Short answer: online payments on a travel website should run through the bank’s secure payment page with 3D Secure, and card details should never be stored on your server. What makes travel different: the amount should first be held on the card and only captured once the ticket or hotel is confirmed. Refunds, currency and agent payments also need thinking through in advance. This article explains how online payments are set up on a travel website and what to watch out for.
How online payment works
- The customer chooses a booking on the website and presses “Pay”.
- They are redirected to the bank’s or payment provider’s secure page and enter their card details there.
- 3D Secure: the card-issuing bank verifies the customer’s identity: approval in the banking app or an SMS code.
- The bank replies: approved or declined. The website receives this answer and continues the booking.
In this model the card number never reaches your server at all. That is the simplest and most reliable approach both for security and for card security standard (PCI DSS) requirements. 3D Secure has another advantage: when a customer disputes a payment made with a stolen card, liability often shifts from you to the card-issuing bank.
What makes travel different: hold first, capture later
In a normal online shop the product is in stock. In travel, seats and prices sit with the supplier and can change at the moment of payment. So the safest sequence is:
- Hold (authorisation): the amount is blocked on the customer’s card but not yet charged.
- Booking and document: the ticket is issued, the hotel is confirmed.
- Capture: on success, the held amount is charged.
- Void: if the ticket isn’t issued or the hotel isn’t confirmed, the hold is released and the customer’s money is untouched. No refund is needed.
A hold usually stays on the card for a few days; the period depends on the bank and card scheme. So capture should happen automatically as soon as the booking is confirmed. Ask your bank in advance whether it supports this (two-step payment).
Refunds and disputed payments
- Full and partial refunds: the whole amount is refunded for a cancelled booking, or only part of it when a penalty applies. The system should calculate the penalty from the fare rules and send the refund to the payment provider.
- To the same card: a refund usually goes back to the card used for payment and can take several working days. Telling the customer this at refund time cuts down on calls.
- Disputed payment (chargeback): the customer can claim the payment back through their bank. Keep evidence in the system: the ticket, voucher, accepted terms and the 3D Secure confirmation.
Currency: manat, dollars and euros
The customer pays in manat, while suppliers often settle in dollars or euros. A few decisions are needed here:
- Exchange rate source: for example, the daily official rate of the Central Bank of Azerbaijan or your bank’s rate.
- Rate buffer: the rate can change between search and settlement. A small buffer percentage prevents losses.
- Prices in several currencies: for foreign customers you can show prices in dollars or euros and accept payment in that currency. Agree this with your bank.
How agents and corporate clients pay
- Balance and deposit: the agent tops up a balance in advance, and bookings are paid from it.
- Credit limit and invoice: a trusted agent or company books, and pays later against an invoice.
- Card directly to the airline: in some cases the customer’s card is passed directly to the airline as the form of payment. The airline is then the merchant and pays the card fee. Check the GDS and airline terms for where this model is possible.
More on agent payments: B2B travel portal and sub-agent system.
Fees and costs
Banks and payment providers charge a percentage on each transaction. With international providers this is usually 2–3% of the transaction, plus an extra percentage for foreign cards and currency conversion. Azerbaijani banks do not publish their e-commerce rates; terms are agreed individually depending on sales volume. Since travel margins are often thin, the fee needs to be built into your pricing rules: for example, included in the service fee, or a different fee by payment method. Overall costs: how much a flight booking system costs.
Reconciliation: which order each payment belongs to
Every payment, refund and fee should be linked to a specific order. Otherwise, matching the bank statement to orders by hand at month end takes hours. In a good system the payment status is visible on the order, refunds are recorded automatically, and the daily report is matched against the bank’s report. Our solution: accounting and back office.
Checklist
- Payment runs on the bank’s secure page with 3D Secure, and card details are not stored on the server.
- Two-step payment (hold, then capture) is supported.
- Full and partial refunds are done from the system.
- The exchange rate source and buffer percentage are defined.
- Balance, credit limit and invoicing work for agents.
- Bank fees are built into the pricing rules.
- Every payment and refund is linked to an order and shows up in reports.
General selection criteria: how to choose a booking system: 10 questions. To write down your requirements: technical specification template.
To discuss connecting online payments to your website, book a free consultation. The payment module is part of the booking engine and is included in our flight booking system.
Frequently asked questions
What is 3D Secure?
3D Secure is an extra check of the customer’s identity by the card-issuing bank in an online card payment: approval in the banking app or an SMS code. It prevents fraudulent payments and, in such disputes, often shifts liability from the merchant to the bank.
What happens to the customer’s money if the ticket isn’t issued?
With two-step payment the amount is only held at first. If the ticket isn’t issued, the hold is released and nothing is charged to the customer’s card. With one-step payment a refund is needed instead, which can take several working days.
Can we store card details on our own website?
You shouldn’t. Storing card details means strict security requirements (PCI DSS) and risk. Payment should happen on the bank’s page, and repeat payments should use a token issued by the bank.
Can foreign customers pay in dollars or euros?
Yes, if your bank and payment provider support it. Prices can be shown in the customer’s currency and payment accepted in that currency. Agree the exchange rate rules and the bank’s currency fee in advance.
