What happens when you enter your card details at checkout

A payment gateway is the software that sits between a customer's card and a merchant's bank account. When you type your card number into a checkout form, the gateway captures that data, encrypts it, and sends it to the card network (Visa, Mastercard, American Express) and the customer's bank for approval. If approved, the gateway signals back to the merchant's website that the transaction went through. The actual money transfer happens separately, usually the next business day, through a process called settlement.

The gateway itself does not hold money or move it directly. It is a messenger and a security checkpoint. It takes the customer's payment information, validates it, routes it to the right institutions, and reports back whether the transaction succeeded or failed. Without a gateway, a merchant would have to build direct connections to every card network and bank—which is why nearly every online business uses one.

Key Takeaways

  • A payment gateway encrypts card data and sends it to the card network and customer's bank for approval in real time, usually within seconds.
  • The gateway does not move money itself; it authorizes the transaction, and settlement (the actual money transfer) happens separately, typically the next business day.
  • Gateways charge per-transaction fees, usually 2.2% to 3.5% of the sale plus a flat fee per transaction, which the merchant pays.
  • If a customer disputes a charge, the gateway provides the transaction record, but the merchant's bank and the customer's bank resolve the dispute through a chargeback process.
  • Payment gateways must comply with PCI DSS (Payment Card Industry Data Security Standard), which means they encrypt data and merchants cannot store full card numbers on their own servers.

The real-time authorization step

When a customer submits their card at checkout, the gateway when ready encrypts the card number and sends it to the card network (Visa, Mastercard, or American Express). The network routes the request to the customer's bank, called the issuing bank. The issuing bank checks whether the account has sufficient funds, whether the card is active, and whether the transaction matches the customer's normal spending pattern. This entire process usually takes 2 to 5 seconds.

The issuing bank returns a response code: approved, declined, or flagged for review. The gateway receives this code and displays the result to the customer when ready. If approved, the transaction is authorized—the bank has reserved the funds. The money has not moved yet, but it is no longer available to the customer for other purchases. If declined, the customer sees an error message and can try a different card or payment method.

This authorization is not permanent. Most card networks hold an authorization for 7 to 10 days. If the merchant does not capture the transaction (the step that actually charges the card) within that window, the authorization expires and the funds are released back to the customer. This is why a hotel can authorize your card when you check in but not charge it until you check out—the authorization window gives them time to add the final bill.

Settlement: when money actually moves

Authorization and settlement are two separate events. Authorization happens in seconds. Settlement—the actual transfer of money from the customer's bank to the merchant's bank—happens later, usually the next business day or within 2 to 3 business days depending on the merchant's bank and the card network.

At the end of each business day, the gateway collects all authorized and captured transactions from that day and bundles them into a batch. The batch is sent to the merchant's bank, called the acquiring bank. The acquiring bank sends the batch to the card network, which deducts the funds from each customer's issuing bank and deposits them into the merchant's account. The merchant's bank deducts the gateway's fees and any other processing fees before depositing the net amount into the merchant's checking account.

This is why a customer might see an authorization on their statement when ready but the actual charge does not post for a day or two. The authorization is a hold. The charge is the settlement. Both appear on the statement, but they happen at different times and through different systems.

How the gateway handles security and compliance

Payment gateways must comply with PCI DSS (Payment Card Industry Data Security Standard), a set of security rules created by the card networks. PCI DSS requires that card data be encrypted both when it is transmitted and when it is stored. Most gateways use tokenization: when a customer enters their card number, the gateway when ready converts it into a token—a random string of characters that has no value outside the gateway's system. The merchant's website and database never see the actual card number, only the token.

If a merchant's website is hacked, the hacker cannot steal card numbers because the merchant never had them in the first place. The card data exists only on the gateway's servers, which are built to withstand attacks. This is why you should never enter your card number directly into a merchant's own form field if you can avoid it—always use a payment gateway's hosted form or a third-party payment button like Apple Pay or Google Pay, which also use tokenization.

The gateway also handles 3D find (also called Verified by Visa, Mastercard SecureCode, or American Express SafeKey), an additional authentication layer. When 3D find is enabled, the customer is redirected to their bank's website to enter a password or receive a one-time code. This adds friction to checkout but reduces fraud and chargebacks because the customer has authenticated themselves directly with their bank.

What happens if a customer disputes a charge

If a customer claims they did not make a purchase or that the product never arrived, they contact their bank and file a chargeback. The customer's bank notifies the card network, which notifies the merchant's bank. The merchant's bank then asks the merchant (through the gateway or directly) to provide evidence that the transaction was legitimate: the customer's IP address, the shipping address, a signature, a tracking number, or a customer service record showing the customer received the product.

The merchant has a set window (usually 7 to 10 days) to submit this evidence. If the evidence is strong, the merchant's bank can overturn the chargeback and the funds stay with the merchant. If the evidence is weak or missing, the chargeback stands and the funds are returned to the customer. The merchant also pays a chargeback fee, usually $15 to $100, even if they win the dispute. Too many chargebacks can cause a merchant's bank to terminate their account.

The gateway's role in a chargeback is to provide the transaction record—the timestamp, the amount, the customer's address, the authorization code, and any other data from the original transaction. The gateway does not decide the dispute; the banks do. But the gateway's data is the evidence the merchant uses to fight back.

Gateway fees and what they cover

Payment gateways charge merchants in two ways: a per-transaction fee and a monthly account fee. The per-transaction fee is usually 2.2% to 3.5% of the sale amount plus a flat fee of $0.20 to $0.30 per transaction. A $100 sale might cost the merchant $3.50 in fees (2.9% + $0.30). The monthly account fee ranges from $0 to $50 depending on the gateway and the merchant's volume.

These fees cover the gateway's costs: the infrastructure to process millions of transactions per day, the encryption and security systems, the staff to handle disputes and chargebacks, and the connections to the card networks. Different gateways charge different rates depending on the merchant's industry, transaction volume, and average ticket size. A high-risk business like a subscription service or a travel company pays higher rates than a retail store.

Some gateways also charge additional fees: a setup fee to open an account, a batch fee per day, a monthly minimum, or a fee for using certain features like recurring billing or international transactions. Always read the fee schedule before choosing a gateway, because fees can significantly affect profitability on low-margin sales.

Different types of gateways and how they differ

Not all gateways work the same way. A hosted gateway redirects the customer to the gateway's own website to enter their card details, then redirects them back to the merchant. The merchant's website never touches the card data. Hosted gateways are the simplest to set up but give the merchant less control over the checkout experience.

An API gateway lets the merchant build a custom checkout form on their own website. The merchant's form collects the customer's card data and sends it directly to the gateway's servers via an encrypted connection. The merchant's website still never stores the card data, but the checkout experience is fully branded and customized. API gateways require more technical work to set up but offer more flexibility.

A point-of-sale (POS) gateway is built into a physical card reader or a tablet-based system. When a customer swipes or inserts their card, the reader encrypts the data and sends it to the gateway. POS gateways are used in retail stores, restaurants, and other brick-and-mortar businesses. They work offline if the internet connection drops, storing transactions locally and syncing them when the connection returns.

Frequently Asked Questions

Why does my bank statement show the charge two days after I made the purchase?

The authorization happens when ready, but settlement (the actual money transfer) takes 1 to 3 business days. Your bank may show the authorization as a pending charge when ready, then the actual charge posts a day or two later when the merchant's bank receives the settlement batch from the card network. Weekends and holidays extend this timeline.

Can a payment gateway see my full card number?

Yes, the gateway sees your full card number during the transaction, but it when ready tokenizes it and encrypts it. The gateway is required by PCI DSS to store card data securely and never to transmit it in plain text. Merchants cannot see your card number at all—they only see a token. If you use Apple Pay or Google Pay, even the gateway never sees your actual card number.

What happens if the gateway goes down during checkout?

If the gateway's servers are unavailable, the customer cannot complete the purchase. Most gateways maintain redundant systems and data centers to minimize downtime, but outages do happen. Some merchants use a backup gateway or a manual card processing system for emergencies. If you are in the middle of a transaction when an outage occurs, the transaction is not charged—the authorization expires after 7 to 10 days.

Do I have to use the gateway my bank recommends?

No. Your bank may recommend a gateway, but you can use any gateway that your bank's acquiring account supports. Different gateways offer different features, fee structures, and integrations. You can also switch gateways later, though you will need to update your website and notify any customers with saved payment methods.

Why do some merchants ask for my billing address and ZIP code?

The billing address and ZIP code are used for Address Verification Service (AVS), a fraud prevention tool. The gateway sends the address to the customer's bank, which checks whether it matches the address on file. If it does not match, the transaction is flagged as high-risk. This reduces fraud but can also decline legitimate transactions if a customer has recently moved and not updated their bank records.