Payment gateway

The gateway is the messenger in an online payment, not the bank. It passes the payment request from your checkout to the payment processor and card network, and the customer's bank decides whether to approve it. Many providers bundle the gateway, the processing and the merchant account into one service, which is why the terms are often used interchangeably.

It is also different from a point-of-sale card terminal, though many providers offer both, so a business can see online and in-person sales in one account.

How it works

When a customer clicks "pay", the gateway encrypts the card details and sends them, through the processor and the card network, to the bank that issued the card. The bank checks the funds, fraud signals and, where required, asks the customer to confirm the payment in their banking app or by a one-time code. That extra step is known as 3-D Secure, and in the EU and UK strong customer authentication rules make it required for many online card payments. The approval or decline travels back the same way, usually within a few seconds.

Approved payments are not paid out instantly. The provider collects the day's transactions and settles them to your business bank account after a delay that varies by provider and country, minus fees. Refunds and chargebacks, where a customer disputes a payment with their bank, flow back through the same chain.

Most small businesses use hosted fields or a hosted payment page, where the card form is served by the provider rather than your own site. Your server never sees full card numbers; it receives a token that stands for the payment. That greatly reduces your obligations under PCI DSS, the card industry's security standard, compared with handling card data yourself. Your site still needs HTTPS and good security, because a compromised page could swap the real payment form for a fake one.

Example

A yoga studio sells class packs on its website. It connects a payment provider through a plug-in, uses the provider's hosted checkout and enables card payments plus a couple of digital wallets popular with its customers. A customer buys a ten-class pack, confirms the payment in her banking app, and the studio's booking system receives a webhook, an automatic message from the provider, that marks the pack as paid.

A month later one payment is disputed as unrecognised. The studio uploads the booking record and attendance list through the provider's dashboard as evidence. Because the statement descriptor showed only a generic company name, the owner changes it to the studio's trading name so customers recognise the charge.

Why it matters for your business

The gateway affects how many customers complete a purchase, how quickly you get paid, what you pay in fees and how much security risk you carry. A slow or confusing checkout loses sales, and handling card data yourself creates serious compliance work and liability. When comparing providers, look at supported payment methods in your customers' countries, the fee structure, payout timing, how disputes are handled and whether your platform has a maintained integration. Fees vary by provider, card type and country, so compare the real cost on your typical order size. You can test any integration with the provider's test mode before going live.

Common mistakes

• Building a custom card form that sends card numbers through your own server, which brings heavy PCI DSS obligations.
• Offering only one payment method when customers in your market commonly use others.
• Using a statement descriptor customers do not recognise, which leads to avoidable disputes.
• Never testing refunds and failed payments before launch, so the first real problem is handled in a panic.

Questions people ask

What is the difference between a payment gateway and a payment processor?

The gateway captures and transmits payment details from your checkout. The processor handles the communication with card networks and banks and moves the money. Many providers offer both in one account, so small businesses often deal with a single company for everything.

How much does a payment gateway cost?

Most providers charge a percentage of each transaction plus a small fixed fee, with different rates for international cards and some payment methods. Some add monthly fees for extra features. Rates vary by provider and country and change over time, so check current pricing for your expected volumes.

Do I need PCI compliance if I use a payment gateway?

Yes, every business that accepts cards has PCI DSS obligations, but using a hosted payment page or hosted fields reduces them to a short self-assessment in many cases. Your provider can tell you which questionnaire applies to your setup.