LinkedIn

Blog

📝 NPBlue Blog 23 articles

Long-form takes on cloud, data, payments, and the technology business — practitioner perspectives you won't find paraphrased from the docs.

Payment Cards Explained: The Differences That Actually Matter in Practice

Pick up any two payment cards and they look identical: the same dimensions, the same logo in the corner, the same 16 digits across the front. The differences that matter — to your cash flow, your fraud protection, your spending limits, and your legal rights — are almost entirely invisible from the outside.

This is a practical rundown of how payment card types actually differ and what those differences mean in real situations.

The Networks vs The Issuers: A Distinction Worth Making

Most people know their card is “a Visa” or “a Mastercard,” and they know it’s issued by their bank. The relationship between these two entities is frequently misunderstood.

Card networks (Visa, Mastercard, American Express, UnionPay) operate the payment rails — the infrastructure that routes authorisation requests, settles transactions between banks, and sets the rules that govern how cards can be used by merchants and issuers alike. They don’t issue cards, and they don’t hold your money.

Card issuers are the banks, building societies, and fintech companies that actually give you the card. They decide your credit limit, set your terms, hold your funds (in the case of debit and prepaid cards), and handle disputes.

Why this matters: when a transaction goes wrong, who you contact depends on what went wrong. The merchant? The issuer? The network? Most disputes start with the issuer, who then processes chargebacks through the network. Understanding this saves time when something needs to be resolved.

American Express operates differently — it’s both the network and often the issuer, which is why Amex merchant fees are higher and why some smaller businesses choose not to accept it.

Credit Cards

The fundamental mechanic: you spend now, the issuer pays the merchant now, and you pay the issuer back later. In the UK, if you pay the full balance by the due date each month, you typically pay no interest. If you carry a balance, interest accrues — usually from the transaction date, not from the statement date.

Where they have clear advantages:

Section 75 of the Consumer Credit Act makes the credit card issuer jointly liable with the merchant for purchases between £100 and £30,000. This is a legal right, not a discretionary policy. If a travel company goes bust before your holiday, you can claim from your card issuer. Debit cards don’t offer this protection in the same form.

Chargeback (claiming a refund through the card network when a merchant doesn’t deliver) is available on credit cards and can go higher than the £100 Section 75 threshold isn’t required for. Together these protections make credit cards strongly preferable for significant online purchases or bookings with businesses you don’t know well.

Where they go wrong:

Carrying a balance at 20%+ APR is expensive. The minimum payment structure is deliberately designed to extend repayment over years. Interest on a missed payment applies to the entire statement balance, not just the portion you didn’t pay.

Debit Cards

You’re spending your own money in real time. The bank checks your balance (and any arranged overdraft headroom) and approves or declines instantly.

Practical strengths: No risk of accumulating interest. No risk of spending money you don’t have (unless you have an overdraft). Widely accepted everywhere credit cards are, and sometimes where they aren’t.

Practical weaknesses: Chargeback protection is weaker than Section 75. Fraud resolution takes longer because the money has already left your account. Some car rental companies, hotels, and online services pre-authorise larger amounts (called a hold or block) which are tied up until the final charge settles — this can affect available balance meaningfully.

The contactless limit matters more with debit cards because each transaction is spending real money immediately. Understanding that a contactless tap on a debit card with a negative balance usually declines — but sometimes doesn’t, depending on your bank’s policies — is useful knowledge.

Prepaid Cards

You load money onto the card before spending it. There’s no credit, no overdraft, no bank account attached. What’s on the card is what you can spend.

Useful for:

Important to understand:

Virtual Cards

A virtual card is a card number (and associated CVV and expiry date) that exists digitally without a physical card. Most virtual cards are issued linked to a real card or account.

They’re increasingly common for:

The security advantage is significant. A virtual card number compromised in a data breach affects nothing else — there’s no underlying card to clone, no account number to misuse. For frequent online shoppers or businesses managing multiple supplier payments, this is a meaningfully better security posture than using a single card number everywhere.

Revolut, Curve, and several bank-issued business cards now offer virtual card generation as a standard feature.

Contactless and the Offline Authorisation Model

Contactless payments below the limit (£100 in the UK as of 2021) don’t always go online to the bank for authorisation at the moment of payment. The terminal maintains a set of rules — called the Contactless Transaction Limit offline floor limit — and makes the authorisation decision locally.

This is why a tap sometimes succeeds even when connectivity is poor (an offline transaction that syncs later). It’s also why a card that’s been cancelled can occasionally process a contactless transaction — the terminal made an offline decision before the cancellation propagated.

Cards automatically force a PIN entry after a certain number of consecutive contactless uses or after a total amount threshold, regardless of individual transaction values. This is a fraud protection measure and will vary by issuer.

The Security Comparison

The hierarchy of fraud protection, roughly:

  1. Virtual one-use card — highest protection for online spending
  2. Credit card — strong legal protections (Section 75), liability limits, and issuer-funded fraud resolution
  3. Debit card — chargeback available but weaker, fraud resolution slower because real money is gone
  4. Prepaid card — depends heavily on the issuer’s policies; no universal legal protection equivalent to Section 75

Chip and PIN is significantly more secure than magstripe (which still exists as a fallback in some markets). Contactless has a reasonable security architecture — the dynamic data in each transaction makes it hard to replicate — but the offline authorisation model creates the specific vulnerabilities described above.

Choosing the Right Card for the Situation

There’s no single best card type — it depends on the transaction:

The payment card market in the UK has become meaningfully competitive, particularly with challenger banks. The difference between the best and worst card for any given use case — in fees, protection, and rewards — is large enough to be worth a few minutes of comparison before defaulting to whatever the bank sent you when you opened your account.