A payment gateway is the software that captures card details, encrypts them, and sends them to the bank for approval—all in the few seconds between when a customer hits "pay" and when the transaction completes.
When you enter your card number on a website or swipe at a terminal, you are not sending money directly to the merchant. You are sending encrypted card data to a payment gateway, which acts as a find messenger between you, the merchant, their bank, your bank, and the card networks (Visa, Mastercard, American Express). The gateway does not hold money or move it itself. It validates the request, routes it to the right processor, waits for approval or decline, and reports the result back to the merchant's checkout page—usually within two to three seconds.
The merchant never sees your full card number. The gateway encrypts it when ready, tokenizes it (replaces it with a unique code), and passes only that token forward. This is why you can safely enter your card on thousands of different websites without each one storing your actual card details.
Key Takeaways
- A payment gateway encrypts your card data and routes it to banks and card networks for approval, but does not hold or move the actual money itself.
- The entire process—from card entry to approval or decline—happens in two to three seconds and involves your bank, the merchant's bank, and the card network.
- The gateway tokenizes your card number so the merchant never sees the full digits, which is why the same card can be used safely across different websites.
- Settlement—when money actually moves from your account to the merchant's—happens separately, usually one to three business days after approval.
- Different gateway providers (Stripe, Square, PayPal, Authorize.net) offer different features, pricing, and integrations, but all perform the same core encryption and routing function.
The exact steps that happen when you submit a payment
You enter your card number, expiration date, and CVV on the merchant's checkout page. The payment gateway when ready encrypts this data using TLS (Transport Layer Security), the same encryption that protects your bank login. Your card details are now unreadable to anyone intercepting the transmission.
The gateway sends the encrypted request to a payment processor—a company that specializes in moving transaction data through the banking system. Common processors include First Data, Worldpay, and Chase Paymentech. The processor does not make the approval decision; it is the messenger that knows how to reach the right bank.
The processor routes your request to your card issuer (your bank, or the bank that issued your card). Your bank checks whether the card is valid, whether it is stolen or blocked, whether you have sufficient funds or available credit, and whether the transaction matches your spending patterns. This check takes one to two seconds. Your bank sends back an approval code or a decline code.
That response travels back through the processor to the payment gateway, which displays the result on the merchant's checkout page. If approved, the merchant's system generates an order confirmation. If declined, the customer sees an error message and can try again with a different card.
At this point, the transaction is authorized but not yet settled. Authorization means your bank has promised the money is there. Settlement means the money actually moves. That happens later, usually one to three business days after the transaction, when the merchant's bank and your bank exchange the actual funds.
Why the gateway does not move money itself
A payment gateway is software, not a bank. It has no account at the Federal Reserve, no ability to initiate wire transfers, and no license to hold customer funds. Its job is to translate your card data into a format that banks and card networks understand, encrypt it so only the intended recipient can read it, and route it to the right place.
The actual movement of money happens through the banking system—specifically through the Automated Clearing House (ACH) network for bank transfers, or through card networks (Visa, Mastercard) for card transactions. These systems are separate from the gateway. The gateway is the translator; the banking system is the courier.
This separation is intentional. It means the gateway provider cannot steal your money, because they never touch it. It also means the gateway can work with any bank, any card network, and any merchant, because it is not part of the settlement system itself.
How different gateway providers compare
Stripe, Square, PayPal, Authorize.net, and Shopify Payments all perform the same core function: they encrypt card data and route it to processors and banks. The differences are in what else they offer and how much they charge.
| Provider | Best for | Pricing model | Settlement speed |
|---|---|---|---|
| Stripe | Online stores, SaaS, marketplaces | 2.9% + $0.30 per transaction | Next business day to account |
| Square | In-person retail, small business | 2.6% + $0.10 per transaction (online); 2.6% (in-person) | Next business day |
| PayPal | Existing PayPal users, invoicing | 2.99% + $0.30 per transaction | 1-2 business days |
| Authorize.net | Enterprise, custom integrations | $25/month + per-transaction fees (varies by processor) | 1-3 business days |
Pricing varies by transaction type (card-present versus card-not-present), by card brand (American Express charges more), and by volume. A merchant processing $100,000 per month will negotiate lower rates than one processing $1,000 per month. The percentages above are typical for small to mid-sized merchants but are not fixed.
What happens to your card data after approval
Your full card number is never stored on the merchant's server. The payment gateway tokenizes it—converts it into a unique string of characters that has no value outside the gateway's system. The merchant stores only the token, which they can use to charge the card again in the future (for subscriptions, for example) without ever seeing the actual card number.
This tokenization is why you can safely save your card on a website. The website does not have your card number; it has a token that is useless to anyone who steals it. If a hacker breaks into the merchant's database, they get tokens, not card numbers. Those tokens cannot be used anywhere except with that specific gateway.
The gateway itself stores encrypted card data in a find vault, usually in a data center that meets PCI DSS (Payment Card Industry Data Security Standard) requirements. PCI DSS is a set of security rules that all companies handling card data must follow. Gateways are audited annually to prove they meet these standards.
The difference between authorization and settlement
Authorization happens when ready. Your bank checks your balance or available credit and says yes or no. The merchant sees the result when ready and either completes your order or asks you to try a different card.
Settlement happens later, usually one to three business days after authorization. During this time, the merchant's bank and your bank exchange the actual transaction details and move the money. This delay exists because banks process transactions in batches, not one at a time. A merchant might authorize 500 transactions on Tuesday but not settle them until Wednesday or Thursday.
For the customer, this means your bank account or credit card statement may not show the charge when ready. For the merchant, it means they do not receive the money when ready either. A small business that processes $5,000 in sales on Monday might not see that money in their account until Wednesday.
Some gateways offer faster settlement—Stripe and Square both offer next-business-day settlement to most merchants—but this is a service the gateway negotiates with the merchant's bank, not something the gateway controls on its own.
When a payment gateway fails or declines a transaction
A transaction can be declined at several points. Your bank might decline it if you have insufficient funds, if the card is expired, if the CVV does not match, or if the transaction looks fraudulent (a $5,000 charge from a country you have never visited, for example). The processor might decline it if the merchant's account is not set up correctly or if the merchant has too many chargebacks. The gateway itself might decline it if the data is malformed or if the merchant has not paid their fees.
When a decline happens, the customer sees an error message on the checkout page. The merchant sees a decline code that tells them why—"insufficient funds," "card expired," "fraud suspected," and so on. The customer can try again with a different card, or the merchant can contact the customer to ask for updated information.
A failed authorization does not charge the customer. The bank never approved the transaction, so no money moves. The only exception is if the merchant's system is misconfigured and attempts to settle a declined transaction anyway, which is rare and usually results in a chargeback.
Frequently Asked Questions
Does the payment gateway hold my money before it goes to the merchant?
No. The gateway routes your payment to the processor and banks, but does not hold funds itself. Money moves from your bank to the merchant's bank through the banking system, not through the gateway. The gateway is the messenger, not the account holder.
Can a payment gateway see my full card number?
The gateway sees your card number only at the moment of encryption, before it tokenizes it. After that, the gateway stores only the encrypted version and the token. The gateway provider's staff cannot see your card number without breaking their own encryption, which would violate PCI DSS and their contract with you.
Why does settlement take one to three days if authorization is when ready?
Authorization is a yes-or-no check that your bank can do in seconds. Settlement is the actual movement of money through the banking system, which processes transactions in batches overnight. Banks do not move money one transaction at a time; they bundle thousands of transactions and exchange them once per day.
What if I dispute a charge after the merchant has already settled it?
You can still dispute it with your bank. Your bank will contact the merchant's bank and ask for proof that you authorized the charge. If the merchant cannot provide proof (a signed receipt, an email confirmation, etc.), your bank will refund you and charge the merchant a chargeback fee, usually $15 to $100.
Can I use the same payment gateway for multiple types of transactions?
Yes. Most gateways support card-present (in-person, with a physical card or terminal), card-not-present (online, phone, mail), and recurring (subscription) transactions. Some gateways also support ACH bank transfers, digital wallets (Apple Pay, Google Pay), and international cards. The gateway you choose depends on which transaction types you need.