How Online Stores Process Customer Payments

What happens when a customer buys something online

When someone enters their card number on your checkout page, that information does not go directly into your bank account. Instead, it travels through a chain of companies—each one checking that the card is real, the funds exist, and the transaction is not fraud. You receive the money, minus fees, usually within one to three business days. Understanding this chain matters because each step has costs, rules, and points where a transaction can fail or get flagged.

The speed and cost of this process depend on which payment processor you use, what type of card the customer swipes or enters, and whether you are selling physical goods or digital ones. A small online boutique and a SaaS company both process payments, but their setups often look different because their risks look different.

Key Takeaways

• Payment processors charge a percentage of each sale (typically 2 to 3 percent) plus a per-transaction fee, and these rates vary by card type and whether the card is present or not.
• Your payment processor connects your store to the card networks (Visa, Mastercard, American Express) and your bank, but you need a separate merchant account to receive the money.
• Chargebacks happen when a customer disputes a charge with their bank instead of asking you for a refund, and they cost you the sale amount plus a fee.
• PCI compliance means your store must meet security standards set by the card networks, or you face fines and loss of payment processing ability.
• Recurring charges (subscriptions) require explicit customer consent and different processing rules than one-time purchases.

The companies involved in a single transaction

A typical online payment involves at least five separate entities. The customer's bank (the issuing bank) owns the card. Your bank (the acquiring bank) receives the money on your behalf. The payment processor is the company you contract with—Stripe, Square, PayPal, or others—and they handle the technical side: collecting the card data, sending it to the right places, and telling your store whether the transaction went through. The card networks (Visa, Mastercard, American Express, Discover) set the rules and move the money between banks. Finally, there may be a payment gateway, which is the software that sits on your website and encrypts the card number before it leaves your server.

Some processors bundle the gateway into their service. Others require you to choose a separate gateway. The processor you pick often determines which gateway options are available to you, so this choice is usually made once, at the start.

How fees work and what they cover

Online payment fees usually come in three forms. The interchange fee is set by the card networks and goes to the customer's bank—it is typically 1.5 to 2.5 percent of the sale, though it varies by card type (debit cards are cheaper than credit cards, and some business cards are more expensive). The assessment fee is a smaller percentage that goes to Visa, Mastercard, or whichever network processed the card. The processor fee is what your processor keeps, and this is where you have the most control—it is usually a flat per-transaction fee (like $0.30) plus a percentage (like 2 percent), though some processors charge a flat monthly rate instead.

A typical transaction might cost you 2.9 percent plus $0.30. On a $100 sale, that is $3.20. On a $10 sale, that is $0.59. The percentage matters more on large orders; the flat fee hurts more on small ones. Some processors offer lower rates if you process a high volume or if you accept cards in person (swiped or chip-read) rather than online, because in-person transactions are lower risk.

International cards, American Express, and certain debit cards often cost more. If you sell to customers outside the United States, ask your processor what the rate is for their country before you launch.

Chargebacks and what they cost you

A chargeback happens when a customer contacts their bank and says "I did not authorize this charge" or "I never received the item," and the bank reverses the transaction without asking you first. You lose the sale amount, plus a chargeback fee (usually $15 to $100 depending on your processor and the card network). If chargebacks climb above a certain threshold—often 0.5 to 1 percent of your total transactions—your processor can raise your rates, require you to hold a reserve, or terminate your account.

Chargebacks are not the same as refunds. A refund is when you give the customer's money back voluntarily. A chargeback is when the bank does it without your consent. You can dispute a chargeback by providing evidence (a tracking number showing delivery, an email showing the customer received the digital good, a signed receipt), but the burden is on you to prove the transaction was legitimate. For digital goods, this is harder—there is no shipping proof, so keep records of IP addresses, email confirmations, and download logs.

The best defense is clear communication: send order confirmations immediately, include a clear refund policy on your website, and respond quickly to customer complaints before they escalate to their bank.

PCI compliance and what it requires

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules created by the card networks to protect customer card data. If you store, process, or transmit card information, you must meet these standards or face fines from the networks—sometimes thousands of dollars per month. Your processor is responsible for some of this, but you are responsible for the rest.

The simplest way to stay compliant is to never touch the card number yourself. Use a payment processor or gateway that handles the encryption and storage for you. If you use a hosted payment form (like Stripe's checkout page), the card data never touches your server, and your compliance burden is much lighter. If you build your own checkout form, you must encrypt the data in transit, use HTTPS on every page, keep your server software updated, and undergo annual security audits. Most small online stores find it cheaper and safer to outsource this to a processor.

Your processor will send you a compliance questionnaire each year. Answer it honestly. If you are unsure whether you are compliant, ask your processor what level of compliance you need based on your setup—they can usually tell you in one conversation.

Recurring charges and subscription billing

If you charge customers on a schedule—monthly subscriptions, annual memberships, or installment plans—you are using recurring billing or subscription processing. This requires explicit written consent from the customer before the first charge, and you must make it easy for them to cancel. The card networks have specific rules about how often you can attempt a failed charge (usually three times over ten days) and how you must notify customers of upcoming charges.

Recurring billing has higher chargeback rates than one-time purchases, because customers sometimes forget they signed up or dispute charges they authorized months ago. Keep detailed records of when the customer consented, what they consented to, and when each charge occurred. Send a reminder email before each charge, and include a clear cancellation link in every email.

Some processors charge extra for recurring billing, or they charge a lower percentage on recurring transactions because the risk is more predictable. Ask about this when comparing processors.

Choosing between payment processors

The main trade-off is between simplicity and cost. Processors like PayPal and Square are easy to set up—you can start accepting payments in minutes—but their rates are usually higher (3 percent plus fees). Processors like Stripe and Authorize.net have lower rates but require more technical setup or integration with your shopping cart software. Some processors specialize in certain industries: Shopify Payments works best if you use Shopify, while Adyen is built for high-volume international sales.

Before you choose, compare the rate structure (percentage plus flat fee), any monthly minimums or reserves, the chargeback fee, the time to deposit (next day, two days, weekly), and whether they support the card types and countries you need. Also check whether they offer the features you need: recurring billing, invoicing, reporting, or integration with accounting software like QuickBooks.

Read the contract carefully. Some processors require you to use their gateway; others let you choose. Some have early termination fees. Some reserve the right to hold your money if chargebacks spike. These details matter more than the headline rate.

Frequently Asked Questions

How long does it take for money to show up in my bank account?

Most processors deposit funds within one to three business days. Some offer next-day deposits for a higher fee. Weekends and holidays do not count as business days, so a Friday transaction might not arrive until Tuesday. Check your processor's deposit schedule before you sign up—it matters if you have tight cash flow.

What is the difference between a payment processor and a payment gateway?

A payment gateway is the software that encrypts card data on your website. A payment processor is the company that handles the entire transaction—they connect to the gateway, the card networks, and your bank. Some companies do both; others specialize in one. You need both, but you may only sign a contract with one company.

Can I accept payments without a merchant account?

No. A merchant account is a bank account specifically for receiving card payments. Your regular business bank account cannot receive them directly. Your processor sets up the merchant account for you, usually as part of onboarding. You do not open it yourself.

What happens if a customer uses a stolen card to buy from me?

If the cardholder disputes the charge, you lose the money and pay a chargeback fee. If the charge goes through and the cardholder never complains, you keep the money. Your processor may offer fraud detection tools (like address verification or CVV checking) that catch some stolen cards before the charge goes through, but no tool catches all of them. This is why chargebacks exist—they protect customers, but they also shift some risk to you.

Do I have to offer multiple payment methods?

No, but most online stores do. Offering Visa, Mastercard, American Express, and Discover covers most customers. PayPal and Apple Pay add convenience for some. The more methods you offer, the higher your conversion rate usually is, but also the more complex your setup becomes. Start with the card networks through one processor, then add others if your data shows customers want them.