How Electronic Payment Gateways Move Money From Customer to Business
What an electronic payment gateway does
An electronic payment gateway is the technology that captures payment information when a customer buys something online or in person, then sends it securely to the bank or payment processor to complete the transaction. It sits between the customer, the merchant (the business), and the financial institutions involved — acting as a secure tunnel for card numbers, bank account details, or digital wallet information.
The gateway does not hold money or make the final decision to approve or decline. It encrypts sensitive data so it cannot be read if intercepted, routes the request to the right processor, and returns a yes-or-no response within seconds. Without a gateway, a business would have to handle raw payment card data directly, which exposes them to fraud, data breaches, and regulatory penalties.
You encounter gateways every time you enter a card number on a website, tap your phone at a register, or click "pay now" on an invoice. The gateway is invisible to you — you see only the payment form and the confirmation — but it is doing the heavy lifting behind the scenes.
Key Takeaways
- A payment gateway encrypts and routes payment information from the customer to the bank or processor, then returns an approval or decline within seconds.
- Gateways handle card data securely so the business never sees the full card number, which protects both the customer and the merchant from fraud.
- Different gateways charge different fees — typically a percentage of each transaction plus a flat per-transaction fee — and support different payment methods.
- A gateway is not the same as a payment processor; the gateway transmits the request, and the processor decides whether to approve it.
- Choosing a gateway depends on what you sell, how you sell it, and which payment methods your customers use most.
How the gateway processes a transaction step by step
When a customer enters payment information and clicks submit, the gateway immediately encrypts that data using SSL encryption (the same technology that protects your bank login). The encrypted information travels to the payment processor — the company that actually talks to the customer's bank.
The processor sends a request to the customer's card network (Visa, Mastercard, American Express, or Discover) or directly to their bank if it is a bank transfer. The bank checks whether the account has sufficient funds and whether the transaction matches the customer's normal spending patterns. This approval or decline comes back through the same route in seconds.
The gateway receives the response and displays it to the customer: "Payment approved" or "Payment declined." If approved, the funds move from the customer's account toward the merchant's account (though settlement — the actual deposit — usually takes one to three business days). If declined, the customer sees an error message and can try again with different payment information.
Throughout this process, the merchant's system never touches the raw card number. The gateway strips it out and replaces it with a token — a unique code that represents that card for future transactions. This means even if a hacker breaks into the merchant's database, they get tokens, not card numbers.
What gateways charge and how fees work
Most gateways charge a combination of fees: a percentage of the transaction amount (typically 1.5% to 3.5%), a flat per-transaction fee (usually $0.20 to $0.50), and sometimes a monthly account fee. A $100 sale might cost the merchant $2.50 to $4.00 in gateway and processing fees combined.
Some gateways charge extra for specific features: recurring billing (charging the same customer monthly), international transactions, or support for less common payment methods like ACH transfers or cryptocurrency. A few charge a monthly minimum or a fee if you process below a certain volume.
The fees vary widely depending on the gateway, your industry, your sales volume, and your risk profile. A high-risk business (like online gambling or subscription services) pays more than a low-risk one (like a retail clothing store). Comparing gateways means looking at the full fee structure, not just the percentage.
Gateway versus processor versus merchant account
These three terms are often confused because they work together, but they are separate things. A payment gateway is the software that captures and encrypts payment data. A payment processor is the company that sends the request to the bank and handles the approval decision. A merchant account is the bank account where your customer's money lands after the transaction settles.
Some companies offer all three services bundled together — you sign up with one provider and they handle the gateway, processing, and deposit account. Other merchants use separate providers: a gateway from one company, a processor from another, and a merchant account from a third. The bundled approach is simpler; the separate approach can be cheaper if you shop carefully.
You need all three to accept payments. If any one is missing or misconfigured, the transaction fails. A customer might see "payment declined" even though their bank approved it, because the gateway and processor were not communicating correctly.
Payment methods a gateway can support
Not every gateway supports every payment method. Most support credit and debit cards (Visa, Mastercard, American Express, Discover). Many also support digital wallets like Apple Pay, Google Pay, and PayPal. Some support bank transfers (ACH in the United States), international payment methods, or buy-now-pay-later services like Affirm or Klarna.
The payment methods you offer affect which gateway you choose. If your customers are mostly in the United States and pay by card, almost any gateway works. If you sell internationally, you need a gateway that supports local payment methods in each country — iDEAL in the Netherlands, Alipay in China, Giropay in Germany. If you want to offer payment plans, you need a gateway that integrates with a BNPL provider.
Adding a new payment method sometimes requires updating your gateway settings or signing a separate agreement with the processor. Some gateways make this easy; others require technical work or a phone call to support.
Security and compliance standards for gateways
All payment gateways must meet PCI DSS (Payment Card Industry Data Security Standard), a set of rules designed to prevent card data theft. PCI DSS requires encryption, regular security testing, access controls, and audit logs. A gateway that is not PCI-compliant is breaking the law and exposing both the merchant and the customer to liability.
When you use a PCI-compliant gateway, you transfer much of the security burden to the gateway provider. You still have to keep your own systems secure — your website, your server, your employee access — but you do not have to store or handle raw card data yourself. This is why using a reputable gateway is cheaper and safer than trying to build your own payment system.
Some gateways offer extra security features: fraud detection that flags suspicious transactions, 3D Secure (an extra verification step for card payments), or tokenization that lets you charge a customer again without asking for their card number. These features cost extra but reduce your fraud losses and chargebacks.
Choosing a gateway for your business
Start by asking: What do I sell, and how do I sell it? If you run an e-commerce store, you need a gateway that integrates with your shopping cart software (Shopify, WooCommerce, BigCommerce, etc.). If you take payments in person, you need a gateway that works with point-of-sale systems. If you bill customers monthly, you need one that supports recurring charges.
Next, consider your customers' payment preferences. If most of your customers are in the United States and use cards, a basic gateway is fine. If you have international customers or they prefer digital wallets, you need broader payment method support. If you sell to businesses rather than consumers, you might need to support ACH transfers or invoicing.
Finally, compare fees across at least three providers. Do not just look at the percentage; add up the percentage, the per-transaction fee, and any monthly fees, then calculate what a typical month would cost. A gateway that charges 2.9% plus $0.30 per transaction might be cheaper than one charging 2.2% plus $0.50 if you process many small transactions.
What happens when a payment is declined
When a customer's payment is declined, the gateway returns an error code that tells you why: insufficient funds, card expired, incorrect CVV, fraud detection triggered, or the card network rejected it for another reason. The customer sees a message like "Payment declined. Please check your card details and try again."
A declined payment does not charge the customer or the merchant. The transaction simply does not go through. The customer can update their payment information and try again immediately, or use a different card. Some gateways let you retry automatically after a few seconds, which sometimes succeeds if the decline was temporary.
If a customer's payment is declined repeatedly, they may have a real problem: a maxed-out card, a frozen account, or a fraud hold from their bank. At that point, they need to contact their bank directly. Your gateway cannot override a bank's decision.
Frequently Asked Questions
Does the gateway store my customer's card number?
No. A PCI-compliant gateway encrypts the card number, sends it to the processor, and then deletes it from its own system. The gateway stores a token instead — a unique code that represents that card. If you want to charge the same customer again, you use the token, not the card number. This protects both you and your customer.
What is the difference between a gateway and a payment app like Square or Stripe?
Square and Stripe are bundled providers: they include the gateway, the processor, and the merchant account all in one. A standalone gateway is just the software layer. Most small businesses use bundled providers because they are simpler to set up. Larger businesses sometimes use separate providers to negotiate better rates.
Can I use the same gateway for online and in-person payments?
Many gateways support both, but not all. Some are designed only for online (e-commerce), others only for in-person (point-of-sale). Check the gateway's documentation or ask their sales team whether it integrates with both your website and your register system before you sign up.
What happens if my gateway goes down?
If the gateway is unavailable, you cannot process payments until it comes back online. Most reputable gateways have uptime guarantees (usually 99.5% or higher) and redundant systems to prevent outages. If an outage lasts more than a few minutes, contact your gateway provider's support line. Some gateways offer a backup payment method you can use if the primary gateway fails.
Do I need a different gateway for international customers?
Not necessarily, but you need a gateway that supports international transactions and the payment methods your customers use in their countries. A gateway designed only for U.S. card payments will not work for a customer in Germany who wants to pay by bank transfer. Check your gateway's supported countries and payment methods before signing up if you plan to sell internationally.