How Payment Gateways Work and Which Ones Businesses Use

What a payment gateway does and why you need one

A payment gateway is the tool that moves money from a customer's card or bank account into your business account when they buy something online or in person. It sits between your store (or website, or app) and the bank that processes the payment. The gateway encrypts the card details so they never sit on your own servers, sends the information to the processor, and tells you whether the transaction went through or was declined—all in a few seconds.

If you take payments online, by phone, or through a mobile device, you are using a payment gateway whether you know its name or not. It is the reason a customer can type their card number into your checkout page and the money actually arrives in your account three to five business days later. Without it, you would have to manually call the card processor for every single transaction, and customers would have no reason to trust you with their card details.

The gateway also handles the rules that banks and card networks (Visa, Mastercard, American Express, Discover) enforce. It checks that the card is not expired, that the address matches, that the amount is not suspiciously large, and that the customer has not already tried this exact transaction five times in a row. These checks happen invisibly and take milliseconds.

Key Takeaways

• A payment gateway encrypts card details and routes them to the bank processor, so you never store sensitive information on your own servers.
• The gateway charges a fee per transaction (usually 2 to 3 percent of the sale plus a flat fee), and this cost varies by the type of card and the processor you choose.
• Major gateways used by U.S. businesses include Stripe, Square, PayPal, Authorize.Net, and Adyen, each with different fee structures and features.
• Your gateway must be PCI compliant, meaning it meets security standards set by the card networks to protect customer data.
• The gateway is separate from your merchant account (the bank account where deposits land) and your processor (the company that talks to the banks)—though some providers bundle all three.

How money moves from customer to your bank account

When a customer enters their card details into your checkout, the gateway immediately encrypts that information. The encrypted data goes to a payment processor, which is usually a separate company that has relationships with the banks on both sides—the customer's bank and your bank.

The processor sends the encrypted details to the customer's bank and asks: "Does this person have the money? Is this card real? Is the address correct?" The customer's bank responds yes or no in about two seconds. If yes, the processor tells your gateway to show a "payment approved" message to the customer.

The money does not move immediately. Instead, the processor batches all your transactions from the day and sends them to your bank in one file, usually overnight. Your bank then deposits the total into your merchant account (the business bank account you set up with the processor or gateway). This deposit typically lands two to five business days after the transaction, depending on your bank and the day of the week.

If a customer disputes the charge later—claiming they never made the purchase, or that the product never arrived—the processor handles the dispute process. The gateway keeps a record of the transaction, the customer's address, the IP address they used, and any other data that might prove you processed it legitimately.

The fees you pay and what they cover

Payment gateway fees are usually charged as a percentage of the sale plus a flat per-transaction fee. A typical structure is 2.9 percent plus 30 cents per transaction, but this varies widely depending on which gateway you use, what type of card the customer used, and whether you are processing in person or online.

Credit cards (Visa, Mastercard, American Express, Discover) each have their own interchange rates—the fee the customer's bank charges the processor for handling the transaction. These rates are set by the card networks and are not negotiable. A rewards card or a business card usually costs more to process than a basic card. American Express typically costs more than Visa. A transaction processed in person (with a chip reader or tap) usually costs less than one processed online, because the in-person transaction is lower risk.

Some gateways charge a monthly fee in addition to per-transaction fees. Others charge only per transaction. Some charge a fee if you do not process a minimum amount of money each month. A few charge a fee just to keep the account open, even if you process nothing. Read the pricing page carefully, because a gateway that looks cheap per transaction might have a $30 monthly minimum that makes it expensive if you only process a few hundred dollars a month.

You also pay for PCI compliance—the security standard that protects customer card data. Some gateways include this in their fee. Others charge $10 to $100 per month for it. A few gateways are PCI Level 1 certified, meaning they have passed the highest security audit; most are Level 2 or 3. The level affects how much security work you have to do on your own website.

Major payment gateways used in the United States

Stripe is used by millions of online businesses, from small shops to large companies. It charges 2.9 percent plus 30 cents per online transaction. Stripe handles the merchant account, the processor, and the gateway all in one—you do not have to sign up with a separate bank. It is popular because the setup is fast, the dashboard is clear, and it integrates easily with most website builders and shopping carts.

Square started as an in-person payment processor (the small white card reader) but now handles online payments too. In-person transactions cost 2.6 percent plus 10 cents. Online transactions cost 2.9 percent plus 30 cents. Square also offers a free point-of-sale system if you use their card reader, which appeals to small retail stores and restaurants.

PayPal has been processing payments since the 1990s and is recognized by most customers. Online transactions cost 2.9 percent plus 30 cents. PayPal also offers a virtual terminal (a phone-based system) and in-person processing through their card reader. Many small businesses use PayPal because customers already have PayPal accounts and trust the name.

Authorize.Net is owned by Visa and is used mainly by businesses that already have a merchant account elsewhere. You set up your merchant account with your own bank, then connect Authorize.Net as the gateway. This setup is more complex but gives you more control over which bank you use. Monthly fees and per-transaction fees vary depending on your plan.

Adyen is used by larger businesses and online marketplaces. It processes payments in over 150 currencies and handles complex scenarios like split payments (paying multiple vendors from one transaction) and recurring billing. Adyen's fees are negotiated per business and are not published on their website, so you have to contact their sales team.

Other gateways include Worldpay, First Data, and Clover, each with different fee structures and features. The right choice depends on your business size, the volume of transactions you process, whether you need in-person or online processing, and whether you want the gateway to also manage your merchant account.

PCI compliance and data security

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules created by Visa, Mastercard, American Express, and Discover to protect customer card data. If you process payments, you must follow these rules or hire a gateway that does the work for you.

The core rule is simple: never store a customer's full card number on your own servers. A PCI-compliant gateway encrypts the card details before they reach you, so your website and your business computer never see the full number. This is why you can safely take payments online—the gateway is responsible for keeping the card data safe, not you.

If you use a gateway that is PCI Level 1 certified, the gateway has passed the strictest security audit and you have fewer security requirements on your own website. If you use a Level 2 or 3 gateway, you have to do more work yourself: use HTTPS on your website, keep your software updated, use strong passwords, and run security scans regularly. Most small businesses use a Level 1 or 2 gateway to avoid this extra work.

If you ever store card data yourself—even encrypted—you must undergo a PCI audit every year. This audit costs $1,000 to $5,000 and requires you to prove that your systems are secure. Most small businesses avoid this by using a gateway that handles all the encryption and storage.

The difference between a gateway, a processor, and a merchant account

These three terms are often used interchangeably, but they are separate things. Understanding the difference helps you know who to call when something goes wrong.

A payment gateway is the software that encrypts card details and routes them to the processor. It is what your customer sees when they enter their card number. Examples: Stripe, Square, PayPal.

A payment processor is the company that talks to the banks. It takes the encrypted card details from the gateway, sends them to the customer's bank, receives the yes-or-no response, and batches the transactions for deposit. Some processors also own gateways (Stripe owns both). Some gateways use a processor owned by a different company.

A merchant account is a bank account specifically for receiving payments from customers. It is separate from your regular business checking account. When the processor deposits money, it goes into the merchant account first, and then you transfer it to your regular account if you want to. Some merchant accounts charge monthly fees, some charge per deposit, and some charge nothing.

Many modern gateways (Stripe, Square, PayPal) bundle all three together—you sign up with the gateway, and they automatically set up a merchant account and use their own processor. Older systems require you to sign up for a merchant account with a bank, then choose a separate gateway and processor. The bundled approach is simpler for small businesses; the separate approach gives you more control and sometimes lower fees if you process a very high volume.

Choosing a gateway for your business

Start by deciding whether you need in-person processing, online processing, or both. If you only sell online, Stripe and PayPal are fast to set up. If you need a physical card reader for a store or restaurant, Square and Clover are popular. If you need both, most major gateways now offer both options.

Next, calculate your expected transaction volume and average sale size. A gateway with a $30 monthly minimum is cheap if you process $5,000 a month but expensive if you only process $500. A gateway that charges 2.9 percent is cheap on a $10 sale but expensive on a $1,000 sale if another gateway charges a flat $1 fee per transaction.

Check whether the gateway integrates with your website builder, shopping cart, or point-of-sale system. Stripe integrates with almost everything. Square integrates well with its own ecosystem. PayPal integrates with most platforms but sometimes requires extra steps. If your website is custom-built, make sure the gateway has an API (a way for your developer to connect it).

Read the contract carefully for hidden fees: monthly minimums, inactivity fees, early termination fees, chargeback fees, and PCI compliance fees. Some gateways charge $25 per chargeback; others charge $15. Over a year, this adds up.

Finally, test the customer experience. Process a test transaction and see how long it takes to appear in your account. Check the dashboard to see whether you can easily refund a transaction, download a report, or see which transactions failed. A gateway that is cheap but has a confusing dashboard will cost you time.

Frequently Asked Questions

Why does it take three to five days for money to show up in my account?

The processor batches all your transactions overnight and sends them to your bank as one file. Your bank then processes that file, which takes one to three business days. Weekends and holidays add extra days. Some gateways offer next-day deposits for an extra fee, but the standard is two to five business days.

What happens if a customer disputes a charge?

The processor handles the dispute process. The customer contacts their bank and claims they did not make the purchase or did not receive the product. The processor asks you for proof—a receipt, an email confirmation, a tracking number, or a signed delivery confirmation. You have a set number of days (usually 7 to 10) to submit proof. If you do, the processor usually rules in your favor. If you do not, the money is returned to the customer and you are charged a chargeback fee (usually $15 to $25).

Can I use the same gateway for multiple businesses?

Yes, but each business needs its own merchant account and its own gateway account. You cannot process payments for Business A and Business B through the same merchant account, because the deposits would be mixed and the processor would not know which transactions belong to which business. Most gateways let you create multiple accounts under one login, which makes it easier to manage.

What if my gateway goes down and I cannot process payments?

Most major gateways have uptime guarantees of 99.9 percent, which means they are down less than an hour per month on average. If the gateway goes down, you cannot process online payments, but you can usually still process in-person payments if you have a backup card reader. Some businesses keep a second gateway account (with a different provider) as a backup, though this costs extra.

Do I need a separate gateway if I sell internationally?

If you only sell to U.S. customers, a U.S. gateway is fine. If you sell internationally, you need a gateway that supports multiple currencies and can process cards from other countries. Stripe and Adyen both handle international payments well. PayPal also supports many countries. Check the gateway's website to see which countries it serves before you sign up.