How Payment Gateway Services Move Money From Customers to Your Business Account

What a payment gateway does and why you need one

A payment gateway is the technology that captures card details, bank account information, or digital wallet data when a customer pays you—and sends that information securely to the bank or processor that actually moves the money. It is the bridge between your checkout page (online or in-person) and the financial system that deposits funds into your account.

Without a gateway, you have no way to accept cards or digital payments at all. With one, you can take payments on a website, mobile app, in a physical store, or over the phone. The gateway encrypts sensitive data so you never see the full card number, which protects both you and your customer from fraud and keeps you compliant with payment security rules.

The gateway itself does not hold money or decide whether a transaction goes through. It passes the request to a payment processor (often a bank or third-party company), which checks with the customer's bank, confirms funds are available, and either approves or declines the charge. The processor then sends the result back through the gateway to your checkout, usually in seconds.

Key Takeaways

• A payment gateway encrypts and transmits payment data to your processor; it does not store money or make approval decisions.
• Gateways work with processors, acquiring banks, and payment networks (Visa, Mastercard, Amex) to complete each transaction.
• You pay the gateway provider a monthly fee, a per-transaction fee, or both, depending on the service you choose.
• Hosted gateways (like Stripe or Square) handle security for you; self-hosted gateways give you more control but require you to meet stricter security standards.
• Settlement—when money actually lands in your bank account—typically takes one to three business days after a transaction is approved.

How the payment flow works from swipe to deposit

When a customer enters payment information at your checkout, the gateway immediately encrypts it. That encrypted data travels to your processor, which forwards it to the customer's card network (Visa, Mastercard, American Express, or Discover) and their issuing bank. The bank checks the account balance, fraud rules, and whether the card is active, then sends back an approval or decline code.

The processor receives that response and relays it back through the gateway to your checkout screen. If approved, the customer sees a confirmation and the transaction is recorded. If declined, they see an error message and can try another card or payment method.

The money does not move immediately. Instead, the processor batches all your approved transactions (usually once per day) and sends them to your acquiring bank—the bank that holds your merchant account. That bank then deposits the total into your business checking account, minus any fees. This settlement window is typically one to three business days, though some gateways offer next-day or same-day settlement for an extra fee.

Hosted gateways versus self-hosted gateways

A hosted gateway redirects the customer to a payment page owned and secured by the gateway provider (like Stripe Checkout or Square Online). You never see the customer's card details at all. The gateway provider handles all the security compliance, encryption, and fraud prevention. This is the simpler route for most small businesses because the provider bears the responsibility for keeping data safe.

A self-hosted gateway lets you build the payment form directly into your own checkout page. The customer enters their card information on your site, and your server sends it to the gateway. This gives you more control over the look and feel of checkout, but it also means you must meet strict security standards called PCI DSS (Payment Card Industry Data Security Standard). Failing to meet PCI compliance can result in fines from card networks and losing your ability to accept payments. Most small businesses choose hosted gateways to avoid this burden.

A middle ground exists: iframe gateways embed a secure payment form from the provider into your page. The form looks like part of your site, but the gateway provider handles the security. This balances control and compliance.

Fees you will encounter and how they are charged

Payment gateway fees vary widely depending on the provider and the type of business you run. Most gateways charge a combination of the following:

• Monthly subscription or account fee: Usually $0 to $50 per month, depending on the provider and plan tier.
• Per-transaction fee: Typically $0.20 to $0.50 per transaction, charged whether the transaction is approved or declined.
• Percentage of transaction amount: Usually 2% to 3.5% of the total sale, charged only on approved transactions. This is called the discount rate.
• Batch fees: Some gateways charge a small fee each time you settle a batch of transactions, though many have eliminated this.
• Chargeback fees: If a customer disputes a charge and the bank sides with them, you typically pay $15 to $100 per chargeback.
• PCI compliance fees: If you use a self-hosted gateway, you may pay extra for compliance scanning or certification.

The total cost depends on your sales volume and average transaction size. A business processing $10,000 per month might pay $200 to $400 in gateway fees; a business processing $100,000 per month might pay $2,000 to $4,000. Always ask for a breakdown of all fees before signing up, and compare total cost across providers, not just the per-transaction rate.

Common gateway providers and what they offer

Stripe is a hosted gateway popular with online businesses and software companies. It charges 2.9% plus $0.30 per transaction for card payments, with no monthly fee. Settlement is standard (one to three days) or next-day for an extra fee. Stripe handles PCI compliance and offers strong fraud tools.

Square serves both online and in-person businesses. Online payments cost 2.9% plus $0.30 per transaction; in-person card payments cost 2.6% (with Square hardware). There is no monthly fee. Square offers point-of-sale hardware, invoicing, and inventory tools alongside the gateway.

PayPal offers a gateway (PayPal Commerce Platform) that charges 2.99% plus $0.49 per transaction for online payments. It integrates with PayPal's wallet, so customers can check out faster if they have a PayPal account. Settlement is typically one to three days.

Authorize.Net is a self-hosted gateway used by businesses that want more control over checkout design. It charges a $25 monthly gateway fee plus $0.10 per transaction, plus interchange fees (which vary by card type and typically run 1.5% to 2.5%). Authorize.Net requires you to meet PCI compliance standards.

These are not the only options. Your acquiring bank may offer a gateway, or you may find specialized providers for your industry. Always compare the total cost, settlement speed, fraud tools, and customer support before choosing.

Disputes, chargebacks, and what happens when a customer contests a charge

When a customer disputes a charge—either because they did not recognize it, did not receive the product, or claim fraud—the card network initiates a chargeback. The customer's bank pulls the money back from your processor, and you are notified. You then have a window (usually 7 to 10 days) to respond with evidence that the transaction was legitimate.

Evidence includes the order confirmation, shipping tracking, delivery signature, customer communication, or a refund you issued. If you can prove the transaction was valid and the customer received what they paid for, you may win the dispute and keep the money. If you cannot prove it, or if you do not respond in time, you lose the money and pay a chargeback fee (typically $15 to $100).

Chargebacks are expensive and damage your account standing. Too many chargebacks can cause your processor to terminate your account. The best defense is clear communication with customers (order confirmations, shipping updates, easy refund policies) and good record-keeping. Some gateways offer chargeback protection or insurance, though these services cost extra and do not cover all disputes.

Security, compliance, and protecting customer data

Payment gateways must comply with PCI DSS, a set of security standards created by the card networks. If you use a hosted gateway, the provider handles most of this compliance for you. If you use a self-hosted gateway or store any payment data yourself, you must meet PCI standards, which include encryption, firewalls, regular security testing, and strict access controls.

Gateways also use tokenization to protect data. Instead of storing the actual card number, the gateway stores a token—a unique code that represents the card but is useless to a thief. When you need to charge the card again (for a subscription or recurring payment), you use the token, not the card number.

Many gateways offer 3D Secure (also called Verified by Visa or Mastercard SecureCode), an extra authentication step where the customer enters a password or receives a code on their phone. This reduces fraud and chargebacks, though it can also increase checkout abandonment because it adds a step.

Always use HTTPS (encrypted connection) on your website, never store full card numbers, and never send payment data via email or unencrypted channels. If you are unsure whether your setup meets PCI standards, ask your gateway provider or acquiring bank for a compliance assessment.

Frequently Asked Questions

What is the difference between a payment gateway and a payment processor?

A gateway is the technology that captures and encrypts payment data and transmits it securely. A processor is the company (often a bank) that actually communicates with the customer's bank, checks for fraud, and approves or declines the transaction. Many companies offer both services together, which can make the distinction confusing, but they are separate functions.

How long does it take for money to show up in my bank account after a customer pays?

Settlement typically takes one to three business days. The gateway approves the transaction immediately, but the processor batches transactions (usually once per day) and sends them to your acquiring bank, which then deposits the funds. Some gateways offer next-day or same-day settlement for an extra fee, but standard settlement is two to three days.

Can I use the same gateway for online and in-person payments?

Yes, many gateways support both. Stripe, Square, and PayPal all allow you to accept online payments and in-person card payments (with a card reader). Fees may differ between online and in-person transactions, so check the pricing for both before choosing.

What happens if a customer's card is declined?

The gateway receives a decline code from the customer's bank (insufficient funds, card expired, fraud block, etc.) and displays an error message at checkout. The customer can try another card or payment method. The transaction is not charged, and you do not pay a fee for the declined attempt, though some gateways charge a small per-transaction fee regardless of approval status.

Do I need a separate merchant account to use a payment gateway?

It depends on the gateway. Hosted gateways like Stripe and Square often set up a merchant account for you as part of their service. Self-hosted gateways like Authorize.Net typically require you to open a merchant account with an acquiring bank separately. Ask the gateway provider whether a merchant account is included or if you need to open one yourself.