the payment system the web site is connected to. This is because there are actually 2 methods to perform an online transaction with a credit card:

• In one, the web site owner(s) develop all that is needed to ask the client for the card data, sent the data to the bank/issuer, get the response from the bank/issuer, and process the payment on their system; this is usually harder to do because all the responsibility falls to the side of the merchant so they have to make sure the system works correctly pretty much under any circumnstance
• In the other, the website simply tells the payment system "hey, this client wants to pay us $X amount with credit card", then the payment system takes control from this point on to get all the info needed from the client, process the charge, and then send only the confirmation info to the merchant so they can process the payment on their system.

If the website uses the first method, it falls into the honest "category" mentioned on the first part of the answer. If they use the second, there's no way they can perform any kind of fraudulent operation because they simply have no access at all to your credit card info; all the information exchange during the payment transaction happens between the client and the payment system, and all the merchant gets is a confirmation that the payment was approved at the end of it.