How Ecommerce Payment Gateways Work and What Happens to Your Money
What an ecommerce payment gateway does
An ecommerce payment gateway is the system that captures card information from a customer's browser, encrypts it, and sends it to the bank that issued the card for approval or denial. It sits between your website and the financial institutions that actually move the money. The gateway does not hold the money—it authorizes the transaction, then passes the result back to your site in seconds. If approved, the funds move from the customer's bank to your merchant account, usually within one to three business days.
The gateway is also responsible for security. It encrypts the card data so your website never sees the full number, which protects both you and the customer. Most gateways comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules that card networks require. If you use a gateway that handles encryption, you avoid storing sensitive card data on your own servers—a major liability if your site is breached.
The gateway charges you a fee for each transaction, usually a percentage of the sale plus a flat amount per transaction. This fee goes to the gateway company, not to the bank. You will also pay separate fees to your merchant account provider and possibly to the card networks themselves, depending on your setup.
Key Takeaways
- A payment gateway encrypts card data, sends it to the customer's bank for approval, and returns the result to your site—all in seconds.
- The gateway does not hold money; it authorizes transactions and passes funds to your merchant account, which deposits them into your bank account within one to three business days.
- You pay the gateway a per-transaction fee (usually a percentage plus a flat amount) separate from fees charged by your merchant account provider or bank.
- Hosted gateways (where the customer enters card data on the gateway's own page) are simpler to set up and shift more security responsibility to the gateway company.
- API gateways (where card data enters your site directly) give you more control over the checkout experience but require you to meet stricter security standards.
Hosted gateways versus API gateways
A hosted gateway redirects the customer to a payment page owned and operated by the gateway company. The customer enters their card details there, not on your site. When payment is complete, the customer is sent back to your site with a confirmation. This approach is simpler to set up because you do not have to handle card data at all—the gateway company manages the encryption and security. Your site only needs to send the customer to the gateway and receive the result.
An API gateway lets the customer enter card information directly into your checkout form, which stays on your site. Your site collects the data and sends it to the gateway's servers via a secure connection. This keeps the checkout experience on your domain and can feel more seamless to the customer, but it requires you to meet stricter security standards. You must use HTTPS encryption, validate your code regularly, and often undergo security audits. The liability is higher if something goes wrong.
Most small to medium ecommerce businesses start with a hosted gateway because the setup is faster and the security burden is lighter. Larger businesses or those with high transaction volume often use API gateways to customize the checkout experience and integrate payment processing more deeply into their systems.
How money moves from the customer to your bank account
When a customer submits their card at checkout, the gateway sends the card number, expiration date, and security code to the customer's card-issuing bank (Visa, Mastercard, American Express, or Discover). The bank checks whether the card is valid, whether the account has sufficient funds, and whether the transaction matches the customer's typical spending pattern. This happens in real time, usually within two to five seconds.
If the bank approves the transaction, it places a temporary hold on the customer's account for that amount. The gateway returns an approval code to your site, and your checkout page shows a confirmation. The customer's bank does not immediately transfer the money—it just reserves it. At this stage, the transaction is authorized but not yet settled.
Settlement happens later, usually at the end of the business day. Your gateway batches all approved transactions from the day and submits them to the card networks for final processing. The card networks instruct the customer's bank to actually move the money from their account to your merchant account. This transfer typically takes one to three business days, depending on your bank and the customer's bank. Once the money arrives in your merchant account, your bank deposits it into your regular business checking account according to your deposit schedule.
If a customer disputes a charge or requests a refund, the money can be returned to their account. Refunds usually process within three to five business days, though the customer's bank may take longer to credit the money back to their card.
Transaction fees and how they are charged
The gateway charges you a fee for each successful transaction. This fee is typically a percentage of the sale amount plus a flat per-transaction fee. For example, a gateway might charge 2.9% plus $0.30 per transaction. On a $100 sale, you would pay $3.20 to the gateway. This fee is deducted from the money that reaches your merchant account, so you receive $96.80.
Different gateways charge different rates, and rates often vary based on how the card is processed. A card present transaction (where the customer is physically in front of you and you swipe or insert their card) usually has a lower rate than a card-not-present transaction (online or phone). Some gateways charge higher rates for international cards or for certain industries like nonprofits or high-risk merchants.
You may also pay a monthly gateway fee, a batch fee, or a chargeback fee if a customer disputes a transaction. Read the gateway's pricing page carefully—fees can add up quickly if you process many small transactions. Some gateways offer flat-rate pricing (a single percentage for all transactions) while others use tiered pricing (different rates depending on card type or transaction size).
Security and compliance requirements
If you use a hosted gateway, the gateway company is responsible for PCI compliance. Your site does not handle card data, so your compliance burden is minimal. You still need to use HTTPS on your site and keep your software updated, but you do not need to undergo security audits or maintain a secure server environment for payment data.
If you use an API gateway, you are responsible for meeting PCI DSS standards. This means your site must use HTTPS encryption, your servers must be protected by a firewall, your code must be regularly tested for vulnerabilities, and you must document your security practices. Depending on your transaction volume, you may need to undergo an annual security audit by a may have access to assessor. Failure to comply can result in fines from the card networks, sometimes thousands of dollars per month.
Some gateways offer tokenization, which stores a reference to the customer's card instead of the card number itself. When the customer makes a repeat purchase, you send the token to the gateway instead of asking for their card again. This reduces your PCI burden because you never store the actual card number. Tokenization also makes recurring billing and subscription payments easier to manage.
Choosing between major gateway providers
The largest gateway providers are Stripe, Square, PayPal, Authorize.net, and Braintree. Each has different strengths depending on your business type and size.
Stripe is popular with online retailers and software companies. It offers both hosted and API options, has straightforward per-transaction pricing (2.9% + $0.30 for online cards), and integrates easily with most ecommerce platforms. Stripe requires you to have a U.S. bank account and a business tax ID.
Square is known for in-person payment processing but also offers online payment links and a full ecommerce platform. Square charges 2.9% + $0.30 for online transactions and is simpler to set up than Stripe, though it offers less customization for complex checkout flows.
PayPal offers both a hosted gateway (PayPal Checkout) and an API gateway (Braintree, which PayPal owns). PayPal Checkout is easy to set up and lets customers pay with their PayPal account or a card. Braintree is better for businesses that need deeper customization and recurring billing.
Authorize.net is one of the oldest gateway providers and is popular with established businesses. It offers both hosted and API options and has more flexible pricing than Stripe or Square, but the setup is more technical and the user interface is less modern.
Before choosing a gateway, check whether it integrates with your ecommerce platform (Shopify, WooCommerce, BigCommerce, etc.). Most major platforms have built-in integrations with the largest gateways, which makes setup much faster. Also compare pricing for your expected transaction volume and card mix, and check whether the gateway supports the countries and currencies you need.
What happens if a transaction is declined
A transaction can be declined for several reasons: insufficient funds, a mismatched address or security code, a card that has expired, or a card that the bank suspects is fraudulent. When a decline happens, the gateway returns a decline code to your site immediately. Your checkout page should show the customer a clear message explaining why the transaction failed and asking them to try again with a different card or updated information.
A declined transaction does not charge the customer and does not appear on their statement. It also does not count against your transaction volume for pricing purposes—you only pay the gateway fee for transactions that are actually approved. However, some gateways charge a small fee for declined transactions if they are declined for reasons other than insufficient funds.
If a customer's transaction is declined multiple times, the card network may flag the card as compromised or the customer's bank may temporarily block the card. Advise the customer to contact their bank if they believe the decline is an error.
Frequently Asked Questions
How long does it take for money to show up in my bank account after a customer pays?
The transaction is authorized in seconds, but settlement takes longer. Your gateway batches transactions at the end of the day and submits them to the card networks. The actual transfer from the customer's bank to your merchant account usually takes one to three business days. Your bank may then take an additional day to deposit the money into your checking account. Weekends and holidays can add extra days.
What is the difference between authorization and settlement?
Authorization happens when the customer's bank approves the transaction and places a hold on their account. Settlement happens later when the money actually moves from their account to yours. You can authorize a transaction without settling it (for example, if you want to verify the card is valid but not charge it yet), though most online checkouts authorize and settle in one step.
Do I have to use the same gateway as my ecommerce platform?
No. Most ecommerce platforms allow you to choose from multiple gateways. Shopify, for example, lets you use Stripe, Square, PayPal, or dozens of others. However, using the platform's recommended gateway is often simpler because the integration is already built in. Using a third-party gateway may require additional setup or custom code.
What happens if a customer requests a refund?
You initiate a refund through your gateway's dashboard. The gateway sends a refund request to the customer's bank, which reverses the original charge. The money is returned to the customer's card, usually within three to five business days. You are charged a small refund fee by the gateway, typically the same per-transaction fee as the original sale.
Can I process payments without a merchant account?
No. A merchant account is required to accept card payments. The merchant account is a special bank account that holds the money from card transactions before it is deposited into your regular business account. Some gateways (like Stripe and Square) set up a merchant account for you automatically when you sign up. Others require you to open a merchant account separately through your bank or a payment processor.