How Payment Gateways Connect Your Business to Customer Money
What a payment gateway does and why you need one
A payment gateway is the system that takes a customer's card number, bank account, or digital wallet and sends it securely to the bank that will actually move the money. It is the middleman between your checkout page (or register, or invoice) and the financial institutions that clear the transaction. Without it, you have no way to accept cards or bank transfers online or over the phone.
The gateway does three concrete things: it encrypts the customer's payment information so it cannot be read in transit, it sends that information to the payment processor (which contacts the customer's bank), and it returns a yes-or-no response to your system within seconds. If the answer is yes, the money is on its way to your account. If it is no, the customer sees a decline message and can try again or use a different payment method.
You do not need a gateway if you only accept cash or checks. You do need one if you take cards online, by phone, by mail, or in person through a virtual terminal. Most gateways handle multiple payment types at once — credit cards, debit cards, ACH transfers, digital wallets like Apple Pay or Google Pay, and sometimes buy-now-pay-later services.
Key Takeaways
- A payment gateway encrypts customer payment data and routes it to the bank that will approve or decline the transaction, returning a result in seconds.
- Gateways charge per transaction (usually 2 to 3 percent of the sale plus a flat fee) and require a merchant account with a bank or payment processor.
- Popular gateways include Stripe, Square, PayPal, Authorize.Net, and Shopify Payments, each with different fee structures and which payment types they support.
- PCI compliance (Payment Card Industry Data Security Standard) is a legal requirement; your gateway must be certified, and you must not store raw card data on your own servers.
- Integration means connecting the gateway to your website, point-of-sale system, or invoicing software so transactions flow automatically without manual entry.
How payment gateways charge and what fees to expect
Every transaction costs you money. The gateway itself charges a percentage of the sale (typically 2.2 to 2.9 percent) plus a flat per-transaction fee (usually $0.30 to $0.50). On top of that, the payment processor and the customer's bank take their own cuts, which are bundled into what you see as your total cost. A $100 sale might cost you $2.50 to $3.50 in fees.
Some gateways charge a monthly minimum or a flat monthly fee instead of (or in addition to) per-transaction fees. Stripe and Square typically charge per transaction with no monthly fee. Authorize.Net charges a monthly gateway fee plus per-transaction costs. PayPal's rates vary depending on whether you use their gateway, their invoicing tool, or their point-of-sale system. Read the pricing page for any gateway you are considering and calculate what your actual cost would be based on your expected monthly volume and average transaction size.
You will also need a merchant account — a special bank account that holds the money from card sales before it settles into your regular business checking account. Some gateways provide the merchant account themselves (Stripe, Square, PayPal). Others require you to open one separately with a bank or payment processor. The merchant account is where the gateway deposits funds, usually within one to three business days after a transaction clears.
Choosing a gateway: what to compare
The right gateway depends on how you sell. If you run an online store, you need a gateway that integrates with your e-commerce platform — Shopify Payments works seamlessly with Shopify, WooCommerce has its own integrations, and Stripe plugs into almost everything. If you take payments in person, you need a gateway that works with point-of-sale systems or offers its own hardware (Square and PayPal both do). If you invoice clients, you need one that works with your invoicing software or lets you send payment links by email.
Compare these specifics: which payment types each gateway accepts (some do not support ACH or digital wallets), whether they charge monthly fees or only per transaction, what their per-transaction rate is, how long money takes to reach your account, whether they offer invoicing or point-of-sale tools built in, and what their customer support looks like. Stripe is known for developer-friendly integration and low fees but minimal phone support. Square is known for in-person payments and strong support. PayPal is the most recognizable name but charges higher rates. Authorize.Net is popular with larger businesses and has been around since the 1990s.
Test the integration before you commit. Most gateways offer a sandbox or test mode where you can send fake transactions and see how the system behaves without charging real money. Use it to make sure the gateway actually works with your website or software before you sign up for a live account.
PCI compliance: what the law requires
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that every business accepting cards must follow. The core rule is simple: you must never store a customer's full card number, expiration date, or security code on your own servers. If you do, you become responsible for protecting that data, and the penalties for a breach are severe — fines can reach hundreds of thousands of dollars, and you may be banned from accepting cards altogether.
A certified payment gateway handles this for you. When a customer enters their card number on your checkout page, the gateway's code encrypts it immediately and sends it directly to the gateway's secure servers. Your website never sees the raw card data. The gateway returns a token — a random string of characters — that represents that card without exposing the actual number. You store the token, not the card.
If you use a third-party gateway that is PCI certified, you are largely protected as long as you do not try to store card data yourself. If you build your own payment system or use an uncertified gateway, you must undergo a PCI audit every year, which costs money and requires significant security infrastructure. For most small and medium businesses, using a certified gateway is the only practical way to stay compliant.
How integration works: connecting the gateway to your business systems
Integration means linking your website, point-of-sale system, or invoicing software to the gateway so that payment information flows automatically. You do not have to manually type in card numbers or amounts. The customer enters their information once, the gateway processes it, and the result (approved or declined) appears in your system instantly.
For a website, integration usually means adding code to your checkout page. Most gateways provide a plugin or pre-built module for popular platforms like Shopify, WooCommerce, or Squarespace. If you have a custom website, the gateway provides an API (a set of instructions for your developer) that lets your site communicate with the gateway's servers. The API tells the gateway "process this card for this amount" and the gateway responds with "approved" or "declined."
For in-person payments, you typically use the gateway's own point-of-sale app (like Square Register or PayPal Zettle) or integrate their API into your existing register system. For invoicing, you send a payment link that the customer clicks, which opens the gateway's secure payment page. The customer enters their information there, and the gateway notifies your invoicing software that the payment went through.
Integration can be as simple as installing a plugin (a few clicks, no coding required) or as complex as hiring a developer to write custom code. Most gateways publish integration guides and offer sandbox testing so you can see exactly how the flow will work before going live. If you are not technical, many gateways have partner developers who can handle the setup for a fee.
Settling funds and reconciliation
When a customer's transaction is approved, the money does not appear in your bank account immediately. Instead, it goes into your merchant account, where it sits for a holding period (usually one to three business days). This is called the settlement period. During that time, the payment processor is verifying that the transaction is legitimate and that the customer's bank has actually set the money aside.
After the settlement period ends, the funds are deposited into your business checking account. Most gateways show you a daily or weekly settlement report that lists every transaction, fee, and deposit. You can download this report and match it against your accounting software to make sure the numbers line up. This process is called reconciliation, and it is important for tax and accounting purposes.
Some gateways hold back a small percentage of each deposit as a reserve, especially if you are new or if your business has high chargeback rates. This reserve protects the gateway if customers dispute charges or if you go out of business owing money. Ask about reserve policies before you sign up; some gateways do not hold reserves at all, while others hold 5 to 10 percent of deposits for the first year.
Chargebacks and disputes
A chargeback happens when a customer tells their bank "I did not authorize this charge" or "I did not receive what I paid for." The bank reverses the transaction, pulling the money back out of your merchant account and returning it to the customer. You lose both the sale and the product or service you provided, plus you are charged a chargeback fee (usually $15 to $100 per dispute).
Your gateway provides tools to fight chargebacks. You can upload proof that the customer authorized the charge (an email confirmation, a signed order form, a delivery receipt) and submit it to the bank within a set time window (usually 7 to 10 days). If the bank agrees with you, the chargeback is reversed and the money goes back into your account. If the bank sides with the customer, you lose the money and the fee.
High chargeback rates (more than 1 percent of your transactions) can get you flagged by payment processors. If your rate stays high, you may be required to pay higher fees, hold larger reserves, or in extreme cases, lose the ability to accept cards altogether. Prevent chargebacks by being clear about what you are selling, sending order confirmations, delivering on time, and making refunds easy for customers who are genuinely unhappy.
Security beyond the gateway
The gateway encrypts payment data, but your website and systems also need protection. Use HTTPS (the "s" in "https://" at the start of your web address) on every page where customers enter information. HTTPS encrypts all data traveling between the customer's browser and your server, not just payment information. Most hosting providers offer free SSL certificates (the technology behind HTTPS), and many website builders include it automatically.
Keep your software updated. If you use WordPress, Shopify, or any other platform, install security updates as soon as they are released. Outdated software is a common entry point for hackers. If you use a point-of-sale system, keep the app and any connected devices updated as well. Use strong passwords for your gateway account and your merchant account, and enable two-factor authentication if the gateway offers it.
Do not store card data in email, spreadsheets, or text files. If you need to keep a record of a transaction for accounting purposes, store only the token the gateway provided, not the card number itself. Train anyone on your team who handles payments to follow these same rules. A single employee forwarding a customer's card number in an email can trigger a breach that affects your entire business.
Frequently Asked Questions
Can I use multiple payment gateways at the same time?
Yes. Many businesses use one gateway for online sales and another for in-person payments, or they offer customers a choice between gateways at checkout. Each gateway charges its own fees, so you will pay for every transaction that goes through each one. Using multiple gateways can be useful if one goes down or if you want to offer payment methods that one gateway does not support.
What happens if a customer's card is declined?
The gateway returns a decline code that tells you why — insufficient funds, expired card, incorrect security code, or the bank flagged it as suspicious. Your checkout page should show the customer a clear message and let them try a different card or payment method. Do not charge them again automatically; let them decide whether to retry.
How long does it take to set up a payment gateway?
If you use a pre-built plugin on Shopify or WooCommerce, you can be live in minutes. If you need custom integration, it depends on your developer's availability and the complexity of your system — anywhere from a few days to a few weeks. Always test in sandbox mode before going live.
What if my gateway goes down or stops working?
Your customers cannot complete purchases. This is why some businesses use a backup gateway or keep a manual payment method (phone orders, invoices) available. Check your gateway's uptime may provide (most promise 99.5 to 99.9 percent uptime) and ask what happens if they have an outage — do they refund your fees for that day?
Do I need a separate gateway for each type of payment?
No. Most modern gateways handle cards, bank transfers, and digital wallets all in one system. You choose which payment types to offer your customers, and the gateway processes all of them. You pay one set of fees per transaction regardless of which payment type the customer uses.