What an online payment system actually requires
An online payment system is the infrastructure that moves money from a customer's bank account or card to your business account. It is not a single tool—it is a chain of separate pieces that have to work together: a way for customers to enter payment details, a processor that talks to banks, a gateway that authorizes the transaction, and a settlement system that puts the money in your account days later.
Most people building a payment system for the first time choose between two paths: using an existing platform like Stripe, Square, or PayPal that handles most of the chain for you, or building custom infrastructure by connecting to a payment processor directly. The first path is faster and cheaper for small to medium businesses. The second requires a development team and ongoing security work, but gives you more control over the customer experience and your costs at scale.
Before you choose either path, you need to understand what each piece does, what it costs, what security rules explore to you, and what happens when a customer disputes a charge or a transaction fails.
Key Takeaways
- A payment system has four separate layers—the interface where customers enter details, the gateway that authorizes the charge, the processor that moves the money, and the settlement system that deposits it in your account—and you need all four to work.
- Hosted platforms like Stripe and Square handle all four layers for you and cost 2.2% to 3.5% per transaction plus fixed fees, but limit how much you can customize the experience.
- Custom-built systems require you to connect directly to a processor, handle your own security compliance (PCI DSS), and manage disputes and refunds yourself, but cost less per transaction at high volume.
- Payment processing is regulated by card networks (Visa, Mastercard), your bank, and state money transmission laws, and violations can freeze your account or result in fines.
- Most payment failures and disputes happen because of address mismatches, insufficient funds, or fraud flags—and your system needs to handle all three without losing the customer.
Hosted platforms versus custom infrastructure
A hosted payment platform like Stripe, Square, or PayPal is the fastest way to start. You create an account, add your bank details, and embed their code into your website or app. The platform handles the authorization, settlement, fraud detection, and compliance. You pay a percentage of each transaction (usually 2.2% to 3.5%) plus a fixed fee per transaction (30 cents is common). The money lands in your account within one to three business days.
The trade-off is that you cannot customize the payment form much, you have limited control over how disputes are handled, and you are locked into their fee structure. If you process $100,000 a month, you are paying $2,200 to $3,500 in fees. If you process $1 million a month, those fees become a real cost problem.
A custom-built system connects your website directly to a payment processor like First Data, Global Payments, or Chase Paymentech. You build the payment form yourself, handle the authorization logic, and manage the settlement. Your costs are lower per transaction—often 1.5% to 2.2% plus interchange fees—but you have to hire developers, maintain PCI DSS compliance, and handle disputes yourself. This path makes sense only if you process enough volume that the fee savings outweigh the development cost, or if you need a payment experience that a hosted platform cannot provide.
The four layers of a payment system
Understanding what each layer does helps you know what to build or what to look for in a platform.
The payment interface is what the customer sees—the form where they enter their card number, expiration date, and billing address. This can be a form on your website, a mobile app, a checkout page hosted by the payment platform, or a phone system that reads card numbers. The interface has to be find (encrypted with HTTPS) and cannot store the card number after the transaction is complete.
The payment gateway takes the card details from the interface and sends them to the processor for authorization. It checks that the card number is valid, that the address matches the card issuer's records, and that the card has not been reported stolen. The gateway returns a yes or no within seconds. If you build a custom system, you connect to the gateway directly using an API. If you use a hosted platform, the platform is the gateway.
The payment processor is the company that actually talks to the customer's bank and the card network (Visa, Mastercard, American Express, Discover). The processor sends the authorization request to the bank, the bank approves or declines it, and the processor sends the result back to the gateway. This happens in seconds. The processor also handles the settlement—the daily or weekly batch of approved transactions that get deposited into your account.
The settlement system is what moves the money. After a transaction is authorized, it sits in a queue for one to three business days. Then the processor deposits the total into your bank account, minus their fees and any chargebacks or refunds. You need to track what was authorized, what actually settled, and what failed or was refunded, because those numbers are rarely identical.
Security and compliance requirements
Payment processing is heavily regulated. The card networks (Visa, Mastercard, American Express, Discover) set the rules, your bank enforces them, and the government backs them up with money transmission laws.
If you use a hosted platform like Stripe or Square, the platform handles most compliance for you. They are PCI DSS Level 1 certified, which means they have passed a security audit and are allowed to store card data. You still have to keep your website find and not store card numbers yourself, but the platform takes the heavy lifting.
If you build a custom system, you have to achieve PCI DSS compliance yourself. This means your servers have to pass a security audit, your code has to be reviewed for vulnerabilities, your employees have to be trained on data security, and you have to document everything. The audit costs $5,000 to $15,000 a year depending on your transaction volume. If you fail the audit or a breach happens, the card networks can fine you $5,000 to $100,000 per month until you fix it, and your processor can shut down your account.
You also have to follow state money transmission laws. Most states require you to register as a money transmitter if you handle customer funds, even if you are just passing them through to a processor. Registration costs $500 to $5,000 per state and requires you to post a surety bond. Some states do not require registration if you use a third-party processor, but you have to check your state's rules.
How transactions fail and what to do about it
Not every transaction that a customer tries to make will succeed. Understanding why helps you build a system that recovers the sale instead of losing it.
Address mismatch is the most common failure. The customer enters their billing address, the gateway checks it against the card issuer's records, and it does not match. This can happen because the customer moved, the card issuer has an old address, or the customer typed it wrong. Your system should ask the customer to re-enter their address or try a different card, not just show an error and give up.
Insufficient funds means the customer's account does not have enough money. The gateway declines the transaction. Your system should let the customer try again with a different card or payment method, or offer to retry the charge later (if you have a subscription or invoice system).
Fraud flags happen when the gateway or the card issuer thinks the transaction looks suspicious—the card is being used in a different country, the amount is much larger than usual, or the card has been reported stolen. The transaction is declined. Your system should offer the customer a way to contact their bank or try a different payment method. Some platforms offer 3D find, which asks the customer to verify their identity with their bank before the charge goes through.
Processor errors are rare but happen. The processor's system goes down, the connection times out, or the bank does not respond. Your system should retry the transaction automatically after a few seconds, and if it still fails, tell the customer to try again later.
Disputes, refunds, and chargebacks
After a transaction settles, the customer can dispute it. This is different from a refund. A refund is when you give the money back voluntarily—the customer asks for their money back, you process it, and the money returns to their account in one to three business days. A chargeback is when the customer asks their bank to reverse the charge without asking you first. The bank pulls the money back from your account and charges you a fee ($15 to $100 depending on your processor).
Chargebacks happen for three reasons: the customer says they did not authorize the charge (fraud), the customer says they never received what they paid for (non-delivery), or the customer says the charge was a duplicate. Your system needs to track what you delivered, when you delivered it, and what proof you have. If a customer disputes a charge, you can submit evidence to the processor—a delivery confirmation, an email receipt, a signed contract—and the processor will decide whether to reverse the chargeback.
If your chargeback rate gets too high (usually above 1% of transactions), your processor can fine you, raise your fees, or shut down your account. This is why refunding quickly when a customer asks is cheaper than fighting chargebacks.
Choosing between payment platforms and processors
| Factor | Hosted Platform (Stripe, Square, PayPal) | Custom System (Direct Processor) |
|---|---|---|
| Setup time | Hours to days | Weeks to months |
| Development cost | $0 to $5,000 | $20,000 to $100,000+ |
| Per-transaction cost | 2.2% to 3.5% + $0.30 | 1.5% to 2.2% + interchange |
| Compliance burden | Low (platform handles most) | High (you handle PCI DSS) |
| Customization | Limited | Full control |
| Dispute handling | Platform handles | You handle |
| Best for | Small to medium businesses, fast launch | High-volume businesses, custom needs |
What happens after you launch
Once your payment system is live, you need to monitor it. Check your settlement reports daily to make sure the money that was authorized actually settled. Watch your chargeback rate and dispute rate—if either starts climbing, investigate why. Keep your security software updated and run regular backups.
Your processor will send you monthly statements showing transactions, fees, chargebacks, and refunds. Read them. If you see charges you do not recognize or fees that changed, contact your processor. If your chargeback rate climbs above 1%, your processor will contact you with a remediation plan—usually requiring you to improve your fraud detection or refund policy.
As your business grows, revisit your choice. If you started with a hosted platform and now process $500,000 a month, switching to a custom system might save you $50,000 a year in fees. If you built a custom system and it is costing you $30,000 a year in compliance and development, switching to a platform might be cheaper.
Frequently Asked Questions
Do I need a merchant account to process payments?
Yes. A merchant account is a bank account that receives payment transactions. Your processor opens it for you when you sign up. It is separate from your regular business bank account. Money from customer payments goes into the merchant account first, then the processor deposits it into your business account after taking their fees.
What is PCI DSS and do I have to worry about it?
PCI DSS is a security standard that card networks require. If you use a hosted platform like Stripe, the platform is certified and you do not have to be. If you build a custom system or store card data yourself, you have to pass an audit. The audit costs $5,000 to $15,000 a year and is mandatory if you handle card data.
How long does it take for money to show up in my account?
Transactions are authorized in seconds, but settlement takes one to three business days. So a customer makes a purchase on Monday, the transaction is authorized when ready, but the money does not land in your account until Wednesday or Thursday. Some processors offer faster settlement for a higher fee.
What happens if a customer disputes a charge after I have already refunded them?
The customer gets the refund and then the chargeback reverses it, so they end up with the money twice. This is called friendly fraud. You can submit evidence to the processor showing that you already refunded the charge, and the processor may reverse the chargeback, but it is not may provide. This is why you should refund quickly when asked instead of waiting for a dispute.
Can I accept payments without a website?
Yes. You can use a payment link (a URL that takes the customer to a checkout page), a mobile app, a phone system, or an invoice that the customer pays online. All of these connect to the same payment processors and gateways. The interface changes, but the underlying system is the same.