The payments glossary

3-D Secure 2 (3DS2) is the card schemes' online authentication protocol. It lets the customer's bank verify a card payment using risk data - or a fingerprint, face scan or app approval - instead of static passwords, and shifts fraud liability from the merchant to the issuing bank.

An acquirer (acquiring bank) is the licensed financial institution that processes card payments on a merchant's behalf: it routes transactions to the card schemes, receives the cleared funds and settles them to the merchant, carrying the financial risk of doing so.

Agentic commerce is buying and selling carried out by AI agents acting on a person's or business's behalf - finding, comparing and completing purchases without the buyer clicking through a checkout. It requires payment rails that can verify an agent's authority and accept machine-initiated payments.

AML (anti-money laundering) is the body of law and controls that stops criminals passing illicit funds off as legitimate business. For payment providers it means verifying customers, monitoring transactions for suspicious patterns, and reporting suspicious activity to the authorities.

AP2 (Agent Payments Protocol) is an open protocol for authorising payments made by AI agents. Cryptographically signed mandates prove a human gave the agent authority for a purchase - what it may buy, for how much - creating a verifiable trail for agent-initiated payments.

Authorisation is the first stage of a card payment: the merchant's payment provider asks the customer's issuing bank to approve the amount. An approval places a hold on the cardholder's funds but moves no money - that happens later, at capture and settlement.

Capture is the step that turns an approved card authorisation into an actual charge. The merchant confirms the final amount to be taken - immediately for digital goods, or later on dispatch - and the transaction is submitted for clearing and settlement.

A card scheme is the network that sets the rules and infrastructure for card payments - Visa, Mastercard, American Express and Diners Club among them. Schemes connect issuers and acquirers, route authorisations, and govern fees, disputes and security standards.

Card-on-file is the practice of storing a customer's card details - as a secure token - with their consent, so future payments can be made without the card being re-entered. It powers one-click checkout, subscriptions and merchant-initiated billing.

A chargeback is a forced reversal of a card payment raised through the customer's issuing bank - for fraud, non-delivery or billing errors. The funds are pulled back from the merchant, who may contest the dispute with evidence through a process called representment.

DebiCheck is South Africa's authenticated debit order system, mandated by the SARB. The customer electronically confirms a debit order mandate - its amount, frequency and account - with their bank before any money is collected, making debit orders far harder to dispute or create fraudulently.

A digital wallet stores a customer's payment credentials so they can pay with a tap or a click instead of typing card details. Google Pay, Apple Pay and Samsung Pay are the most widely used at online checkouts, where they replace the card number with a device-bound token.

EFT (electronic funds transfer) is the electronic movement of money between bank accounts. In South Africa, traditional EFTs clear in batches through BankservAfrica and commonly take one to three business days to reflect - the delay that Instant EFT and PayShap were built to remove.

Embedded finance is financial services built into non-financial software - payments, lending, insurance or accounts offered inside a marketplace, SaaS platform or app - so customers transact where they already are, while a regulated provider runs the rails behind the scenes.

Fraud scoring rates the risk of each transaction in real time, combining signals such as device fingerprint, location, purchase pattern and past behaviour into a single score. The score drives an automatic decision: approve, step up to extra authentication, or decline.

A hosted checkout is a payment page run by the payment provider instead of the merchant. The customer is handed over - by redirect or an embedded frame - to enter payment details on the provider's secure page, keeping card data off the merchant's systems entirely.

Instant EFT is an online payment method where the customer approves a once-off transfer from inside their own internet banking and the merchant receives immediate confirmation - so orders can be released straight away instead of waiting days for a traditional EFT to clear.

Interchange is the fee paid on every card transaction by the merchant's acquirer to the customer's issuing bank, at rates set by the card schemes. It is usually the largest component of the merchant discount rate and is passed on to merchants in their pricing.

An issuer (issuing bank) is the bank that gave the customer their card. It approves or declines each authorisation, sets card limits, authenticates the cardholder and takes the cardholder's side in disputes - the counterpart to the merchant's acquiring bank.

KYC (know your customer) is the identity verification a financial services provider performs before taking on a customer or merchant - confirming who they are, that the business is real, and who ultimately owns it. It is required under anti-money-laundering law.

A merchant account is an account with an acquiring bank that lets a business accept card payments in its own name. Each account carries a merchant ID (MID) that identifies the business to the card schemes and determines where its card takings settle.

The merchant discount rate (MDR) is the total fee a merchant pays to accept a card payment, usually a percentage of the transaction value. It bundles interchange (paid to the issuer), card scheme fees, and the margin of the acquirer or payment provider.

A merchant-initiated transaction (MIT) is a payment charged to a stored card without the customer present - a subscription renewal, instalment or automatic top-up - made under a prior agreement using a token and referencing the original authorised transaction.

Mobile money is a store of value tied to a mobile number - M-Pesa is the best-known example - that lets people deposit, send and spend money from a phone without a bank account. Across much of Africa it is the default way to pay, and an essential acceptance method in those markets.

Network tokenisation is tokenisation performed by the card schemes themselves: Visa or Mastercard issue the token and keep it linked to the underlying card, updating it automatically when the card is reissued - which improves approval rates for stored-card payments.

Pay-by-bank is the umbrella term for payments made straight from the customer's bank account at checkout - approved through a bank login, a banking app or a proxy such as a mobile number - rather than through a card. In South Africa its main forms are Instant EFT and PayShap.

A payment aggregator pools many merchants under one master merchant account and processes their payments collectively, so individual businesses can accept cards without their own acquiring relationship - fast to join, with settlement flowing via the aggregator.

A payment facilitator (PayFac) is a provider that onboards merchants as sub-merchants under its own master merchant account, letting them accept card payments quickly without acquiring a merchant account of their own. The PayFac handles onboarding, risk and settlement.

A payment gateway is the technology layer that connects a merchant's checkout to the payment system: it captures payment details securely, sends them for authorisation, applies fraud checks and 3-D Secure, and returns the approval or decline to the merchant in real time.

A payment link is a shareable URL that opens a ready-made checkout for a set amount or product. Merchants send it by chat, email, SMS or on an invoice; the customer taps it and pays on a hosted page - no website or integration required.

Payment orchestration is a single layer between a merchant and many payment services - gateways, acquirers, methods and fraud tools - managed through one integration. It handles routing, failover, tokenisation and reconciliation across all of them from one place.

A payment service provider (PSP) is a company that enables businesses to accept payments - cards, EFT, wallets, vouchers - through a single integration and contract, bundling gateway technology, acquiring connections, risk management and settlement.

A payout is the transfer of settled funds from a payment provider to the merchant's own bank account - the moment card and alternative-payment takings, minus fees and any reserve, actually arrive. Payout schedules commonly run daily or weekly.

PayShap is South Africa's real-time rapid payments service, launched in 2023 by BankservAfrica with the country's major banks. It moves money between bank accounts in seconds, around the clock, and lets payers use a ShapID proxy - such as a mobile number - instead of an account number.

PCI DSS (Payment Card Industry Data Security Standard) is the card industry's global security standard for any organisation that stores, processes or transmits cardholder data. Compliance is validated at levels, with Level 1 - independently assessed each year - the most stringent.

POPIA - the Protection of Personal Information Act, 2013 - is South Africa's data protection law. It sets eight conditions for how organisations may collect, store, use and share personal information, and it is enforced by the Information Regulator of South Africa.

Real-time payments are account-to-account transfers that clear individually in seconds, around the clock, with funds immediately available to the recipient. South Africa's real-time rail is PayShap, operated by BankservAfrica; similar systems run in many markets worldwide.

Reconciliation is the process of matching payment records against money actually received - checking every transaction, fee, refund and chargeback in a settlement against the provider's reports and the bank statement so the books balance to the cent.

Recurring payments are charges collected automatically on a schedule under the customer's standing authority - subscriptions, instalments, memberships. Online they typically run on a tokenised card-on-file, with the merchant initiating each charge without the customer present.

A refund is a merchant-initiated return of funds for a completed card payment, sent back through the original payment route to the customer's card. Unlike a chargeback, the merchant controls the decision and no dispute process or penalty is involved.

Representment is a merchant's formal challenge to a chargeback: evidence such as delivery confirmation, 3-D Secure results and customer correspondence is submitted through the acquirer to the issuing bank to argue that the original charge was valid.

A rolling reserve is a percentage of a merchant's card turnover that a payment provider holds back for a fixed period - commonly around 5-10% for 90 to 180 days - as a buffer against future chargebacks and refunds, paid out on a rolling schedule as each period matures.

A sandbox is a payment provider's test environment - a working replica of the live API with test cards and simulated banks - where developers can build and verify an integration end-to-end without moving real money.

Settlement is the process of actually moving money after card payments are approved: captured transactions are batched, cleared through the card schemes, and funds flow from the issuing bank to the acquirer and on to the merchant, typically one to two business days later.

Smart routing automatically sends each transaction down the processing path most likely to succeed, choosing between acquirers or providers based on card type, issuer behaviour, cost and historical approval rates - and can retry a declined payment along an alternative route.

A stablecoin is a cryptocurrency designed to hold a steady value, usually pegged 1:1 to a currency such as the US dollar and backed by reserves. It settles like crypto - in seconds, across borders, around the clock - which is why it underpins much of the emerging machine-payment stack.

Tokenisation replaces a card number with a unique, non-sensitive token that is useless if stolen. Merchants store and reuse the token for repeat and recurring payments while the real card details stay in a secure, PCI DSS-compliant vault.

Velocity checks are fraud rules that count how often something happens in a time window - attempts per card, per device, per IP address, per email - and block or flag activity that breaches the limit, such as ten card attempts from one device in five minutes.

Voucher payments let customers pay online with cash. The customer buys a prepaid voucher - 1Voucher, OTT, BluVoucher and Kazang are well-known South African examples - for cash at a retail till, then enters the voucher PIN at checkout to pay. No bank account or card is required.

A webhook is an automated HTTP callback a payment provider sends to a merchant's server when an event happens - a payment succeeds, a refund completes, a chargeback arrives - so the merchant's systems can react immediately instead of repeatedly polling an API.

x402 is an open payment protocol built into HTTP itself, reviving the 402 "Payment Required" status code. A server quotes a price in the 402 response; the client - commonly an AI agent - pays and retries the request. The protocol is stewarded under the Linux Foundation.