The three ways to take credit card payments
You can accept credit cards through a payment processor (a company that handles the transaction), a point-of-sale system (hardware and software that processes cards in person), or a payment gateway (software that connects your website to a processor). Which one you use depends on where you sell: in a physical location, online, or both.
All three routes require you to set up a merchant account—a bank account that receives card payments. The processor or gateway provider handles the connection between your customer's card, their bank, and your account. You pay a fee for each transaction, usually between 1.5% and 3.5% of the sale, plus a small flat fee per transaction (often $0.25 to $0.30).
The fastest way to start is through a third-party processor like Square, Stripe, or PayPal. These companies let you begin accepting cards within hours, with minimal paperwork. If you process high volume or want lower fees, you may eventually work directly with a bank or dedicated payment processor, but that requires more setup time and documentation.
Key Takeaways
- Payment processors, point-of-sale systems, and payment gateways all charge a percentage fee per transaction plus a flat fee, and the total cost varies by provider and transaction size.
- Third-party processors like Square and Stripe let you start accepting cards the same day with minimal paperwork, while bank merchant accounts take longer to set up but may offer lower fees at high volume.
- In-person card readers plug into your phone or tablet; online payment forms sit on your website or invoice; and virtual terminals let you enter card details manually over the phone.
- Every card transaction is encrypted and routed through the card network (Visa, Mastercard, American Express, Discover) to the customer's bank, which approves or declines the charge.
- You are responsible for keeping card data secure, and using a PCI-compliant processor protects you from liability if a breach occurs.
In-person card readers for physical locations
If you take payments face-to-face—at a retail counter, a market stall, a service appointment, or a delivery—you need a card reader that connects to a phone or tablet. Square Reader, Stripe Terminal, and PayPal Here are the most common. The reader itself costs $29 to $99 one time; you then pay the per-transaction fee each time a customer swipes, inserts, or taps their card.
The reader encrypts the card data immediately, so you never see the full card number. The transaction is sent to the processor's servers, the customer's bank approves or declines it within seconds, and the money lands in your account within one to two business days. If the customer's bank declines the card, the reader tells you immediately and you can ask for a different payment method.
Most readers also accept contactless payments (tap or phone-based wallets like Apple Pay and Google Pay), which are faster than swiping and reduce fraud because the card never leaves the customer's hand. Some readers print receipts; others send them by email or text.
Online payment forms for websites and invoices
If you sell online or send invoices to customers, you embed a payment form on your website or invoice that collects card details securely. Stripe, Square Online, Shopify Payments, and WooCommerce all offer this. The form encrypts the card data before it reaches your server, so your website never stores the full card number.
When a customer enters their card details and clicks "Pay," the form sends the data to the processor, the processor contacts the customer's bank, and the bank approves or declines the charge. The customer sees the result on your page within a few seconds. The money then moves to your account on the processor's standard schedule, usually one to two business days.
You can also generate a payment link—a unique URL you send to a customer via email or text—that takes them to a secure form to enter their card. This is useful for one-off invoices or when you don't have a website. The link expires after a set time or after the payment is made, so it is safe to share.
Virtual terminals for phone and mail orders
A virtual terminal is a web page where you manually enter a customer's card details—useful when the customer reads their card number to you over the phone, sends it by mail, or you have it on file from a previous order. You log into your processor's dashboard, enter the card number, expiration date, and CVV (the three-digit security code on the back), and click "Process."
The processor encrypts the data and sends it to the card network and the customer's bank. The transaction is approved or declined within seconds. Virtual terminals carry higher fraud risk because you are entering the data yourself rather than the customer entering it into an encrypted form, so some processors charge a higher fee (up to 3.5% instead of 2.5%) or require you to verify the customer's identity first.
Never store a customer's card details in an email, text, or unencrypted file. If you need to process the same customer repeatedly, ask your processor about tokenization—storing an encrypted version of the card that you can use to charge them again without asking for the full number each time.
How the transaction actually moves through the system
When a customer swipes, inserts, taps, or enters their card, the card reader or payment form captures the data and encrypts it immediately. The encrypted data is sent to your processor's servers. The processor then contacts the card network (Visa, Mastercard, American Express, or Discover), which routes the request to the customer's bank.
The customer's bank checks whether the card is valid, whether the account has enough funds or available credit, and whether the transaction matches the customer's typical spending pattern. If everything looks good, the bank approves the charge and sends a code back through the network to your processor. Your processor displays "Approved" on the reader or form, and the customer's receipt is generated.
The customer's bank then deducts the amount from their account and sends the money to your processor's bank account. Your processor deducts its fee and deposits the remainder into your merchant account, usually within one to two business days. The entire process—from card swipe to approval—takes seconds. Settlement (the money actually arriving in your account) takes longer.
Fees, deposits, and when money reaches your account
Every card transaction costs you a fee. The fee structure varies by processor and card type, but typically breaks down as follows: a percentage of the sale (1.5% to 3.5%), a flat per-transaction fee ($0.25 to $0.30), and sometimes a monthly account fee ($10 to $30). American Express and Discover often charge higher percentages than Visa and Mastercard because they are card-issuing networks, not just payment networks.
Your processor batches all your transactions from a given day and submits them for settlement. Settlement usually takes one to two business days, meaning the money lands in your merchant account on day two or three after the sale. Some processors offer next-day settlement for an extra fee, or instant settlement for a higher percentage fee.
If a customer disputes a charge or files a chargeback (tells their bank the charge was unauthorized or the product never arrived), the processor reverses the transaction and deducts the amount from your account. You then have a window—usually 7 to 10 days—to provide evidence that the transaction was legitimate (a signed receipt, shipping confirmation, or email correspondence). If you cannot prove it, you lose the money and may also pay a chargeback fee ($15 to $100).
Security and your responsibility to protect card data
When you use a PCI-compliant processor (one that meets Payment Card Industry Data Security Standard requirements), the processor is responsible for protecting card data and you are protected from liability if a breach occurs. PCI compliance means the processor encrypts card data, uses secure servers, and undergoes regular security audits. All major processors—Square, Stripe, PayPal, Shopify—are PCI-compliant.
Your responsibility is to never store full card numbers, expiration dates, or CVVs in plain text. Never email a customer's card details, write them in a spreadsheet, or save them in an unencrypted file. If you need to store card information for repeat charges, use your processor's tokenization feature, which stores an encrypted token instead of the actual card number.
If you use a virtual terminal or manually enter card details, take extra care: verify the customer's identity, check that the card number and expiration date match, and never process a transaction if the customer seems uncertain or the request seems unusual. If a customer calls with a card number and you are unsure whether they are the actual cardholder, ask for their billing address and the CVV as verification.
Choosing between processors based on your business type
For a small retail business or service provider, Square or PayPal Here offer the fastest setup and lowest barrier to entry. You buy a reader, download the app, and start accepting cards the same day. Fees are straightforward: around 2.6% plus $0.30 per transaction for in-person cards, and 2.9% plus $0.30 for online payments.
For an online store, Stripe or Shopify Payments integrate directly with your website and invoice software. Stripe works with any website builder; Shopify Payments is built into Shopify. Both charge similar fees and settle within one to two business days.
For high-volume businesses processing thousands of dollars per month, a dedicated payment processor or your bank's merchant services may offer lower fees. These routes require more paperwork and take longer to set up (one to two weeks), but fees can drop to 1.5% to 2% for in-person transactions. You typically need a business bank account, tax ID, and proof of business registration.
If you process a mix of in-person and online payments, choose a processor that handles both well. Square, Stripe, and PayPal all do. Compare their fee structures for your typical transaction size and volume before committing.
Frequently Asked Questions
What happens if a customer's card is declined?
The processor receives a decline code from the customer's bank—usually "insufficient funds," "card expired," "incorrect PIN," or "card not activated." The reader or form displays the decline immediately. You can ask the customer for a different card or payment method. The declined transaction does not charge the customer and does not cost you a fee.
Can I accept credit cards without a business bank account?
Yes. Third-party processors like Square and Stripe deposit money into any bank account in your name, including a personal checking account. However, mixing personal and business money makes tax time harder. If you are running a business, a separate business account is worth opening.
Do I have to accept all card types?
No. You can choose to accept only Visa and Mastercard, for example, and decline American Express and Discover. However, most customers expect you to accept all major cards, so declining some may cost you sales. Most processors charge the same fee for all card types, so there is no cost advantage to being selective.
What if a customer claims they never received the product or service?
The customer can file a chargeback with their bank. You then have 7 to 10 days to provide evidence that the transaction was legitimate—a shipping confirmation, delivery signature, receipt, or email correspondence showing the customer received what they paid for. If you provide proof, the chargeback is usually reversed and the money stays in your account. If you cannot prove it, you lose the money and pay a chargeback fee.
How long does it take to get paid after a customer swipes their card?
The transaction is approved within seconds. Settlement (the money actually reaching your account) usually takes one to two business days. Some processors offer next-day settlement for a fee. Weekends and holidays can delay settlement by a day.