What Is a Payment Gateway? How Online Payments Work
A payment gateway is the service that securely captures a customer's card details at checkout, sends them to the card networks for approval, and returns an approve-or-decline answer in about two seconds. It is the online equivalent of a card terminal. Modern providers like Stripe, Square, and PayPal bundle the gateway, processor, and merchant account into one service, typically charging US merchants around 2.9% plus 30 cents per online transaction.
- Stripe online card rate
- 2.9% + 30¢ per successful US card charge (Stripe published pricing)
- Square online rate
- 2.9% + 30¢ per online transaction (Square published pricing)
- PayPal standard checkout
- About 3.49% + fixed fee for standard online checkout (PayPal published pricing)
- Typical chargeback fee
- Roughly $15-$25 per dispute, in addition to the refunded sale (industry-reported range)
The Short Version: What a Gateway Actually Does #
A payment gateway is software that stands between your checkout page and the banking system. When a customer types in a card number, the gateway encrypts those details, packages them into a request the card networks understand, and carries the approve-or-decline answer back to your store. Without one, your website has no legal or technical way to accept a card. Think of it as the card reader at a retail counter, rebuilt for the internet. Twenty years ago you had to assemble a gateway, a payment processor, and a merchant account from three different vendors. Today, providers like Stripe, Square, PayPal, and Braintree bundle all three into a single account you can open in an afternoon. That bundling is why most small US stores never think about the individual pieces, but understanding them still matters when you compare fees, negotiate rates, or troubleshoot a settlement delay.
What Happens in the Two Seconds After a Customer Clicks Pay? #
Here is the whole flow in plain English. 1) The customer submits card details on your checkout page, and the gateway encrypts them immediately. 2) The gateway forwards the transaction to the payment processor, which routes it onto the card network, such as Visa or Mastercard. 3) The network asks the customer's bank, called the issuing bank, whether the card is valid and has funds. 4) The issuing bank runs fraud checks and answers approve or decline. 5) That answer travels back through the network and gateway to your website, which shows a confirmation or an error. All of this typically finishes in one to three seconds. The money itself moves later: approved transactions are batched and settled into your bank account, usually within one to two business days for major US providers.
Gateway vs. Processor vs. Merchant Account: Who Does What? #
These three terms get mixed up constantly, so here is the clean separation. The gateway is the front door: it captures and encrypts card data on your website. The processor is the courier: it moves transaction data between the card networks and the banks. The merchant account is the holding tank: a special bank account where approved funds sit before settling into your regular business checking account. Traditional setups required you to apply for each separately, complete with underwriting paperwork and monthly minimums. Modern aggregators like Stripe and Square act as the merchant of record and pool merchants under their own master account, which is why signup takes minutes instead of weeks. The trade-off is slightly less pricing flexibility and the small risk of automated account holds if your sales pattern suddenly looks unusual to their fraud systems.
What Do Payment Gateways Cost a US Small Business? #
Expect three categories of cost. First, per-transaction fees: Stripe and Square both charge 2.9% plus 30 cents for standard online card payments, while PayPal's standard checkout runs about 3.49% plus a fixed fee. On a $50 order, that is roughly $1.75 to $2.05. Second, situational fees: currency conversion, instant payouts, disputes, and premium fraud tools each add a percentage or flat charge. Third, hidden costs: some platforms, notably Shopify when you use an outside gateway, add their own transaction surcharge on top. There are usually no monthly fees with modern aggregators, which is ideal for stores under roughly $10,000 per month in volume. Above that, interchange-plus pricing from a traditional merchant account can shave 0.3% to 0.8% off your effective rate, which becomes real money at scale.
Hosted Checkout vs. Embedded Checkout #
There are two ways to put a gateway on your site. A hosted checkout redirects the customer to a payment page run by the provider, then returns them to your site after payment. It is the fastest to set up and the safest, because card data never touches your server. An embedded checkout keeps customers on your domain using secure iframes or drop-in components, which converts better because the experience feels seamless, but it requires more careful integration. A minimal hosted example looks like this.
<form action="/create-checkout-session" method="POST">
<input type="hidden" name="item" value="sku_1234" />
<button type="submit">Pay $49.00</button>
</form>
<!-- Server redirects to the gateway's secure page,
then back to /thank-you on success -->Chargebacks: The Cost Nobody Budgets For #
A chargeback happens when a customer disputes a charge with their bank instead of asking you for a refund. The bank pulls the money back from your account immediately, and your gateway adds a dispute fee, typically $15 to $25, whether you win or lose. You can fight a chargeback by submitting evidence such as delivery confirmation, order records, and customer communication, but issuing banks side with cardholders more often than not. Prevention beats disputing: use a recognizable billing descriptor so customers know the charge is yours, require address and CVC verification, ship with tracking, and answer support emails fast, since many disputes start as unanswered refund requests. Watch your dispute rate closely. Card networks flag merchants above roughly 1% of transactions, and sustained high rates can get your account placed in a monitoring program or terminated.
Security and Your PCI Scope #
Every business that accepts cards must comply with PCI DSS, the card industry's security standard, and your gateway choice largely determines how heavy that burden is. If you use a hosted checkout or the provider's official embedded components, card numbers never touch your server, and you qualify for the shortest self-assessment questionnaires. If you build a custom form that posts card data to your own backend, you inherit the full weight of the standard, including network scans and extensive documentation. For nearly every small store, the right answer is to let the gateway handle card data entirely. Your remaining job is keeping the rest of the site secure: HTTPS everywhere, updated software, strong admin passwords, and no card numbers stored in email or spreadsheets. Our website security services cover exactly this perimeter for store owners who want it handled.
How Do You Choose a Gateway for a Small Store? #
Match the gateway to how you actually sell. 1) Platform fit: Shopify stores should default to Shopify Payments to avoid surcharges; WooCommerce pairs naturally with Stripe or Square. 2) Payment methods: confirm support for Apple Pay, Google Pay, and, if your margins allow, buy-now-pay-later options, since wallet payments measurably lift mobile conversion. 3) Payout speed: standard is one to two business days; some providers offer instant payouts for an extra fee. 4) Dispute tooling: built-in fraud screening like Stripe Radar saves real money. 5) Industry restrictions: CBD, supplements, firearms accessories, and other regulated categories are prohibited by mainstream aggregators and need a specialist high-risk provider. 6) Support quality: when a payout is frozen, you want a phone number, not a ticket queue. For most US small stores, Stripe, Square, or PayPal is the correct starting point.
When to Bring in Help #
Most owners can open a Stripe or Square account on their own. Where projects go sideways is integration: webhooks that silently fail and never mark orders paid, tax and shipping calculated after authorization, double charges from misconfigured retries, or checkout flows that leak sales on mobile. If your payment setup involves subscriptions, multi-currency sales, marketplaces, or a migration between gateways, that is squarely what our e-commerce development service exists for. We design the checkout, wire up the gateway correctly, and test the failure paths that only show up in production. Not sure where your store stands today? Run it through our free Website Grader for a snapshot of speed, security, and checkout health, and use our free ADA Compliance Checker to confirm the checkout is usable for every customer, including those on screen readers.
FAQ
Do I need a merchant account to sell online?
Not a separate one, in most cases. Aggregators like Stripe, Square, and PayPal include merchant account functionality inside their service, so you sign one agreement and start selling. A dedicated merchant account only makes sense once your volume is high enough, often above $10,000 to $20,000 per month, that negotiated interchange-plus pricing beats flat-rate fees.
Is PayPal a payment gateway?
Yes. PayPal bundles a gateway, processor, and merchant account into one service, just like Stripe and Square. It also brings its own wallet: customers can pay from a PayPal balance or linked bank account. Many stores offer PayPal alongside a card gateway because a meaningful share of shoppers simply trust and prefer the PayPal button at checkout.
How long until the money reaches my bank account?
Approved card payments typically settle into your bank account within one to two business days with Stripe or Square, and new accounts sometimes see a slightly longer first payout while the provider verifies your business. Instant payout options exist for an added fee, usually around 1% to 1.5% of the payout amount.
Can I pass card fees on to customers?
Surcharging is legal in most US states but heavily regulated: card network rules generally cap surcharges at your actual cost of acceptance, require disclosure before payment, and prohibit surcharging debit cards. A few states restrict it further. Many small stores find a modest across-the-board price adjustment simpler and friendlier than an explicit card fee at checkout.
What is the difference between authorization and capture?
Authorization checks the card and places a hold on the funds; capture actually collects the money. Most stores capture immediately at checkout. Separating the two is useful when you charge only at shipment or need to verify inventory first. Holds expire, typically within about seven days for card networks, so capture promptly or the authorization lapses.
Which gateway is best for a brand-new store?
For most new US stores, Stripe or Square offers the cleanest combination of flat pricing, no monthly fees, strong fraud tools, and easy platform integration. If you sell on Shopify, use Shopify Payments to avoid extra surcharges. Add PayPal as a second option since some customers strongly prefer it. Revisit pricing once you pass roughly $10,000 in monthly volume.
Was this helpful?