What a payment gateway does

A payment gateway is the technology that captures card or bank details from a customer, encrypts them, and sends them to the right financial institution to approve or decline the transaction. It sits between your checkout page and the banks involved—the customer's bank and yours. The gateway does not hold money or decide whether to fund you; it moves the request through the system and reports back whether the payment went through.

Think of it as a translator. Your customer enters their card number on your website or app. The gateway takes that information, formats it in a way the banking system understands, passes it along, waits for a yes or no, and tells your checkout page what happened—usually in under three seconds. If the answer is yes, the money moves. If it is no, the customer sees a decline message and can try again or use a different card.

The gateway itself does not move the actual money. That happens through a separate system called a payment processor, which handles the settlement—the actual transfer of funds from the customer's account to yours, usually one to three business days later. Many companies offer both services together, which can make the distinction blurry, but they are two different jobs.

Key Takeaways

  • A payment gateway encrypts and transmits payment information from your customer to their bank and yours, then reports whether the transaction was approved.
  • The gateway does not hold money or move funds; it only carries the request and the answer, which takes a few seconds.
  • Settlement—the actual transfer of money to your account—happens separately through a processor, usually one to three business days after approval.
  • Gateways charge per transaction (typically 2 to 3 percent plus a flat fee) and require you to have a merchant account or a connection to one.
  • Different gateways support different payment methods, so your choice affects what your customers can use to pay you.

The step-by-step flow of a payment

When a customer clicks "Pay Now," the gateway begins a chain of events that happens in seconds. First, it collects the payment details—card number, expiration date, CVV, billing address—and encrypts them so no one in between can read them. This encryption standard is called PCI DSS (Payment Card Industry Data Security Standard), and it is a legal requirement for anyone handling card data.

Next, the gateway sends the encrypted request to the customer's bank (called the issuing bank) through a network like Visa or Mastercard. The issuing bank checks whether the account exists, whether there are sufficient funds, whether the card is stolen or flagged, and whether the transaction matches the customer's normal spending pattern. This is where most declines happen—insufficient funds, fraud flags, or a card that has been reported lost.

The issuing bank sends back an approval code or a decline code. The gateway receives this response and when ready tells your checkout page what happened. If approved, the transaction is marked as pending settlement. If declined, your customer sees a message and can try another payment method. At this point, no money has actually moved—only information has traveled back and forth.

Later—usually the next business day—the processor collects all approved transactions from your account and batches them together. It sends this batch to your bank (your acquiring bank) with instructions to deposit the total into your account. Your bank then deducts the gateway and processor fees and deposits the remainder. This settlement window is why you do not see money from today's sales until tomorrow or the day after.

What gateways charge and why

Payment gateways charge in two ways: a per-transaction fee and sometimes a monthly account fee. The per-transaction fee is usually a percentage of the sale (2 to 3 percent is common) plus a flat amount per transaction (often $0.20 to $0.50). So a $100 sale might cost you $2.50 to $3.50 to process.

The percentage covers the risk the gateway and processor take on. Every transaction carries a small chance of fraud, a chargeback (a customer disputing the charge with their bank), or a failed settlement. The flat fee covers the cost of running the infrastructure—the servers, the encryption, the connection to the banking networks, the customer support team. Larger companies sometimes negotiate lower rates, but the basic structure stays the same.

Some gateways also charge a monthly account fee ($10 to $30) just to keep your account open, even if you process no transactions. Others waive this if you meet a minimum monthly volume. A few charge setup fees or fees for features like recurring billing or international transactions. Before you choose a gateway, add up the total cost of a typical month of your sales, not just the per-transaction rate.

How gateways handle security and fraud prevention

The gateway itself does not store your customer's card number after the transaction is complete. It passes the encrypted data through and then discards it. This is why you never see full card numbers in your records—only the last four digits and a token (a unique code that represents that card for future transactions, if the customer allows it).

Most gateways include basic fraud detection: they flag transactions that do not match the customer's usual pattern, that come from a different country than their billing address, or that exceed a certain amount. Some gateways let you set your own rules—for example, decline any transaction over $500 or from a specific country. These tools are not perfect, but they catch obvious fraud before it reaches your bank.

For higher-risk businesses (like online retail or digital goods), gateways offer 3D find, a system that asks the customer to verify their identity with their bank during checkout—usually by entering a code sent to their phone. This adds a step to checkout but significantly reduces fraud and chargebacks because the bank has confirmed the customer is real.

Different types of gateways and what they support

Not all gateways work the same way. Some are hosted gateways—they redirect your customer to a payment page that the gateway controls, then send the customer back to you after the transaction. This is simpler to set up because you do not handle the card data yourself, but it interrupts the checkout flow and can feel less integrated.

Others are integrated gateways—they sit on your own checkout page and handle the payment without leaving your site. This feels smoother to customers but requires you to meet higher security standards and handle more of the technical setup. Examples include Stripe, Square, and PayPal's payment gateway.

Some gateways specialize in certain payment methods. Stripe and Square handle cards and bank transfers. PayPal's gateway handles PayPal accounts and cards. Authorize.net handles cards and some alternative methods. If your customers want to pay with digital wallets like Apple Pay or Google Pay, or with international methods like iDEAL or Alipay, you need a gateway that supports those. This is one of the most important differences between gateways—not which one is "best," but which one accepts the payment methods your customers actually use.

What happens when a payment fails

If the gateway receives a decline from the issuing bank, it tells your checkout page when ready. The customer sees a message like "Card declined" or "Insufficient funds." At this point, nothing has been charged. The customer can try a different card, update their billing address, or contact their bank to find out why the card was declined.

Some gateways offer retry logic—they automatically try the transaction again a few hours later if it failed the first time. This helps when a decline was temporary (like a fraud flag that the customer's bank has now cleared). But if the customer does not fix the underlying problem, the retry will fail too.

If a customer disputes a charge after it has settled, that is a chargeback, and it is handled by the banks and the card networks, not by the gateway. The gateway may flag the transaction as disputed in your records, but the actual reversal of funds happens through a separate process. Chargebacks are expensive—you usually lose the sale amount plus a $15 to $100 chargeback fee—so preventing them through clear communication and good customer service is cheaper than fighting them.

Choosing a gateway for your situation

The right gateway depends on what you sell, where your customers are, and how much you process. If you run a small online store and your customers are mostly in the United States paying with cards, Stripe or Square will work fine and cost roughly the same. If you sell internationally, you need a gateway that supports multiple currencies and payment methods in those countries—Stripe handles this better than most.

If you run a subscription business, you need a gateway with strong recurring billing features. If you sell in person and online, you might want a processor like Square that handles both. If you have very high transaction volume, you might negotiate directly with an acquiring bank instead of using a third-party gateway, though this requires more technical work and higher security standards.

The gateway you choose also affects your customers' experience. A gateway that supports Apple Pay and Google Pay means customers can check out in one tap. A gateway with poor fraud detection might decline legitimate transactions and frustrate your customers. A gateway with slow settlement might leave you waiting longer for your money. These are not just technical details—they affect your revenue and your reputation.

Frequently Asked Questions

Does the payment gateway hold my money?

No. The gateway transmits the payment request and reports the result, but it does not hold funds. Your processor collects approved transactions and sends them to your bank, which deposits the money into your account after deducting fees. The time between approval and deposit is usually one to three business days.

What is the difference between a gateway and a processor?

The gateway captures and encrypts the payment information and sends it to the banks for approval. The processor batches approved transactions and arranges the actual transfer of money from the customer's bank to yours. Many companies offer both services, which is why the terms are often used together, but they are two separate functions.

Can I use the same gateway for online and in-person payments?

Some gateways support both, but not all. Stripe and Square both handle online and in-person payments, though in-person usually requires a card reader. Check the gateway's documentation to see which payment methods and channels it supports before you sign up.

What happens if a customer's card is declined?

The gateway receives the decline from the customer's bank and when ready tells your checkout page. The customer sees a decline message and can try a different card or payment method. No charge is made. The customer should contact their bank to find out why the card was declined.

Are payment gateways safe for customers?

Yes, if the gateway is PCI DSS compliant. This means it encrypts card data, does not store full card numbers after the transaction, and meets strict security standards. Reputable gateways like Stripe, Square, and PayPal are all PCI compliant. You should never use a gateway that is not certified.