A payment gateway is the tool that connects your customer's card or bank account to your merchant account so money can move from them to you
When a customer enters their card details on your website or in your store, the payment gateway is what captures that information, encrypts it, and sends it to the bank that issued the card. The gateway waits for approval or rejection, then tells your system whether the transaction went through. Without a gateway, you have no secure way to accept cards at all — it is the middleman that makes the whole transaction possible.
Think of it like a translator between your store and the banking system. Your store speaks one language, the banks speak another, and the gateway makes sure both sides understand each other. It also handles the security part: the gateway itself never actually stores the card number on your server, which keeps you from being responsible for protecting that data.
Key Takeaways
- A payment gateway encrypts and transmits card information from your customer to their bank, then returns approval or denial to your system.
- The gateway is separate from your merchant account — you need both, and they may come from different companies.
- Gateways charge a transaction fee (usually 2 to 3 percent plus a flat amount per transaction) and sometimes a monthly account fee.
- Online stores, in-person terminals, and phone orders all use gateways, but the setup and hardware differ depending on where the customer is.
How the payment gateway processes a transaction
The process happens in seconds but involves several steps. Your customer enters their card number, expiration date, and CVV (the three-digit code on the back). The gateway immediately encrypts this data so it cannot be read if intercepted. It then sends the encrypted information to the card network — Visa, Mastercard, American Express, or Discover — which routes it to the customer's bank.
The bank checks whether the card is valid, whether the account has enough funds, and whether the transaction matches the customer's normal spending pattern. It sends back a yes or no. The gateway receives this response and passes it to your system in real time. If approved, the money is reserved. If denied, the customer sees an error message and can try again or use a different card.
Settlement happens later — usually the next business day. The gateway batches all your approved transactions and sends them to your bank, which deposits the money into your account minus the gateway's fee. This delay between approval and deposit is normal and expected.
The difference between a gateway and a merchant account
Many business owners confuse these two because they work together so closely. Your merchant account is the bank account that receives the money. Your payment gateway is the tool that moves the money there. You need both, but they are separate services.
Some companies bundle them together — Stripe, Square, and PayPal all offer both in one package. Others keep them separate: you might use a gateway from one vendor and a merchant account from your bank. The bundled approach is simpler for small businesses because you sign one contract and get one bill. The separate approach gives you more flexibility to shop around, but requires more setup.
What you pay for a payment gateway
Gateway fees come in two forms: a percentage of each transaction plus a flat per-transaction fee, and sometimes a monthly account fee. A typical rate is 2.2 percent plus 30 cents per transaction, though this varies by provider and by card type. American Express and Discover often cost more than Visa and Mastercard. If you process a $100 sale, you might pay $2.50 to $3.00 in fees.
Some gateways charge a monthly fee ($10 to $30) whether you process transactions or not. Others charge nothing monthly but take a higher percentage. A few charge setup fees or early termination fees. Read the contract carefully because these add up quickly if you process high volume. A business doing $50,000 a month in sales will pay $1,000 to $1,500 in gateway fees alone.
You also pay for PCI compliance — the security standard that protects card data. If your gateway handles this for you (which most do), the cost is built into your transaction fee. If you handle it yourself, you pay a separate compliance fee to a third party.
Online gateways versus in-person terminals
An online gateway is software that sits on your website or in your shopping cart. The customer never leaves your site to enter their card details. Examples include Stripe, Authorize.net, and PayPal Commerce. These are the cheapest option and the easiest to set up — many take 15 minutes to activate.
An in-person gateway is hardware: a card reader that plugs into your phone or tablet, or a standalone terminal that sits on your counter. Square Reader, Toast, and Clover are common examples. These let you accept cards when the customer is physically present. The hardware usually costs $50 to $300 upfront, and the per-transaction fees are often slightly higher than online gateways.
Phone and mail order gateways let you enter the card details yourself on behalf of the customer. These are the most expensive option because the risk of fraud is highest — the customer is not present to verify their identity. You will pay higher fees and may need to key-enter the card manually, which is slower.
Security and PCI compliance
A payment gateway's main job is to keep card data safe. It does this by encrypting the information the moment it enters the system, so even your own employees cannot see the full card number. The gateway also uses tokenization — it replaces the card number with a random code that only the gateway understands. Your system stores the token, not the card number.
This setup means you do not have to worry about storing sensitive data yourself. If a hacker breaks into your server, they get tokens, not card numbers. The gateway is responsible for protecting the actual card data, and gateways are built to withstand attacks.
You still have to follow PCI compliance rules, which means keeping your website updated, using strong passwords, and not storing card data in plain text. Most gateways handle the heavy lifting, but you cannot ignore security entirely. If you are unsure whether your setup is compliant, ask your gateway provider — they can tell you what you need to do.
Choosing a gateway for your business
Start by deciding where you accept payments: online only, in-person only, or both. If you are online only, Stripe and Authorize.net are industry standard and work with almost any shopping cart. If you are in-person only, Square and Toast are easiest because they are designed for small businesses and require minimal setup. If you do both, look for a provider that handles both channels in one dashboard.
Next, compare fees across three or four providers. Do not just look at the percentage — add up the monthly fee, the per-transaction fee, and any other charges. Calculate what you would pay on a typical month of your sales. A gateway that looks cheap at 2 percent might cost more than one at 2.5 percent if the cheap one charges $25 a month and the other does not.
Finally, test customer support. Call or email with a question and see how fast they respond. If something breaks on a Friday night, you want to know someone will pick up the phone. Read reviews from other businesses in your industry — what works for a coffee shop might not work for a consulting firm.
Frequently Asked Questions
Do I need a separate merchant account if I use Stripe or PayPal?
No. Stripe and PayPal both provide the merchant account as part of their service. The money goes directly into your bank account. With other gateways like Authorize.net, you usually need to set up a merchant account separately, often through your bank or a payment processor.
What happens if a customer disputes a charge?
The customer contacts their bank and files a chargeback. The gateway notifies you, and you have a window (usually 7 to 10 days) to respond with proof that the transaction was legitimate — an order confirmation, shipping receipt, or email from the customer. If you cannot prove it, the money is refunded to the customer and you lose the sale plus a chargeback fee.
Can I use the same gateway for multiple locations or stores?
Yes. Most gateways let you create multiple locations in one account and see all transactions in one dashboard. Some charge per location, others do not. Check with your provider about their multi-location pricing before you set up.
What is the difference between a gateway and a payment processor?
A payment processor is the company that moves the money between banks. A gateway is the tool that captures the card data. Some companies do both — Stripe is both a processor and a gateway. Others do one or the other. For your purposes, the distinction does not matter much; what matters is that you have a tool to accept cards and a way to get the money into your account.
How long does it take for money to show up in my account after a sale?
Usually one to three business days, depending on your bank and your gateway. Weekends and holidays do not count. Some gateways offer faster settlement for an extra fee. Check your contract to see what the standard timeline is for your provider.