What a payment gateway does
A payment gateway is the technology that processes credit card, debit card, and digital wallet payments when someone buys something from you online or in person. It sits between your customer, their bank, your bank, and the card networks (Visa, Mastercard, American Express) — moving money and information securely so the transaction actually completes.
If you're selling something — whether that's rental property management services, home repair invoices, or goods through a website — the gateway is what lets you accept payment without handling the card details yourself. The gateway encrypts the card information, sends it to the customer's bank to verify funds are available, and tells you whether the charge went through or was declined.
You don't own or operate the gateway. You contract with a payment processor (like Square, Stripe, PayPal, or your bank) who provides the gateway as part of their service. The processor takes a small cut of each transaction — usually 2 to 3 percent plus a per-transaction fee — in exchange for handling all the security, compliance, and bank connections.
Key Takeaways
- A payment gateway encrypts card data and routes it between your customer's bank and yours, so you never see or store the raw card number.
- Payment processors charge a percentage of each transaction (typically 2 to 3 percent) plus a small flat fee per transaction, and these rates vary by processor and payment method.
- In-person gateways (card readers) and online gateways (website checkout) are different products, though many processors offer both.
- PCI compliance — a security standard for handling card data — is mandatory by law, and using a gateway-provided checkout form handles most of it for you.
- Choosing a gateway depends on your volume, the payment methods you want to accept, and whether you need in-person, online, or both.
How the money actually moves
When a customer enters their card information into your checkout form or card reader, the gateway encrypts it immediately. That encrypted data goes to the payment processor, who sends it to the customer's bank (the issuing bank) to check whether the account has sufficient funds and whether the card is valid.
The issuing bank approves or declines the charge and sends that response back through the processor to your gateway, which displays the result to your customer in seconds. If approved, the money doesn't arrive in your account instantly — it settles in your merchant account (usually within one to three business days), and then your bank deposits it into your regular business checking account.
During that settlement window, the processor and card networks take their cut. A typical breakdown on a $100 transaction might be: processor takes $2.50 (2.5 percent) plus $0.30 (flat fee), leaving you $97.20. The exact rate depends on your processor, your contract, the card type (debit cards often cost less than credit cards), and your monthly volume.
In-person versus online gateways
An in-person gateway is a physical card reader (like a Square Reader or Clover device) that connects to your phone or tablet. You tap, insert, or swipe the customer's card, and the reader processes the payment on the spot. This is what you use if you're collecting payment face-to-face — for a service call, a cash-and-carry transaction, or a pop-up sale.
An online gateway is a checkout form embedded in your website or sent via invoice link. The customer enters their card details into that form, which is hosted securely by your processor. You never see the card number — the gateway handles it end-to-end. This is what you use for e-commerce, subscription billing, or invoiced services.
Many processors (Stripe, Square, PayPal) offer both, so you can accept payments however your customers prefer. Some charge the same rate for both; others charge slightly more for in-person transactions because the fraud risk is lower (the card is physically present). A few processors specialize in only one or the other, so check before signing up.
Security and PCI compliance
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that anyone handling card data must follow. The rules exist to prevent card theft and fraud. If you use a gateway-provided checkout form or card reader, the processor handles most of the compliance burden for you — they encrypt the data, store it securely (if at all), and manage the security audits.
If you try to collect card data yourself — storing card numbers in email, spreadsheets, or your own database — you become responsible for PCI compliance, which means expensive security audits, encryption systems, and liability if a breach happens. This is why using a gateway is not just convenient; it's legally safer.
The gateway encrypts card information the moment it enters the system, so neither you nor your processor ever sees the full card number in plain text. Even if someone hacks your website or your processor's servers, the card data is useless without the encryption key.
Choosing between processors and gateways
The major processors differ in fees, features, and ease of setup. Square and PayPal are simple to start with and charge straightforward rates (around 2.6 percent plus $0.10 per transaction for online, slightly higher for in-person). Stripe is popular with developers and e-commerce sites because it integrates deeply with custom websites. Authorize.net is older and works well for invoicing and recurring billing. Your bank may also offer a gateway as part of a merchant account.
Consider your volume: if you process fewer than 10 transactions a month, a simple processor like Square or PayPal is usually cheaper than a traditional merchant account with setup fees and monthly minimums. If you process hundreds of transactions monthly, you may negotiate better rates with a dedicated processor or your bank.
Consider your payment methods: do you need to accept only credit cards, or also digital wallets (Apple Pay, Google Pay), ACH transfers, or international cards? Not all gateways support all methods. Consider your industry: some processors charge more for high-risk businesses (like home renovation contractors with high chargeback rates) or won't work with certain industries at all.
Fees and what they cover
A typical online transaction costs you 2.2 to 3.5 percent of the sale plus $0.30 to $0.50 per transaction. In-person transactions usually cost 2.2 to 2.9 percent plus $0.10 to $0.25. These rates vary by processor, card type (American Express often costs more), and your monthly volume.
Beyond per-transaction fees, some processors charge monthly account fees ($0 to $50), PCI compliance fees ($5 to $15 per month), or fees for features like invoicing, recurring billing, or customer support. Read the full fee schedule before signing up — a processor with a lower per-transaction rate might make up for it with hidden monthly charges.
Chargebacks (when a customer disputes a charge and their bank reverses it) usually cost $15 to $100 per chargeback, and you lose the original sale amount too. This is why fraud prevention and clear refund policies matter — they reduce chargebacks and protect your bottom line.
Setting up a gateway for your business
If you're selling online, start by choosing a processor and signing up for a merchant account. You'll provide your business name, tax ID, bank account details, and a brief description of what you sell. Most processors approve you within 24 to 48 hours. Then you integrate their gateway into your website (or use their hosted checkout form if you don't have a website) and start accepting payments.
If you're collecting payments in person, download the processor's app, plug in a card reader, and you're ready to go. Square and PayPal let you start accepting payments the same day you sign up, with money depositing into your bank account within one to three business days.
Keep records of every transaction for tax and accounting purposes. Most gateways provide transaction reports and can integrate with accounting software like QuickBooks, which saves you time at tax time.
Frequently Asked Questions
Do I need a separate merchant account and a gateway?
Not necessarily. A merchant account is a bank account that holds money from card sales before it settles into your regular checking account. Many modern processors (Square, Stripe, PayPal) bundle the merchant account and gateway together, so you sign up once and money goes straight to your bank. Traditional processors sometimes charge separately for each, so ask before committing.
What happens if a customer disputes a charge?
The customer contacts their bank and claims the charge was fraudulent or the service wasn't delivered. The processor notifies you and gives you a window (usually 7 to 10 days) to respond with evidence — an invoice, receipt, email confirmation, or shipping proof. If you respond with proof the charge was legitimate, you usually keep the money. If you don't respond or your evidence is weak, the bank reverses the charge and you lose the sale plus a chargeback fee.
Can I accept payments without a gateway?
Technically yes, but it's risky and illegal in most cases. You could ask customers to mail you a check or transfer money via bank account, but you'd lose the speed and convenience of card payments. Trying to collect card data yourself without proper encryption and compliance puts you in violation of PCI rules and exposes you to massive liability if a breach happens. A gateway is the safe, legal way.
Do I pay the gateway fee even if a transaction is declined?
No. If a customer's card is declined, the transaction doesn't go through and you don't pay a processing fee. You may pay a small authorization fee (usually $0.05 to $0.10) just to check whether the card is valid, but the main percentage fee only applies to successful charges.
Can I switch processors later if I'm unhappy?
Yes. There are no long-term contracts with most modern processors — you can stop using them whenever you want. The hard part is migrating your transaction history and customer data if you've been using their invoicing or subscription tools. Plan the switch during a slow period and give yourself time to test the new processor before going live.