What is a payment gateway? How online card payments work

A payment gateway is the service that securely takes a shopper's payment details at checkout, sends them to the payment processor and card networks for authorization, and returns the approval or decline to your store. It is the link between your checkout and the banks that move the money.

How a card payment flows

  1. The shopper enters card details at checkout.
  2. The gateway encrypts the data and sends the transaction to the processor and the acquirer, the bank that processes card transactions for the merchant.
  3. The acquirer routes the request through the card network to the issuer, the bank that issued the shopper's card.
  4. The issuer checks the card and funds, may ask for authentication such as 3-D Secure, and approves or declines.
  5. The response travels back through the acquirer and gateway, and your store shows the result.

Settlement, when the money actually reaches your account, happens afterwards.

Gateway, processor and acquirer

The terms overlap. The PCI Security Standards Council's glossary notes that a payment processor is sometimes referred to as a payment gateway or payment service provider (PSP), and defines it as an entity engaged by a merchant to handle payment card transactions on its behalf. In practice, many providers bundle gateway, processing and a merchant account into one contract, while others let you connect a gateway to a separate acquirer.

Why it matters for an online store

  • Security scope. If card details are entered in the provider's hosted page or embedded fields, they don't pass through your servers, which narrows your PCI DSS scope.
  • Payment methods. The gateway decides which cards, wallets and local methods you can offer.
  • Cost. Fees are usually a percentage per transaction, sometimes plus a fixed amount. In a hypothetical example, a 3 percent fee on an $80 order costs $2.40, so on 1,000 such orders a month, a 0.5-point difference is $400.
  • Disputes. Your provider notifies you of chargebacks and collects your evidence.

Common mistakes

  • Comparing headline rates only, without currency conversion, refund, dispute and payout fees.
  • Assuming the gateway calculates or files your sales tax; that stays with the seller unless a merchant of record takes it on.
  • Treating every decline as final. Some are soft declines that succeed after the shopper authenticates.

CIQRA stores can take payments through Stripe, PayPal, iyzico, PayTR, Param, Moka and bank card gateways, plus bank transfer and cash on delivery.

Sources