How E-Commerce Payment Systems Work and What Happens to Your Money

What an e-commerce payment system does

An e-commerce payment system is the machinery that moves money from a customer's card or bank account to your business account when someone buys something online. It is not one company or one step — it is a chain of separate organizations, each taking a small cut, each doing one specific job. Understanding who touches the money and in what order helps you choose the right system for your business and know what to expect when something goes wrong.

The basic flow is this: customer enters payment details on your website, the system encrypts that data, a processor sends it to the customer's bank, the bank says yes or no, the processor tells your website the answer, and money moves into your merchant account. That whole chain takes seconds. But the money does not arrive in your business bank account the same day — it arrives in batches, usually within one to three business days, minus fees that each player in the chain takes.

Key Takeaways

• An e-commerce payment system involves your payment processor, the customer's bank, your acquiring bank, and often a payment gateway — each one handles a different part of the transaction and takes a fee.
• Fees typically include a percentage of the sale (interchange), a flat per-transaction fee, and sometimes a monthly gateway or account fee, and they vary by card type and processor.
• Money from sales does not arrive instantly — it settles in batches, usually one to three business days later, and chargebacks can pull money back out weeks afterward.
• PCI compliance means your website and systems must meet security standards set by the card networks, or you face fines and loss of payment processing ability.
• Choosing between hosted payment pages, embedded forms, and digital wallets depends on how much control you want over the checkout experience and how much security work you want to handle yourself.

The organizations that touch your transaction

When a customer buys from you, money does not go directly from their bank to yours. It passes through at least four separate entities, sometimes five. Your payment processor is the company you sign a contract with — Stripe, Square, PayPal, Authorize.net. They are the face of the system to you, but they do not hold the money or make the yes-or-no decision. They route the transaction to the next player.

The payment gateway is the software that encrypts the customer's card details and sends them securely to the processor. Sometimes your processor owns the gateway; sometimes they are separate companies. The gateway never sees the unencrypted card number — it scrambles it before it leaves your website.

The acquiring bank (or merchant bank) is the bank that holds your merchant account — the account where your sales money lands. They are not the customer's bank; they are your bank. They have a contract with the card networks (Visa, Mastercard, American Express, Discover) that lets them accept those cards.

The issuing bank is the customer's bank — the one that holds their checking or credit card account. When the processor asks "is this card good?", the issuing bank answers yes or no and holds the money on the customer's side until settlement.

How fees work and where they come from

Every e-commerce transaction costs you money in fees. The amount depends on the card type, the processor you chose, and your contract terms. Most processors show you a breakdown, but the names vary enough that it is worth understanding what each piece is.

Interchange is the largest fee — it goes to the customer's bank (the issuing bank) and is set by the card networks, not by your processor. It is usually 1.5 to 2.5 percent of the sale, but it is higher for rewards cards, business cards, and international cards. Your processor cannot negotiate this; it is the same whether you use Stripe or Square.

Assessment fees go to Visa, Mastercard, or Discover — a small percentage (usually 0.1 to 0.15 percent) for the right to accept their cards. Again, this is set by the network, not your processor.

Processor markup is what your processor keeps. This is where competition matters. Some processors charge a flat percentage (2.9 percent plus $0.30 per transaction is common for small businesses), others charge tiered rates depending on card type, and others charge a monthly fee plus a lower per-transaction rate. Read your contract to know which model you are on.

Gateway fees are charged by some processors for the software that encrypts your checkout page — usually $10 to $30 per month. Hosted payment pages (where the customer leaves your site to enter their card) often have no gateway fee because the processor handles the security.

Monthly minimums or statement fees vary by processor and plan. Some charge nothing; others charge $20 to $50 per month just to keep the account open.

Settlement: when money actually arrives in your account

Settlement is the moment money moves from the customer's bank into your merchant account. It does not happen instantly. Here is the real timeline.

When a customer completes a purchase, the transaction is authorized — the issuing bank says the card is good and holds that amount on the customer's side. But the money has not moved yet. The transaction sits in a queue with other transactions from your store.

Once or twice per day (depending on your processor and plan), your processor batches all authorized transactions and sends them to your acquiring bank. This is called the settlement batch. The acquiring bank then sends the batch to the card networks, which send it to the issuing banks. Each issuing bank pulls the money from the customer's account and sends it to your acquiring bank.

Your acquiring bank receives the money and deposits it into your merchant account. This usually takes one to three business days from the time you batched the transaction. So a sale on Monday might not land in your account until Wednesday or Thursday. Some processors offer next-day settlement for a higher fee; some offer same-day for an even higher fee.

Once money is in your merchant account, it is yours — unless a customer disputes the charge (a chargeback). Chargebacks can happen weeks or months later, and if the customer wins, the money is pulled back out of your account and returned to them.

Chargebacks and disputes

A chargeback is a reversal initiated by the customer's bank, not by the customer directly. The customer calls their bank and says they did not recognize the charge, did not receive the item, or received something different from what was promised. The bank then pulls the money back from your merchant account and returns it to the customer.

Chargebacks can happen 30 to 180 days after the transaction, depending on the card network and the reason. You have the right to dispute the chargeback by providing evidence — a tracking number showing delivery, an email from the customer confirming the order, a signature on the package. But the burden is on you to prove the transaction was legitimate.

If you lose too many chargebacks (the threshold varies by processor, but is often 0.5 to 1 percent of your monthly volume), your processor can raise your fees, require you to hold a reserve, or close your account. This is why keeping records of orders, shipments, and customer communication matters.

PCI compliance and security requirements

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules set by Visa, Mastercard, American Express, and Discover. If you accept cards, you must follow these rules or face fines from your processor and acquiring bank.

The core rule is simple: never store unencrypted card numbers. If you use a hosted payment page (where the customer enters their card on a page you do not control), you do not touch the card data at all, so you are automatically compliant. If you use an embedded payment form on your website, the form itself is PCI-compliant — the card data is encrypted before it leaves the customer's browser.

Beyond that, you must use HTTPS (encrypted connection) on any page where payment happens, keep your software and plugins updated, use strong passwords, and monitor your systems for unauthorized access. If you are a very small business and use a hosted payment page, your compliance burden is minimal. If you build your own checkout, you need to know these rules or hire someone who does.

Fines for PCI violations start at $5,000 to $100,000 per month, depending on the violation and how long it goes unaddressed. More commonly, your processor will simply close your account if they discover you are not compliant.

Choosing between payment methods and checkout types

You have three main options for how customers enter payment information on your site.

Hosted payment pages redirect the customer to a page owned and secured by your processor. You never see the card number. The customer enters their details, the processor handles the security, and the customer is sent back to your site. This is the simplest and most secure option, but you have no control over the look and feel of the checkout page. Examples: PayPal Standard, Stripe Checkout.

Embedded payment forms sit on your website but are controlled by your processor's code. The form looks like part of your site, but the card data is encrypted by the processor's JavaScript before it ever reaches your server. You have more control over the design, but you still do not handle the raw card data. Examples: Stripe Elements, Square Payment Form. These require a gateway fee but give you a better customer experience.

Digital wallets let customers pay with Apple Pay, Google Pay, or their saved card on file. These are fast, reduce friction, and are increasingly expected. Most processors support them at no extra cost.

ACH and bank transfers let customers pay directly from their bank account instead of a card. Fees are lower (usually 1 percent or less), but settlement is slower (three to five days) and chargebacks are less common but still possible.

Frequently Asked Questions

Why does my money take three days to arrive if the transaction is approved in seconds?

Authorization and settlement are two different things. Authorization confirms the card is good and holds the money on the customer's side. Settlement is when the money actually moves from their bank to yours. Your processor batches transactions once or twice per day, then the acquiring bank and card networks process those batches, which takes one to three business days. You can pay for faster settlement, but it costs more.

What happens if a customer disputes a charge after I have already shipped the item?

The money can be pulled back from your account weeks later. Your only defense is proof — a tracking number showing delivery, a signature confirmation, or an email from the customer confirming they received it and were satisfied. Keep records of all orders and shipments for at least 18 months. If you lose the dispute, you lose both the money and the item.

Do I have to use the payment processor my website platform recommends?

No. Most website builders (Shopify, WooCommerce, BigCommerce) work with multiple processors. You can compare fees, settlement times, and features across Stripe, Square, PayPal, Authorize.net, and others. Some platforms charge extra if you use a processor they do not own, so factor that into your comparison.

What is the difference between a payment processor and a payment gateway?

A payment processor is the company you sign a contract with and pay fees to — they handle the whole transaction. A payment gateway is the software that encrypts your customer's card details and sends them securely. Some processors own their gateway; some use a third party. For most small businesses, you only need to know your processor's name.

Can I reduce my e-commerce fees?

Yes. Negotiate your processor's markup if you have high volume. Use ACH transfers instead of cards when possible — fees are lower. Encourage customers to use debit cards instead of credit cards (interchange is lower). Reduce chargebacks by shipping tracked packages and keeping order records. And shop around — processors compete on rates, and switching can save hundreds per month if your volume is high enough.