A payment gateway is the software layer that sits between your online store and the banking system: when a shopper clicks “Pay,” the gateway encrypts their card details, hands them to a payment processor, and routes them through the card network to the customer’s bank for an approval or decline. That is the short version of how a payment gateway works in ecommerce. The full round trip usually finishes in two to three seconds, though the money itself takes one to three business days to reach your account.
Who Is Involved in Every Transaction
Six parties touch each sale. The cardholder is your customer. The merchant is you. The payment gateway is the software that captures and encrypts the card data. The payment processor is the technical engine that moves that data between the gateway and the card networks. The acquiring bank (sometimes called the merchant bank) holds your merchant account and receives the funds on your behalf. The issuing bank gave your customer the card and decides whether to approve the charge.
Each has a specific job. The issuing bank confirms the customer has available credit or funds and runs fraud screening. The acquiring bank underwrites your side of the risk. The card networks (Visa, Mastercard, American Express) set the rules and route data between the two banks. When something breaks, the fix depends on which link caused the problem, so it helps to know who does what.
What Happens in the Two to Three Seconds After Checkout
When your customer submits their card, the gateway encrypts the card number, expiration date, CVV, and billing address using strong encryption (typically AES-256) so nothing readable travels across the wire. That encrypted packet goes to the payment processor, which identifies the card brand and forwards the request to the correct network. The network passes it to the issuing bank.
The issuing bank runs its checks in real time. Is the card valid? Are funds or credit available? Does anything about the transaction look off, like a purchase amount unusual for this cardholder, or an IP address in a different country than the billing address? If the answers line up, the bank returns an authorization code back through the network to the processor. That code means the funds are reserved, not yet transferred. The processor relays the approval to the gateway, which tells your storefront to show a confirmation page.
3-D Secure Authentication
For higher-risk transactions, the gateway may trigger an extra authentication step called 3-D Secure (branded as “Visa Secure” or “Mastercard Identity Check”). The current version, 3DS2, does risk-based authentication in the background. If the risk score is low, the customer sees nothing extra, which the industry calls a frictionless flow. If the risk is elevated, the customer gets a challenge, usually a one-time code by text or a biometric prompt inside their banking app.
The practical reason to enable it is the liability shift. When a transaction passes 3-D Secure and the customer later disputes it as unauthorized, liability for that chargeback generally moves from you to the issuing bank. The occasional challenge adds a few seconds at checkout, and that trade is usually worth taking.
Tokenization
After the first authorization, most modern gateways replace the real card number with a randomized substitute called a token. Encryption scrambles data but can be reversed with a key; tokenization removes the actual card number from your systems entirely. You can safely store the token for repeat purchases, subscriptions, or refunds. If your database is ever breached, attackers get meaningless token strings instead of usable cards.
When a Charge Is Declined
Not every request comes back approved. The gateway returns a decline response code, and declines fall into two groups.
- Soft declines mean the bank approved in principle, but something else went wrong: a temporary network issue, a processing hiccup. Retrying often works.
- Hard declines mean the bank refused outright. Insufficient funds, expired card, card reported lost or stolen, or a fraud block. Retrying will not help. The customer needs another card or a call to their bank.
The code you will see most is “Do Not Honor,” a catch-all the issuing bank uses when it does not want to explain. Ask the customer to try a different method or contact their bank. Aggressively retrying hard declines can flag your merchant account for suspicious behavior.
Settlement: When the Money Actually Arrives
Authorization reserves funds. It does not move them. At the end of each business day, or on whatever schedule you configure, your gateway sends a batch of authorized transactions to the processor. The processor routes them to the card networks, which calculate interchange fees and coordinate the transfer of funds from each issuing bank to your acquiring bank.
Credit card settlement typically completes within one to three business days after the transaction. Your acquiring bank deposits the net amount, the transaction total minus fees, into your merchant account. Some providers hold a percentage in reserve to cover potential chargebacks, especially for new merchants or higher-risk industries.
The consumer protections attached to these transfers depend on the payment method. Debit card transactions and direct bank transfers fall under the Electronic Fund Transfer Act, which gives consumers the right to dispute errors and unauthorized charges and requires financial institutions to investigate within specific timeframes.1Legal Information Institute. Electronic Funds Transfer Act Credit card transactions are governed instead by the Truth in Lending Act and its implementing Regulation Z, which caps cardholder liability for unauthorized charges at $50.2Office of the Comptroller of the Currency. Electronic Fund Transfer Act – Comptrollers Handbook
What You Pay Per Transaction
Every card sale costs you money, and the total is really three fees stacked together.
- Interchange fee: paid to the issuing bank. The largest chunk. Rates vary by card type, transaction method, and industry. Rewards and corporate cards cost more than basic debit.
- Network assessment fee: paid to the card network. Usually a small fraction of a percent.
- Processor markup: paid to your payment processor or gateway. The only piece that is negotiable.
Added together, total processing costs for most ecommerce merchants land somewhere between roughly two and four percent of each sale. The exact rate depends on your sales volume, average ticket size, the mix of card types your customers use, and the pricing model your processor offers.
Hosted Checkout or Direct API: The Setup Choice That Shapes Everything
Before you connect a gateway, you pick how deeply it integrates with your site. The choice has real consequences for both the customer experience and the compliance work you sign up for.
Hosted Payment Pages
With a hosted checkout, your customer is redirected to a page the gateway controls, or sees the gateway’s form loaded in an iframe on your site. The card number never touches your server. That shifts the security burden to the provider and shrinks your PCI compliance scope. Most merchants using hosted checkouts qualify for the simplest self-assessment questionnaire, SAQ A.3PCI Security Standards Council. Best Practices for Securing E-commerce The tradeoff is less control over the look and feel of the payment form, and the redirect can add friction that causes some carts to be abandoned.
Direct API Integration
A direct API integration lets you build a fully custom checkout. Card data flows through your own server, or is tokenized in the browser before reaching your server. You control the whole experience, but your PCI scope expands. Merchants handling raw card data typically need SAQ D, the most comprehensive questionnaire, covering hundreds of controls.3PCI Security Standards Council. Best Practices for Securing E-commerce Unless you have a dedicated security team, hosted checkout is usually the better call.
Either way, your site needs a TLS certificate to encrypt the connection between the customer’s browser and your server. PCI DSS requires TLS 1.2 or higher for payment processing.4PCI Security Standards Council. PCI DSS Standards
Chargebacks: The Biggest Ongoing Risk
A chargeback happens when a customer disputes a transaction with their issuing bank and the bank forcibly reverses the charge. The money leaves your account first. You get a chance to fight it after.
On top of losing the sale, you pay a non-refundable chargeback fee, typically $20 to $100 per dispute. You generally have 20 to 45 days after notification to gather evidence and submit a rebuttal to your acquiring bank, and the full process can drag on up to 120 days.5Mastercard. How Can Merchants Dispute Credit Card Chargebacks Winning takes compelling evidence: delivery confirmation, signed receipts, correspondence showing the customer got what they ordered.
The bigger threat is what happens if your chargeback rate climbs. Visa’s dispute monitoring program triggers when your chargeback ratio crosses 0.5% of transactions. Mastercard’s Excessive Chargeback Program kicks in at 1.5% when you have 100 or more disputes in a month. Landing in either means higher fees, mandatory remediation, and in serious cases losing the ability to accept cards at all. Clear product descriptions, responsive customer service, and easy refund policies prevent chargebacks more reliably than fighting them after the fact.
Two Things the Gateway Does Not Handle for You
Your gateway routes payments; it does not shield you from a couple of adjacent obligations worth knowing about.
Tax reporting. Payment processors report your transaction volume to the IRS. If you use a third-party settlement organization, which covers most ecommerce payment platforms, the provider files a Form 1099-K when your gross payments exceed $20,000 and you have more than 200 transactions in a calendar year.6Internal Revenue Service. 2026 Publication 1099 Direct payment card transactions through a traditional merchant account have no minimum threshold and are always reported. The amounts reflect gross sales, not net; refunds, fees, and chargebacks are not subtracted. If the tax ID on file with your processor is missing or wrong, the processor must withhold 24% of your payments and send it to the IRS.7Internal Revenue Service. Publication 515 (2026) – Withholding of Tax on Nonresident Aliens and Foreign Entities
Surcharging. Some merchants add a surcharge to credit card transactions to offset processing fees. Card network rules allow it in most cases with restrictions. Mastercard caps credit card surcharges at 4% or your actual cost of acceptance, whichever is lower, and prohibits surcharges on debit or prepaid cards.8Mastercard. Mastercard Credit Card Surcharge Rules A handful of states ban credit card surcharging entirely, so check your state’s rules before adding one, and disclose it clearly before the customer enters payment information.