What a payment gateway does

A payment gateway is the tool that captures card or bank details from a customer, encrypts them, and sends them to the bank or payment processor for approval. It sits between your checkout page and the financial system—the customer enters their information into the gateway, the gateway talks to the bank, and the bank says yes or no within seconds.

The gateway does not hold the money. It does not process the transaction itself. It is the messenger that takes the customer's payment details, keeps them secure during transit, and routes the request to whoever actually processes it—usually a payment processor or your merchant bank. Without a gateway, you would have no way to accept card payments online safely.

Think of it this way: the customer is on your website. They want to buy something. They cannot hand you a card through the screen. The gateway is what makes that possible—it collects the card data, protects it, and passes it along to the right place so the money can move.

Key Takeaways

  • A payment gateway encrypts and transmits customer payment details from your checkout to the bank or processor that approves the transaction.
  • The gateway does not process the payment itself or hold the funds—it is the secure channel that connects your business to the financial system.
  • Most gateways charge a per-transaction fee, usually between 2.2% and 3.5% of the sale plus a flat fee per transaction.
  • The gateway must be PCI compliant, meaning it meets security standards set by the card networks to protect customer data.
  • Different gateways work with different processors and banks, so your choice affects which payment methods you can offer and how fast money reaches your account.

How the transaction flows through a gateway

When a customer clicks "Pay Now," the gateway receives their card number, expiration date, and CVV. The gateway immediately encrypts this data—scrambles it so that even if someone intercepts it, they cannot read it. That encrypted data travels to the payment processor or acquiring bank.

The processor sends the request to the customer's bank (the issuing bank) asking, "Does this person have the funds? Is this card valid? Should we approve this?" The issuing bank checks the account and sends back an approval or decline code. This entire exchange usually takes 2 to 5 seconds.

The gateway receives that response and sends it back to your checkout page. If approved, the customer sees a confirmation and your system records the sale. If declined, the customer sees a message to try another card or contact their bank. The gateway logs all of this—the request, the response, the timestamp, the amount—so you have a record.

The actual money does not move during this step. The gateway and processor have authorized the charge. Settlement—the movement of funds from the customer's bank to your merchant account—happens later, usually within one to three business days.

What gateways cost and what they charge for

Most gateways charge a combination of per-transaction fees and monthly fees. A typical structure is 2.2% to 3.5% of the transaction amount plus $0.30 per transaction. If a customer buys something for $100, you might pay $2.50 to $3.80 in gateway fees alone, before processor fees.

Some gateways charge a monthly minimum or a flat monthly fee ($10 to $50) whether you process transactions or not. Others charge nothing monthly but take a higher percentage per transaction. A few charge for failed transactions or refunds, though this is less common.

Interchange fees—the fee the card networks (Visa, Mastercard, Amex) charge—are separate from gateway fees. Your processor handles interchange, but the total cost to you includes both. If you use a gateway that is integrated with a processor (like Stripe or Square), the fees are bundled and quoted as one rate. If you use a standalone gateway with a separate processor, you pay both entities.

PCI compliance and why it matters

Every gateway that handles card data must meet PCI DSS (Payment Card Industry Data Security Standard) requirements. These are rules set by Visa, Mastercard, American Express, and Discover to protect customer card information from theft and fraud.

PCI compliance means the gateway encrypts data in transit, stores data securely (or does not store it at all), and undergoes regular security audits. If a gateway is not PCI compliant and a breach happens, you and your customers are at risk—and you can face fines from the card networks.

Most modern gateways handle PCI compliance for you. You do not store the card number on your own servers; the gateway does (or passes it through without storing it). This is why using a reputable gateway is not optional—it is how you protect yourself and your customers legally.

Hosted pages versus embedded forms

A hosted payment page redirects the customer away from your website to a page owned by the gateway. The customer enters their card details there, then is sent back to your site. This is the simplest setup and puts the security burden entirely on the gateway. Examples include PayPal's checkout and Square's hosted page.

An embedded form (also called an iframe or hosted field) keeps the customer on your website but the card form itself is hosted by the gateway. The customer sees your branding and layout, but the actual input field is controlled by the gateway's servers. This feels more seamless and usually has higher conversion rates because customers do not leave your site.

A direct integration means your website talks directly to the gateway's API (application programming interface) and handles the form yourself. This requires more technical work and puts more responsibility on you for security, but it gives you the most control over the customer experience. Most businesses use hosted pages or embedded forms because they are simpler and safer.

Choosing between gateways

Different gateways work with different processors and banks. Stripe, for example, is both a gateway and a processor—you sign up with Stripe and they handle everything. Square is similar. PayPal is a gateway that can work with multiple processors, or you can use PayPal's own processing.

If you already have a merchant account with a bank, that bank may have a preferred gateway or require you to use a specific one. If you are starting from scratch, you choose a gateway and it either brings its own processor or connects you to one.

Consider these factors: What payment methods do you need to accept (cards, digital wallets, bank transfers)? What are the fees? How fast do you need the money in your account? Do you need invoicing, recurring billing, or other features? How good is the customer support? Some gateways are better for high-volume businesses, others for small shops or nonprofits.

What happens when a transaction fails or is disputed

If a transaction is declined, the gateway logs the reason: insufficient funds, card expired, address mismatch, fraud filter triggered, or issuing bank declined. You see this reason in your gateway dashboard. The customer can try another card or contact their bank.

If a customer disputes a charge later (calls their bank and says they did not authorize it), the gateway provides evidence to the processor: the authorization code, the timestamp, the IP address, the customer's billing address, and any other data captured at the time. This evidence is used in the chargeback process. If the evidence is strong, the processor wins the dispute and you keep the money. If not, the charge is reversed and you lose the money plus a chargeback fee (usually $15 to $100).

This is why gateways capture as much data as possible during the transaction—it protects you in disputes. It is also why you should keep records of what the customer ordered, when, and any communication about the order.

Frequently Asked Questions

Can I use the same gateway with different processors?

Some gateways are processor-agnostic and can connect to multiple processors. Others are tied to one processor. Stripe and Square are their own processors, so you cannot use them with another one. PayPal can work with multiple processors, but most small businesses use PayPal's own processing. Check the gateway's documentation to see what processors it supports.

What is the difference between a gateway and a processor?

A gateway captures and encrypts the payment details and routes them to the processor. A processor takes that routed request, talks to the banks, and handles settlement—moving the money from the customer's bank to your account. Some companies (like Stripe) do both. Others do only one.

Do I need a separate gateway if I use an e-commerce platform like Shopify?

No. Shopify has built-in gateways and processors. You do not choose a separate gateway; you choose which payment methods to accept (Shopify Payments, Stripe, PayPal, etc.) and Shopify handles the gateway part. If you use your own website, you choose and integrate a gateway yourself.

How long does it take for money to show up in my account after a customer pays?

The gateway approves the transaction in seconds, but settlement—the actual movement of money—takes one to three business days. Some gateways and processors offer faster settlement (next business day or same day) for a higher fee. Weekends and holidays extend the timeline.

What should I do if a customer says they were charged twice?

Check your gateway dashboard for the transaction records. If there are two identical charges, one is usually a duplicate that failed to process correctly. Contact your processor or gateway support to reverse the duplicate charge. If the charges are different amounts or times, they may be legitimate separate purchases. Ask the customer for details about what they ordered.