How Credit Card Payment Gateways Work and Where Your Money Goes
What a payment gateway does with your card information
A payment gateway is the technology that sits between you, the merchant, and your bank when you swipe, tap, or type your card number online or in person. It does not hold your money or your card details — it passes them along securely to the right places and tells the merchant whether the transaction went through.
When you enter your card at checkout, the gateway encrypts that information and sends it to a processor, which contacts your bank to check whether you have enough available credit or funds. Your bank says yes or no within seconds. The processor then tells the gateway, the gateway tells the merchant, and the merchant either completes the sale or declines it. Your card number itself never sits on the merchant's computer.
The gateway also handles the back-and-forth if something goes wrong — a declined card, a fraud flag, a chargeback months later. It is the messenger and the record-keeper, not the decision-maker.
Key Takeaways
- Payment gateways encrypt your card data and route it to your bank for approval, but they do not store your card number on the merchant's system.
- The entire approval process happens in seconds and involves your bank, a processor, and the gateway — each checking a different piece of the transaction.
- Gateways charge merchants a fee (usually 2 to 3 percent of the sale), which is why some businesses offer discounts for cash or have minimum purchase amounts for cards.
- If you dispute a charge later, the gateway and processor handle the chargeback process between you and the merchant, not the merchant alone.
- Different gateways have different security standards, but all are required to meet PCI compliance, which means your card data is encrypted in transit.
How the payment flows from your card to the merchant's account
The money does not move instantly. When you complete a purchase, the gateway approves the transaction in real time, but the actual transfer of funds takes one to three business days. Here is what happens in that window.
First, the merchant's bank (called the acquiring bank) receives a batch of all the day's transactions from the processor. The processor has already deducted its fee and the gateway's fee from the total. The acquiring bank then deposits what remains into the merchant's account, usually by the next business day or the one after.
Your own bank (the issuing bank) pulls the money from your account on a similar timeline, though the exact day depends on whether you used a debit card, a credit card, or a bank account. With a credit card, the charge appears on your statement immediately, but your bank does not actually move the money until the card network (Visa, Mastercard, American Express) settles the batch — usually overnight.
This delay is why a merchant can still cancel a transaction within a few hours of the sale, but after settlement, they have to issue a refund instead of reversing the charge.
What fees the gateway charges and who pays them
The merchant pays the gateway fee, not you directly. But that cost gets built into prices, so you pay it indirectly through higher prices or minimum purchase requirements.
Gateway fees vary widely depending on the type of business and the payment method. A typical online retailer pays 2 to 3 percent of each transaction plus a small flat fee (often 30 cents). A restaurant or grocery store using a point-of-sale terminal might pay 1.5 to 2.5 percent. A nonprofit or charity might negotiate lower rates. Businesses that process high volumes can sometimes negotiate better terms.
The fee covers the gateway's cost to encrypt and route your data, maintain the servers, handle disputes, and comply with security regulations. Some gateways also charge a monthly account fee or a per-transaction minimum, especially for small businesses.
If you use a digital wallet like Apple Pay or Google Pay, the fee is the same — the gateway does not charge less because your card data is tokenized (stored as a code rather than the full number).
Why some merchants ask you to pay a surcharge or offer cash discounts
Some businesses pass the gateway fee directly to you as a surcharge, or they offer a discount if you pay with cash or a check. This is legal in most states, but the rules vary.
In most of the United States, a merchant can charge you a surcharge for using a credit card, as long as they disclose it before you complete the purchase and the surcharge does not exceed the actual fee they paid (usually capped at 4 percent). A few states — California, Colorado, Connecticut, Florida, Kansas, Maine, Massachusetts, New York, Oklahoma, and Texas — have restrictions or bans on surcharges, though some allow them for certain card types.
A cash discount is different: the merchant lowers the price for cash and charges the regular price for cards. This is legal everywhere. The difference is psychological — a discount feels voluntary, while a surcharge feels like a penalty — but the math is the same.
Debit card surcharges are more restricted. Federal law caps the surcharge on debit cards at 0.05 percent of the transaction, which is so small that most merchants do not bother.
How the gateway protects your card information
The gateway uses encryption to scramble your card number so that it cannot be read if someone intercepts it in transit. When you see a padlock icon or "https" in the address bar, that means the connection between your browser and the merchant's website is encrypted.
But encryption is only part of the picture. The gateway also has to meet PCI DSS compliance (Payment Card Industry Data Security Standard), a set of rules created by Visa, Mastercard, American Express, and other card networks. PCI compliance requires the gateway to use firewalls, change default passwords, monitor for unauthorized access, and never store your full card number after the transaction is complete.
Most gateways use tokenization for repeat customers: instead of storing your card number, they store a token — a random code that only the gateway can decode. If a hacker steals the token, it is useless without the gateway's decryption key. This is why your card number does not appear in your email receipt or on the merchant's invoice.
You are also protected by your bank's fraud monitoring. If a charge looks suspicious — a purchase in a different country, a sudden spike in spending, a card-not-present transaction from an unusual location — your bank can flag it and contact you before the transaction settles.
What happens if you dispute a charge
If you see a charge you do not recognize or a purchase that never arrived, you contact your bank, not the merchant directly. Your bank then files a chargeback with the processor, which notifies the merchant's bank and the gateway.
The merchant has a window (usually 7 to 10 days) to respond with evidence that the transaction was legitimate — a signed receipt, a tracking number, an email confirmation from you, or proof of delivery. If the merchant provides that evidence and your bank agrees it is valid, the chargeback is denied and the charge stays on your account. If the merchant does not respond or the evidence is weak, the chargeback is upheld and the money is returned to you.
The gateway does not decide the dispute — it just passes documents back and forth. But it does keep a record of chargebacks for each merchant. A merchant with too many chargebacks (the threshold varies by card network, but is often 1 percent of transactions) can lose their ability to accept cards altogether.
Different types of gateways and how they work differently
Not all payment gateways are the same. Some are owned by banks, some by payment processors, and some by independent companies. The type affects how fast transactions settle and what features are available.
Hosted gateways redirect you to a secure page owned by the gateway (not the merchant's website) to enter your card information. This is the safest option for small merchants because the merchant never touches your card data. Examples include PayPal and Square.
Self-hosted gateways let the merchant collect your card information on their own website, but they have to meet stricter PCI compliance requirements and maintain their own security. Large retailers often use this model.
API gateways let a merchant's software communicate directly with the gateway's servers. This is common for subscription services and apps that need to charge you repeatedly without asking for your card each time.
Regardless of type, all gateways must encrypt your data and comply with PCI standards. The difference is mainly in convenience and cost — hosted gateways are easier for small businesses but may charge higher fees, while self-hosted gateways give more control but require more technical expertise.
Frequently Asked Questions
Can a merchant see my full card number after I complete a purchase?
No. PCI compliance rules require the gateway to strip the full card number from the merchant's records within 24 hours. The merchant's receipt and invoice show only the last four digits. If the merchant claims they need your full number for a refund or dispute, that is a red flag — they should only need the last four digits and the original transaction ID.
Why does my bank show a pending charge that disappears and then reappears?
Pending charges are authorizations, not actual withdrawals. The gateway reserves the money to make sure you have available credit, but the charge does not settle (actually move from your account) until the merchant submits the batch, usually within 24 hours. If the merchant cancels the transaction before settlement, the pending charge disappears. Once it settles, it becomes permanent and can only be reversed by refund.
What is the difference between a payment gateway and a payment processor?
A gateway is the technology that encrypts and routes your card data. A processor is the company that actually contacts your bank and handles the settlement. Many companies do both, which is why the terms are sometimes used interchangeably, but they are technically different functions. The gateway is the messenger; the processor is the one who delivers the message to the bank.
Do I have to pay a fee to use a payment gateway as a customer?
Not directly. The merchant pays the gateway fee. However, some merchants pass that fee to you as a surcharge or build it into their prices. A few states restrict or ban surcharges, but most allow them if disclosed at checkout.
Is it safer to use a digital wallet like Apple Pay than to enter my card number?
Both are secure, but digital wallets add an extra layer. When you use Apple Pay or Google Pay, the gateway receives a token instead of your actual card number, and your phone requires biometric authentication (fingerprint or face recognition) before the payment goes through. Entering your card number directly is also encrypted, but the gateway does see the full number temporarily. For fraud prevention, digital wallets are slightly safer, but the difference is small if the merchant uses a reputable gateway.