What an online payment gateway does
An online payment gateway is the tool that takes your payment information when you buy something on a website or app and sends it securely to the bank or payment processor that actually moves the money. It sits between you and the merchant's bank — you enter your card details or choose a digital wallet, the gateway encrypts that information, checks that your card is valid, and then passes everything along to process the charge.
The gateway does not hold your money or decide whether to approve the transaction. It is the messenger and the security checkpoint. Common gateways include Stripe, Square Online, PayPal, and Authorize.Net. When you see a payment form on a website, that form is usually powered by one of these gateways.
From your side as a customer, you notice the gateway mainly when something goes wrong — a declined card, a security prompt, or a page that asks you to verify your identity. Most of the time it works invisibly in a fraction of a second.
Key Takeaways
- A payment gateway encrypts your card information and sends it to the bank for approval, but does not store your payment details or hold funds.
- Merchants choose a gateway based on transaction fees, the types of payments it accepts, and whether it integrates with their existing business software.
- Your card information is encrypted during transmission, so the merchant's website never actually sees your full card number.
- Payment gateways typically charge merchants a percentage of each transaction plus a small flat fee, which is why some businesses set minimum purchase amounts.
- If a transaction is declined, the gateway tells you why — insufficient funds, expired card, or fraud detection — but you may need to contact your bank for details.
How the payment flow works from start to finish
When you enter your card information on a checkout page, the gateway when ready encrypts it using SSL encryption — the same technology that protects your bank login. The merchant's website does not see your full card number; it only sees a token, which is a stand-in code that represents your payment without exposing the actual digits.
The gateway then sends your encrypted information to the payment processor, which is usually a company like Visa, Mastercard, or your bank's processor. The processor checks with your bank to confirm you have enough funds and that the card has not been reported stolen or compromised. This approval step usually takes one to three seconds.
Once approved, the processor sends a confirmation back to the gateway, which displays a success message on the merchant's website. The money does not move when ready — that happens in a batch settlement, usually within one to two business days. The merchant receives the funds minus the gateway's fee, and you see the charge on your next statement.
Why merchants use gateways instead of processing payments directly
A merchant could theoretically build their own payment system, but that would require them to store card information securely, comply with PCI DSS (Payment Card Industry Data Security Standard), and handle fraud detection themselves. PCI DSS compliance is expensive and exposes the business to liability if data is breached.
Using a third-party gateway shifts that responsibility. The gateway provider handles encryption, fraud detection, and PCI compliance. The merchant only needs to integrate the gateway into their website or app, which takes a few hours to a few days depending on the platform.
Gateways also handle multiple payment types — credit cards, debit cards, digital wallets like Apple Pay and Google Pay, and sometimes bank transfers or local payment methods. A small business owner does not have to negotiate separate agreements with Visa, Mastercard, and each digital wallet provider; the gateway does that.
Transaction fees and what they cover
Payment gateways charge merchants a fee for each transaction, typically between 2.2% and 3.5% of the sale amount plus a flat fee of 20 to 30 cents. The exact rate depends on the gateway, the type of card used, and the merchant's sales volume. A merchant processing $10,000 per month might pay $250 to $400 in gateway fees alone.
These fees cover the cost of encryption, fraud detection, customer support, and the gateway company's profit. Some gateways also charge a monthly account fee or a fee for chargebacks — when a customer disputes a charge and the bank reverses it.
Because these fees add up, some merchants set a minimum purchase amount (like $5 or $10) or charge a small surcharge for card payments. Others absorb the cost and build it into their prices. You may also see a "convenience fee" at checkout, which is the merchant passing part of the gateway fee to you.
Security features that protect your payment information
The gateway encrypts your data using TLS encryption (Transport Layer Security), which scrambles your card number so that even if someone intercepts the transmission, they cannot read it. You can tell a payment page is encrypted if the URL starts with "https://" and there is a padlock icon in your browser's address bar.
Most gateways also use tokenization, which means your actual card number is replaced with a unique token that is useless to a thief. If a merchant's database is hacked, the hacker gets tokens, not card numbers. The card number stays with the gateway or the bank.
Gateways also run fraud detection in real time. If a transaction looks suspicious — a card used in two countries within an hour, or a purchase amount far higher than the customer's usual spending — the gateway may decline it or ask for additional verification. This is why you sometimes see a prompt asking you to confirm your identity or enter a code sent to your phone.
When a payment is declined and what to do
If your payment is declined, the gateway tells the merchant's website why. Common reasons include insufficient funds, an expired card, a mismatched billing address, or fraud detection flagging the transaction as suspicious. The decline message usually appears on the checkout page.
If you see a decline, first check that you entered your card number, expiration date, and billing address correctly. If those are right, contact your bank — they may have flagged the transaction as unusual, or your account may have a temporary hold. Your bank can tell you whether the card is active and whether there are any restrictions on it.
If the decline is due to fraud detection, you may be able to verify the transaction through your bank's app or by calling the number on the back of your card. Once verified, you can usually retry the payment when ready.
Different types of gateways and how to choose one
Gateways come in a few flavors. Hosted gateways redirect you to a separate payment page (like PayPal's checkout) where you enter your information. The merchant's website never touches your card data. Integrated gateways embed a payment form directly on the merchant's website, but the data is still encrypted and sent to the gateway's servers, not stored on the merchant's site.
Mobile gateways are designed for apps and mobile websites, often with features like one-tap checkout or biometric authentication. In-person gateways (like Square or Toast) process card payments at a physical location using a card reader connected to a phone or tablet.
Merchants choose a gateway based on transaction fees, the payment methods it supports, integration difficulty, and customer support quality. A small online store might use Stripe or Square because they are straightforward to set up. A large retailer might use a custom gateway built by a payment processor because they need advanced features and lower fees at high volume.
Frequently Asked Questions
Does the merchant ever see my full card number?
No. The payment gateway encrypts your card number before it reaches the merchant's website. The merchant only sees a token — a code that represents your payment without exposing the actual digits. This is why merchants cannot steal your card number even if their website is hacked.
Why was my payment declined even though I have money in my account?
Common reasons include a mismatched billing address, an expired card, fraud detection flagging the transaction, or a temporary hold from your bank. Check that your address matches your card's records, and contact your bank to confirm the card is active and there are no restrictions on it.
How long does it take for my payment to go through?
The gateway approves or declines your payment in one to three seconds. The merchant receives the funds within one to two business days in a batch settlement. You see the charge on your statement within one to three business days, depending on your bank.
What happens if I dispute a charge?
You contact your bank or credit card company and file a dispute, also called a chargeback. The bank investigates and either reverses the charge or sides with the merchant. The merchant may be charged a chargeback fee by the gateway, which is why they keep records of all transactions and communications with customers.
Can I use a payment gateway to send money to someone else?
Most payment gateways are designed for merchants to receive payments from customers, not for peer-to-peer transfers. For sending money to another person, you would use a different service like Venmo, PayPal's personal transfer feature, or your bank's bill pay system.