How Payment Gateways Move Money From Your Customer to Your Bank Account

What a payment gateway does, and why you need one

A payment gateway is the technology that captures card or digital payment information from your customer, encrypts it, and sends it to the bank or processor that actually moves the money. It sits between your checkout page (or point-of-sale terminal) and the financial institutions that settle the transaction. Without a gateway, you have no secure way to accept cards online or in person.

The gateway does not hold the money or decide whether to approve the payment — that is the job of the processor and the customer's bank. What the gateway does is create a secure tunnel for sensitive data, check that the information is formatted correctly, and route it to the right place in real time. Most gateways also handle recurring billing, invoicing, and reporting so you can see what came in and when.

If you sell anything — whether online, by phone, or in a physical location — and you accept cards or digital wallets, you are using a payment gateway, even if you do not know its name. Stripe, Square, PayPal, Authorize.Net, and Adyen are common examples, but there are dozens of others, and many are invisible to you because your point-of-sale system or shopping cart includes one built in.

Key Takeaways

• A payment gateway encrypts and routes payment information from your customer to your bank and the customer's bank in real time, but does not hold or approve the money itself.
• Gateways charge per-transaction fees (usually 2 to 3 percent plus a flat fee per transaction) and may charge monthly minimums or setup fees depending on the provider and your sales volume.
• You need a merchant account (a special bank account that accepts card payments) to use a gateway; some gateway providers offer both together, while others require you to set up the account separately.
• The gateway you choose affects how fast money reaches your account, what payment methods you can accept, and what data you can see about each transaction.
• PCI compliance — a security standard that protects card data — is required by law; most gateways handle the technical work, but you are responsible for following the rules in your business practices.

How payment gateways charge you

Payment gateways make money by taking a cut of each transaction. The most common fee structure is a percentage of the sale plus a flat per-transaction fee. For example, a gateway might charge 2.9 percent of the sale amount plus $0.30 per transaction. On a $100 sale, that is $2.90 plus $0.30, totaling $3.20 out of your $100.

The exact percentage and flat fee vary widely depending on which gateway you use, what type of card is used (credit cards cost more than debit cards), and how much you sell each month. Some gateways offer lower rates if you process a certain volume — say, $10,000 or more per month. Others charge a monthly minimum or a monthly subscription fee whether you process anything or not.

A few gateways use a flat monthly fee instead of per-transaction fees, but this model is less common and usually only makes sense if you process a very high volume. Before you sign up, ask the gateway provider for a written breakdown of all fees: per-transaction rate, monthly minimum, setup fee, statement fee, and any fees for things like chargebacks or refunds. Some gateways also charge extra if you want to accept certain payment methods like international cards or digital wallets.

The difference between a gateway and a merchant account

A merchant account is a special bank account that your bank or a payment processor opens for you. It is the account where the money from your card sales actually lands. A payment gateway is the technology that sends the transaction to that account. You need both, but they are separate things.

Some companies bundle them together — Stripe, Square, and PayPal all provide both the gateway and the merchant account as one package. You sign up, give them your business information, and they set up the account and the gateway for you. Other gateways, like Authorize.Net, only provide the gateway technology; you have to open a merchant account with a separate processor or bank.

If you already have a merchant account with your bank, you can often use a different gateway with it, as long as the gateway and your merchant account provider are compatible. This gives you flexibility: you might use your bank's merchant account but route transactions through a gateway that offers better reporting or lower fees. Ask your bank or processor whether they allow this before you switch gateways.

Settlement: how long money takes to reach your account

When a customer swipes a card or clicks "pay," the gateway approves the transaction in seconds. But the money does not land in your account immediately. Settlement is the process of actually moving the funds from the customer's bank to your merchant account, and it usually takes one to three business days.

The timeline depends on when the transaction happens and when your processor batches and submits transactions to the banking system. If you process a payment on a Friday evening, it may not settle until Tuesday. Some gateways offer faster settlement — sometimes called "next-day funding" — but they charge extra for it, or only offer it to high-volume sellers.

During the settlement period, the money is in limbo: the customer's bank has deducted it from their account, but your account has not received it yet. If a customer disputes the charge during this time, the processor can reverse it before it ever reaches you. Once it settles into your account, it is yours, though the customer can still file a chargeback later (usually within 60 to 180 days, depending on the card network).

PCI compliance and data security

PCI compliance refers to a set of security rules that protect credit card data. The Payment Card Industry Security Standards Council created these rules, and every business that accepts cards must follow them. The rules exist because card data is a target for theft, and if your business is breached, you and your customers are at risk.

Most payment gateways handle the technical side of PCI compliance for you — they encrypt data, use secure servers, and undergo regular security audits. But compliance is not just about the gateway. You are also responsible for how you store, handle, and dispose of card information in your business. You cannot write down card numbers, store them in an unencrypted spreadsheet, or leave receipts with full card numbers lying around. You must train your staff on data security, use strong passwords, and keep your systems updated.

If your business is breached and card data is stolen, you can face fines from the card networks, lawsuits from customers, and damage to your reputation. Some gateways offer fraud detection and chargeback protection as add-ons, which can help reduce your risk. Before you choose a gateway, ask what security features they include and what compliance responsibilities fall on you.

Choosing between gateway providers

The right gateway for your business depends on what you sell, how you sell it, and what features matter most to you. If you run an online store, you need a gateway that integrates with your shopping cart software (Shopify, WooCommerce, BigCommerce, etc.). If you sell in person, you need one that works with your point-of-sale system or mobile device. If you do both, you need a gateway that handles both channels.

Other factors to consider: Does the gateway accept the payment methods your customers use? (Some accept only cards; others add PayPal, Apple Pay, Google Pay, and bank transfers.) How fast does money settle into your account? What does the reporting dashboard show you — just totals, or detailed transaction data? Is there a setup fee or monthly minimum? Do they charge extra for chargebacks or refunds? Can you reach customer support by phone, or only by email or chat?

Many gateways offer a free trial or a low-cost starter plan, so you can test them before committing. Read reviews from other small business owners in your industry, and ask your accountant or bookkeeper whether the gateway integrates with your accounting software. The cheapest gateway is not always the best one if it lacks features you need or if customer support is poor.

What happens when a transaction is declined

When a customer enters their card information, the gateway sends it to their bank for approval. The bank checks whether the card is valid, whether there are enough funds, and whether the transaction looks suspicious. If the bank approves it, the transaction goes through. If not, the gateway receives a decline code and tells your checkout page or terminal to reject the payment.

Common reasons for declines include insufficient funds, a card that has expired, a mismatch between the billing address the customer entered and the address on file with their bank, or fraud detection triggered by an unusual purchase pattern. Some declines are temporary — the customer's bank might be down for maintenance, or the card might be locked due to too many failed attempts. The customer can try again later or use a different card.

As a business owner, you see the decline code but usually not the reason behind it. The gateway logs the attempt, and you can see it in your reporting dashboard. You cannot charge the customer again without their permission, and you should not ask them to re-enter their card information over the phone or email — that creates a security risk and violates PCI rules. Instead, direct them to your checkout page or terminal to try again.

Chargebacks and disputes

A chargeback happens when a customer contacts their bank and says they did not authorize a charge or did not receive what they paid for. The bank reverses the transaction, pulling the money back out of your merchant account and returning it to the customer. You lose the sale, and the gateway or processor charges you a chargeback fee (usually $15 to $100 per chargeback).

Chargebacks are a cost of accepting cards, but you can reduce them by being clear about what you are selling, shipping orders promptly, and responding quickly if a customer complains. Keep records of every transaction — the order confirmation, shipping tracking, delivery confirmation, and any customer communications. If a customer files a chargeback, you can dispute it by submitting this evidence to your processor. If you win the dispute, the money goes back into your account and the chargeback fee is waived.

Some gateways offer chargeback protection or fraud detection tools that flag suspicious transactions before they settle. These tools are not perfect, but they can reduce your exposure. Read the fine print to understand what is covered and what is not.

Frequently Asked Questions

Can I use the same gateway for online and in-person sales?

Many gateways support both, but you need the right setup for each. For online sales, you need a gateway that integrates with your website or shopping cart. For in-person sales, you need a gateway that works with a point-of-sale terminal or mobile device. Some providers like Square and Stripe offer both in one account; others require separate setups. Check with your gateway provider about what hardware and software you need for each channel.

What is the difference between a gateway and a payment processor?

A payment gateway is the technology that captures and encrypts payment information. A payment processor is the company that handles the transaction behind the scenes — they communicate with banks, manage the merchant account, and settle funds into your account. Some companies do both; others specialize in one or the other. For your purposes, what matters is that you have both functions covered, whether through one provider or two.

Do I have to use the gateway my bank recommends?

No. You can use any gateway that is compatible with your merchant account. Your bank may offer their own gateway or recommend one, but you are not required to use it. Shop around, compare fees and features, and choose the one that works best for your business. Just make sure the gateway you choose can work with your merchant account provider before you sign up.

What happens if my gateway provider goes out of business?

If your gateway provider closes, you will need to switch to a different one. The good news is that your merchant account is separate, so your ability to accept cards does not disappear. You will need to update your website or point-of-sale system to use the new gateway, and you may lose access to historical transaction data depending on how the transition is handled. Before you choose a gateway, research the company's stability and ask what happens to your data if they shut down.

Can I accept payments without a payment gateway?

Not securely. You could ask customers to mail you checks or wire money, but that is slow and limits your sales. You could take card numbers over the phone, but that violates PCI compliance rules and puts your business at legal and financial risk. A payment gateway is the standard, secure way to accept cards, and the fees are a normal cost of doing business. For most small businesses, the convenience and security are worth the expense.