How Payment Gateways Work and What They Cost You

What a payment gateway does and why you need one

A payment gateway is the system that captures card information when a customer buys something from you—online, in person, or over the phone—and sends it securely to the bank for approval. It does not hold the money or move it into your account. It only authorizes the transaction and passes the data along. If you sell anything and accept cards, a gateway sits between your customer and the financial system that clears the payment.

You do not choose a gateway in isolation. It works with a payment processor (the company that talks to the banks), a merchant account (the bank account where money lands), and often a point-of-sale system (the register or software you use). Some providers bundle all of these together. Others let you mix and match. Understanding what each piece does helps you see where fees come from and what you actually control.

Key Takeaways

• A payment gateway authorizes transactions and encrypts card data, but does not move money into your account—the processor and your merchant account do that.
• Fees vary by gateway, processor, and card type: you may pay a percentage per transaction, a flat per-transaction fee, monthly minimums, or setup charges.
• The gateway you choose depends on where you sell (online store, physical location, invoices) and what payment types you accept (cards, ACH, digital wallets).
• Switching gateways is possible but requires updating your merchant account, PCI compliance setup, and customer payment links or terminals.
• Disputes and chargebacks go through the gateway and processor, so your choice affects how quickly you learn about and respond to customer claims.

How money actually moves from customer to your bank account

When a customer swipes, taps, or enters a card number, the gateway encrypts that data and sends it to the processor. The processor forwards it to the card network (Visa, Mastercard, Amex, Discover) and the customer's bank. The bank says yes or no within seconds. The gateway tells your register or website whether the transaction went through.

The money does not arrive the same day. The processor batches all your transactions from that day and sends them to your merchant account (usually held at a different bank than your personal checking account). Settlement typically takes one to three business days. During that time, the funds are in limbo—not with the customer anymore, but not in your account yet. This gap is where disputes and chargebacks happen: if a customer claims they never got the item or did not authorize the charge, the claim can come in days or weeks later, and the processor pulls the money back out of your account.

The gateway itself does not hold or move money. It only validates and encrypts. But it is the first point where the transaction is recorded, so it is also where you see the record of what happened and when.

Types of gateways and where each one fits

Gateways are usually sorted by how they connect to your business. An online gateway (like Stripe, Square Online, or PayPal) sits on your website or e-commerce platform and handles card payments from customers anywhere. A point-of-sale gateway (like Square Terminal or Toast) is built into a physical register and processes cards in person. An invoice gateway lets you send a payment link to a customer via email or text, and they enter their card on a secure page you do not control.

Some gateways work across all three. Square, for example, offers online checkout, in-person terminals, and invoice links from one account. Others specialize: Stripe is primarily online, while Clover is primarily in-person. Your choice depends on where most of your sales happen and whether you want one provider or multiple.

Each type has different security and compliance requirements. An online gateway must meet PCI DSS (Payment Card Industry Data Security Standard) rules, which means your website must use HTTPS, your servers must be regularly scanned, and you cannot store full card numbers. A point-of-sale terminal handles PCI compliance for you—the terminal itself is certified, so you do not have to certify your whole store. An invoice gateway keeps card data off your servers entirely; the customer enters it on the gateway's own secure page.

What you pay: fees, minimums, and hidden costs

Gateway fees come in several forms. A per-transaction fee is usually 2.2% to 3.5% of the sale plus $0.30 to $0.50 per card transaction. This is the most common model for online and invoice gateways. A flat monthly fee (often $10 to $50) covers basic access; you still pay per-transaction fees on top. Some gateways charge a monthly minimum—if you do not hit it in transaction fees, you pay the difference.

Rates vary by card type. A debit card or Visa might cost 2.2% + $0.30. An American Express or Discover card might cost 3.5% + $0.30. Some gateways charge different rates for in-person versus online transactions (in-person is usually cheaper because the card is physically present). A few charge more if the customer is not present and you are typing in the card number yourself.

Beyond per-transaction fees, watch for setup fees ($0 to $500), PCI compliance fees ($10 to $100 per year), chargeback fees ($15 to $100 per dispute), batch fees (charged when you settle each day's transactions), and gateway downtime penalties. Some gateways charge a fee if you do not process a minimum number of transactions per month. Others charge a fee to close your account early. Read the pricing page and the terms of service side by side; the terms often list fees the pricing page does not mention.

Security, compliance, and what happens if something goes wrong

A payment gateway must encrypt card data so that even your staff cannot see the full card number. This is called tokenization: the gateway stores a token (a random string) instead of the actual card number, and uses the token to process future charges if the customer gives permission. You never see or store the real card number.

If your gateway is breached, the attacker gets tokens, not card numbers. Tokens are useless without the gateway's decryption key, which the gateway keeps on its own secure servers. This is why using a major gateway (Stripe, Square, PayPal) is safer than building your own payment system: they have security teams and insurance. If they are breached, they notify you and often cover the cost of notifying customers.

When a customer disputes a charge or claims fraud, the dispute goes to the processor, not the gateway. The processor notifies you through the gateway's dashboard and gives you a window (usually 7 to 10 days) to respond with evidence: a receipt, a shipping confirmation, an email from the customer authorizing the charge. If you do not respond or your evidence is weak, you lose the chargeback and the money is pulled from your account. Some gateways charge a chargeback fee on top of the lost sale. If you get too many chargebacks (usually more than 1% of your transactions), the processor can close your merchant account.

Choosing a gateway: what actually matters

Start with where you sell. If you only sell online, an online-first gateway like Stripe or Shopify Payments is usually cheaper and simpler than a point-of-sale system. If you sell in person, Square or Clover give you a terminal and online dashboard in one package. If you sell both ways, look for a provider that does not charge extra to use multiple channels.

Next, consider what payment types you need. Most gateways accept Visa, Mastercard, Amex, and Discover. Some also accept ACH (bank transfers), digital wallets (Apple Pay, Google Pay), or international cards. If you sell to customers outside the US, check whether the gateway supports their payment methods and currencies.

Then compare fees honestly. A gateway with a 2.5% rate and a $10 monthly fee is cheaper than one with a 2.9% rate and no monthly fee if you process more than $500 per month. Use a calculator: multiply your average monthly sales by the per-transaction rate, add the monthly fee, and compare. Do not forget chargeback fees and PCI compliance fees.

Finally, test customer support. Call or email with a question and see how long it takes to get an answer. If your gateway goes down during a sale, you need someone to call immediately. Some gateways have live phone support; others only offer email or chat. Know what you are getting before you sign up.

Switching gateways: what you have to change

Switching is possible but not seamless. Your old gateway holds your transaction history and your customer payment records. Your new gateway will not have access to those. You will need to export your data from the old gateway (usually as a CSV file) and import it into your new one if you want to keep the records.

If you have customers on recurring billing (subscriptions, retainers), you will need to ask them to re-enter their card information with the new gateway. The new gateway will have a different token system, so old tokens do not work. Some gateways let you migrate recurring customers automatically; most do not.

Your website or point-of-sale system will need to be reconfigured to point to the new gateway. If you use Shopify, WooCommerce, or Square Online, this is usually a few clicks. If you have a custom-built website, your developer will need to update the code. If you use a physical terminal, you will need a new terminal from the new provider.

Plan the switch during a slow period. Notify customers that you are changing payment processors and that their recurring charges will pause briefly. Give yourself at least a week to test the new gateway before you go live.

Frequently Asked Questions

Can I use multiple payment gateways at the same time?

Yes. Many businesses use one gateway for online sales and another for in-person sales, or one for recurring billing and another for one-time purchases. Each gateway has its own merchant account and fees. The trade-off is more complexity: you have to log into multiple dashboards, reconcile multiple bank deposits, and manage multiple sets of PCI compliance. Most small businesses find one gateway simpler.

What is the difference between a payment gateway and a payment processor?

A gateway is the software that captures and encrypts card data. A processor is the company that sends that data to the banks and handles the settlement. Some companies (like Stripe or Square) are both: they provide the gateway and process the payment. Others separate the roles. You always have both, but you may only see one company's name.

Do I need a separate merchant account?

Usually yes, but it depends on the gateway. Some gateways (like Stripe or Square) set up a merchant account for you automatically when you sign up. Others require you to open a merchant account with a bank first, then connect the gateway to it. Check the gateway's setup process before you sign up.

What happens if my gateway goes down?

If the gateway is down, you cannot process card payments until it comes back up. Most major gateways have uptime guarantees (99.5% to 99.9%) and notify you if they are doing maintenance. During an outage, you can ask customers to pay by bank transfer, check, or cash, or you can wait. This is why having a backup payment method (like a second gateway or a manual payment option) is useful for high-volume businesses.

Can I negotiate gateway fees?

Yes, but only if you process high volume (usually $10,000+ per month). Most gateways have published rates for small businesses and custom rates for larger ones. If you are growing, ask your gateway whether they offer volume discounts. If they do not, that is a reason to consider switching.