The basic steps to process a credit card payment

To take a credit card payment, you need three things: a way to read or enter the card number (a terminal, a payment app, or a form), the cardholder's permission, and a merchant account or payment processor that connects you to the card networks. The cardholder gives you their card number, expiration date, and CVV (the three-digit code on the back). You enter or swipe this information into your payment system. The processor sends the request to the card's bank, which approves or declines it in seconds. If approved, the money moves from the customer's bank to yours—usually within one to three business days.

The method you use depends on your business type and volume. A brick-and-mortar store typically uses a physical terminal that reads the card chip or magnetic stripe. An online business uses a payment gateway—software that encrypts the card data and routes it securely. A service business might use a mobile app like Square or PayPal. A phone or mail order uses a virtual terminal where you manually type in the card details. Each method has different equipment costs, transaction fees, and security requirements.

Key Takeaways

  • You need a merchant account or payment processor to accept credit cards; you cannot deposit card payments directly into a personal bank account.
  • The cardholder must authorize the payment—either by swiping, inserting, tapping their card, or providing the number to you directly.
  • Card data must be encrypted during transmission and storage to comply with PCI DSS (Payment Card Industry Data Security Standard) rules.
  • Approved payments typically arrive in your bank account within one to three business days, minus the processor's fee (usually 2 to 3 percent plus a per-transaction charge).
  • You are responsible for refunding declined or disputed charges; the processor does not cover merchant error or customer dissatisfaction.

Choosing the right payment method for your business

The payment method you choose depends on where your customers are and how often you take payments. If you run a retail store, a point-of-sale (POS) terminal is standard—it reads the card in person and reduces fraud because the cardholder is present. If you sell online, a payment gateway like Stripe, Square Online, or Shopify Payments integrates with your website and handles the entire transaction. If you take payments over the phone or by mail, a virtual terminal lets you type in the card number manually, though this method carries higher fraud risk and higher fees.

Mobile payment apps like Square, PayPal, or Toast work well for small businesses, service providers, and pop-up vendors because they turn a smartphone into a card reader. Subscription billing platforms like Recurly or Chargify are built for recurring charges. Each option has different monthly costs, per-transaction fees, and setup requirements. A high-volume retail store might pay $50 to $300 per month for a terminal plus 2 to 2.5 percent per transaction. A small online business might use a gateway with no monthly fee but pay 2.9 percent plus $0.30 per transaction. Compare the total cost for your expected volume, not just the headline rate.

How authorization and settlement work

Authorization and settlement are two separate steps that happen at different times. Authorization happens immediately when you swipe, insert, or tap the card. The processor checks with the cardholder's bank to confirm the account exists, the card is not stolen or blocked, and the account has enough funds. The bank holds that amount in reserve so the customer cannot spend it twice. This hold typically lasts three to seven days.

Settlement happens later, usually the next business day. The processor batches all your approved transactions and sends them to the card networks (Visa, Mastercard, American Express, Discover). The networks route the money from each customer's bank to your merchant account. The processor deducts its fee and deposits the remainder into your business bank account. If you refund a transaction before settlement, it never moves money at all—the hold simply drops. If you refund after settlement, the money goes back to the customer's card, which takes one to three business days.

Understanding fees and what they cover

Credit card processing fees come in three main forms: interchange, assessment, and processor markup. Interchange is the fee the card networks charge—it goes to the customer's bank and varies by card type (rewards cards cost more than basic cards) and transaction type (in-person is cheaper than online). Assessment is a small fee the networks charge you directly, usually 0.05 to 0.15 percent. Processor markup is what your payment processor keeps for providing the service—this is where you have the most control when shopping for a processor.

A typical retail transaction costs 2 to 2.5 percent of the sale plus $0.10 to $0.30 per transaction. A keyed-in or online transaction costs 2.5 to 3.5 percent plus $0.25 to $0.50. These fees are non-refundable—you pay them whether the customer is satisfied or not. If you refund the customer, you still lose the fee. Some processors charge monthly minimums, PCI compliance fees, or statement fees. Read the full pricing sheet before signing up, and ask what happens if your volume drops or you want to cancel.

Security requirements and PCI compliance

You are legally required to protect credit card data under PCI DSS (Payment Card Industry Data Security Standard). The rules are strict: you cannot store the full card number, expiration date, or CVV after the transaction is complete. You cannot transmit this data over unencrypted connections. You must use a secure, encrypted payment processor or gateway. If you handle card data yourself—for example, by taking payments over the phone and typing them into a system—you must encrypt the data in transit and at rest, use a secure password, and never write down or email card numbers.

The easiest way to stay compliant is to use a PCI-certified processor or gateway that handles encryption for you. Square, Stripe, PayPal, and most major processors are certified. If you use a virtual terminal or phone payments, the processor encrypts the data before it reaches your system. If you are a small business and you use a PCI-certified payment app, you are generally protected. If you store card data yourself or process payments through an unsecured method, you risk fines of $5,000 to $100,000 per month, plus liability if the data is breached. Do not store card data yourself unless you have a specific reason and a security expert has reviewed your system.

What to do when a payment is declined

A declined payment means the cardholder's bank rejected the transaction. Common reasons include insufficient funds, a card that is expired or reported stolen, a mismatch between the billing address and the address on file, or the card network flagging the transaction as suspicious. The processor returns a decline code—a two-digit number that tells you why. Code 05 means the card was declined by the issuer (the customer's bank). Code 54 means the card is expired. Code 62 means the card is restricted.

When a payment declines, ask the customer for a different card or payment method. Do not charge the card multiple times hoping it will go through—each attempt is a separate transaction and each one costs you a fee. If the customer says the card should work, have them contact their bank to ask why it was declined. Some banks decline transactions they think are suspicious, especially if the purchase is large or from an unfamiliar merchant. The customer can call their bank and approve the transaction, then you can try again. If the customer disputes the charge later, you have the decline record to prove the payment did not go through.

Handling refunds and chargebacks

A refund is when you return money to the customer because they asked for it or because you made an error. You initiate the refund through your payment processor, and the money goes back to the customer's card within one to three business days. You pay the processing fee again on the refund—the processor does not refund the fee you paid on the original transaction. If you refund before settlement (usually the same day), the transaction never moves money and you lose only the fee. If you refund after settlement, the money comes out of your merchant account.

A chargeback is when the customer disputes the charge with their bank instead of asking you for a refund. The bank pulls the money back from your account and charges you a chargeback fee (usually $15 to $100). You have the right to dispute the chargeback by providing evidence—a receipt, a signed authorization, proof of delivery, or a message from the customer confirming the purchase. If you win the dispute, the money goes back into your account, but you still lose the chargeback fee. If you lose, you lose the money and the fee. Chargebacks are expensive, so refund legitimate requests quickly. If a customer claims they never received a product or service, ask for proof of delivery or a signed receipt before refunding.

Frequently Asked Questions

Can I take a credit card payment over the phone or email?

Yes, but it carries higher fraud risk and higher fees. Over the phone, you type the card number into a virtual terminal—the processor encrypts it before it reaches your system. Never email a card number or store it in an email. Never ask a customer to text their card number. If you take phone payments regularly, use a PCI-certified virtual terminal or payment app designed for phone orders.

What happens if I process a payment and the customer says they never authorized it?

The customer can file a chargeback with their bank. You can dispute it by providing proof of authorization—a signed receipt, an email confirmation, or a recording of the phone call (if your state allows one-party consent). If you cannot prove authorization, you lose the money and pay a chargeback fee. Always get written or recorded consent before processing a payment.

How long does it take for a payment to show up in my bank account?

Approved payments typically settle within one to three business days. The processor batches transactions daily and sends them to the card networks overnight. The networks route the money to your bank, which deposits it into your merchant account. Weekends and holidays delay settlement. Some processors offer next-day settlement for an extra fee.

Do I have to use the payment processor my bank recommends?

No. Your bank may offer payment processing, but you can use any PCI-certified processor. Shop around—fees vary widely. A processor your bank recommends may not have the lowest rates or the best features for your business. Compare total cost, customer support, and integration with your point-of-sale or accounting software.

What if a customer's card is declined but they insist they have money?

Tell them to contact their bank. The decline came from their bank, not from you or your processor. Their bank may have flagged the transaction as suspicious, the card may be temporarily blocked, or there may be a technical issue. The customer's bank can override the decline or issue a new card. Do not keep trying to charge the card—each attempt costs you a fee and may trigger fraud alerts.