Before the Agent: How a Card Payment Actually Works

An AI agent that shops for you has to do something a human does without thinking: pay. And paying, it turns out, is the hard part. Finding a product is a search problem. Handing over money is a trust and authorization problem, negotiated between five parties, governed by rules written long before anyone imagined software doing the buying.

So this cursus starts one layer down. You cannot evaluate any claim about agentic commerce, what breaks, what is genuinely new, who carries the risk, without knowing what happens when you click Pay. Almost everything interesting about agent payments is a modification of this existing machinery, not a replacement of it.

This lesson covers that machinery:

• Who the parties are and what each one actually does.
• The transaction path: authorization, capture, clearing, settlement.
• Interchange: where the money in payments comes from.
• Card-not-present risk: why remote payments are treated differently, and who eats the loss.
• Tokenization: the mechanism that agentic commerce is built directly on top of.

One assumption is worth flagging now, because the rest of the cursus attacks it. This entire system was designed around a premise: a human being is present at the moment of purchase. Agents break that premise, and the consequences are the subject of Lessons 2 and 3.

Every card transaction involves five roles. Confusing them is the source of most misunderstanding about payments.

• The cardholder. You, the person paying.
• The issuer. The bank that gave you the card. It holds your money or extends you credit, and it is the party that ultimately decides whether to approve a transaction. Your card is the issuer's product.
• The merchant. The business being paid.
• The acquirer (or merchant bank). The merchant's side of the relationship: it accepts the transaction on the merchant's behalf, submits it for authorization, and ultimately deposits the funds into the merchant's account.
• The card network (Visa, Mastercard, and others). Not a bank. It is the switch and the rulebook: it routes messages between acquirers and issuers, sets the rules all participants must follow, and calculates who owes whom.

The critical structural insight: the network does not hold the money. Banks do. The network moves messages and rules. Visa does not pay the merchant; the issuer's money reaches the merchant through the acquirer, and Visa orchestrates it.

This matters for the rest of the cursus, because when you read that "Visa is enabling AI agents to pay," what is actually being changed is the rules and message formats, plus a way to identify agents. The money still flows issuer, network, acquirer, merchant, exactly as before. Agentic commerce is a new kind of instruction entering an old, unchanged pipe.

When you click Pay, a message makes a round trip in roughly a second.

1. Merchant  -->  Acquirer      "can I charge this card $80?"
2. Acquirer  -->  Network       routed by card number
3. Network   -->  Issuer        "your customer wants to spend $80"
4. Issuer checks: valid card? funds/credit available? fraud rules?
5. Issuer    -->  Network  -->  Acquirer  -->  Merchant   approve / decline

If approved, the issuer places a hold on the funds. Notice what has not happened: no money has moved. Authorization is a promise, a reservation against your balance. This is why a pending charge can vanish, or why a hotel's hold sits on your card for days.

Step 4 is where the power sits. The issuer decides, and it decides using its own fraud rules. A transaction can be declined not because you lack funds but because the issuer's model finds it suspicious. That is a genuinely important detail for agentic commerce: an issuer that considers agent-initiated purchases anomalous will decline them, no matter what the merchant or the agent wants. Which is precisely why the networks' agent programs emphasize agent identification, giving the issuer a way to see that a transaction is a legitimate agent acting for a known cardholder, rather than an unexplained oddity that trips a fraud rule.

Authorization reserved the money. Three more steps actually move it, and the gap between them is bigger than most people realize.

• Capture. The merchant says "bill it for real." This can happen hours or days after authorization, and the amount can differ from what was authorized. That is why hotels and fuel stations authorize an estimate and capture the true figure later.
• Clearing. Merchants batch their captured transactions and submit them. The network matches each to its original authorization and exchanges the data between acquirer and issuer.
• Settlement. Money finally moves. And it moves in a way worth understanding: the network calculates net positions across all participating banks, working out who owes what to whom in aggregate, and the banks exchange net amounts rather than settling each transaction individually.

That netting step is the quiet engine of card payments. Millions of transactions between two banks collapse into a single transfer. Without netting, the system would drown in its own volume.

The practical lesson: paying is not one event, it is a pipeline stretched over days. Authorization is fast and is what the customer experiences; settlement is slow and is where money genuinely changes hands. Hold that distinction, because it explains why merchants care so much about the difference between an authorization that will settle and one that will be disputed, and it is exactly the seam that stablecoin settlement, the subject of a companion cursus, aims at.

Payments are not free, and the money flows in a direction that surprises people.

The central fee is interchange: it is set by the card network, and paid by the acquirer to the issuer. Read that again, the merchant's side pays the cardholder's bank. It compensates the issuer for its costs and risks: funding the transaction, extending credit, and absorbing fraud.

The merchant does not see interchange as a separate line; it reaches them bundled into the merchant discount rate, the total they pay to accept a card. On an 80 dollar sale, a merchant might receive roughly 77 to 78 dollars. Interchange is the largest slice of that gap.

This explains several things at once:

• Why your card has rewards. Interchange funds them. Your points are paid for by merchants, through the acquirer, to your issuer.
• Why merchants care intensely about payment costs. On thin retail margins, 2 to 3 percent of revenue is enormous.
• Why merchants have a motive to prefer cheaper rails, and why any new payment method arrives with cost as its opening argument.

And it sets up a theme for Lesson 3. Interchange is not arbitrary: it prices risk, chiefly fraud and disputes. So when a new kind of transaction appears whose risk profile is unknown, an agent buying on your behalf, the question "what does this cost?" is really the question "who is liable when it goes wrong?"

Payments split into two worlds, and the distinction drives the design of everything that follows.

Card-present means the physical card met the physical terminal. The chip performs cryptography proving the real card was there. Fraud is comparatively hard.

Card-not-present (CNP) means the card was not physically present: online, phone, in-app. The merchant is trusting data (a number, an expiry, a security code) rather than a cryptographic proof from the chip. Anyone who has the numbers can transact. CNP is therefore where card fraud concentrates.

The system's response has two parts:

• Liability sits differently. In CNP, the merchant typically bears the loss on fraudulent transactions. If a stolen card is used on your store and the real cardholder disputes it, the merchant usually eats a chargeback: the money is pulled back, often with a fee, even though the merchant shipped the goods.
• Extra verification exists precisely to shift that risk, for example 3-D Secure style step-up checks, which can move liability back toward the issuer when the cardholder is authenticated.

So online merchants live with a permanent tension: every extra check reduces fraud and also kills conversion. Ask too much and the customer abandons; ask too little and you absorb chargebacks.

Hold that tension. An agent buying on your behalf is, by construction, a card-not-present transaction in which the cardholder is not even at the keyboard. It is the riskiest category, with the human removed.

The last piece is the most important for this cursus, because agentic payments are a direct extension of it.

If CNP fraud comes from the fact that the card number is a bearer secret, anyone who learns it can spend, then the fix is obvious: stop sharing the real number. That is tokenization. The real card number (the PAN) is replaced with a network token, a substitute value that the network can map back to the real card.

Why this is powerful: a token can be scoped. It can be restricted to a particular merchant, so a token stolen from one store is worthless anywhere else. It can be restricted to a channel or device. It can be revoked without reissuing your physical card. This is exactly how a phone wallet works: the merchant never sees your real number.

The benefits are concrete: network tokenization reduces CNP fraud, and it can earn merchants lower interchange, because a scoped credential is genuinely less risky than a raw number, and interchange prices risk.

Now the punchline that sets up Lesson 2. A token is a credential that is deliberately less powerful than the card it stands for. Once you can issue a credential restricted to one merchant, you can ask: why not restrict it to one merchant and one amount, and one use, and a time window? That is not a new idea. It is tokenization taken to its logical end, and it is precisely what handing spending power to an agent requires.

Assemble the machinery, and notice what it quietly assumes.

Every row assumes a present, deciding human. Fraud models are trained on human behavior and flag deviations from it. Step-up authentication challenges a person. Conversion optimization is about human patience. Liability rules ask, in effect, whether a human was properly asked.

An AI agent violates that assumption completely. It buys at 3am, at machine speed, in patterns no human produces, and cannot be shown a challenge screen. To the existing system, a legitimate agent and a fraud bot look identical: automated software spending someone else's money without them watching.

That is the real problem agentic commerce has to solve, and it is not about shopping. It is about proving authority without a human present, and bounding what that authority can do. Fortunately, the last step already showed the shape of the answer, a credential deliberately weaker than a card. Lesson 2 is how the industry is building exactly that.

A payment runs merchant to acquirer to network to issuer for authorization, which only places a hold; capture, clearing, and netted settlement move the money later, while interchange flows from acquirer to issuer to price the risk the merchant bears in card-not-present sales.