What is a Payment Gateway?

Intro

Payment gateways allow sellers to accept credit and debit card (EFTPOS) payments by connecting payment processors (the service charging the card) and merchant account providers (the service providing your payment systems). Gateways are payment services – typically provided for an additional fee – that process cards online through an ecommerce site or in-person through an EFTPOS card terminal.

FAQs

Five Frequently Asked Questions About Payment Gateways

What’s the difference between a virtual terminal and a payment gateway?

Payment gateways let you accept card payments (in person or online) by transferring money between your merchant account and a payment processor through a card terminal or processor.

A virtual terminal – sometimes referred to as a web POS or cloud POS – is software that lets you take payments from any device (e.g., desktop, phone or tablet) which turns it into a point-of-sale terminal. For example, Square’s free virtual terminal software is accessible via your Dashboard and capable of accepting payments right away, with no setup or engineering resources required. Virtual terminals are ideal for businesses that don’t need an online store but do need to accept remote payments through phone or mail order.

How much do payment gateways cost?

Payment gateway providers are not always transparent about their EFTPOS card machine prices. Each payment may have different fees associated with it and it’s not always clear why those fees are (or aren’t) applied to a given transaction.

In addition to a per-transaction percentage, many payment gateway and payment processing providers charge all or some of the following:

• Monthly account fees
• Membership fees
• PCI-compliance fees
• Initial setup fees
• Batch fees
• Refund/chargeback fees
• Higher rates for cards like American Express

What’s the relationship between merchant accounts, payment processors, and payment gateways?

A merchant account is what establishes a business relationship between you and your merchant services provider (e.g., the bank account for your business). With traditional card processing services, you cannot take payments until after you apply and are approved for a merchant account. A payment processor is the bank that actually processes the payment request. When customers pay with a credit card, payment gateways connect merchant accounts with payment processors by transferring credit card information between the bank that issued the credit card and the bank account for your business.

What’s the difference between a payment gateway and a payment switch?

The payment switch is part of the payment gateway and is responsible for making sure incoming payment requests (transactions) are directed to the right place. When the gateway receives a payment request, the transaction is routed to the payment switch (this process is called “transaction switching”), then the switch routes the transaction to the correct issuing bank for approval.

If I already have a payment gateway provider do I still need to worry about PCI compliance?

Yes. All merchants who process credit and debit card information must be PCI compliant, and having a PCI-compliant gateway is only one part of that requirement. Fortunately, if you use Square for payment processing, PCI compliance is easy because we provide all the pieces in your payment workflow, protecting cardholder data from the moment it’s recorded at the point of sale to the time we deliver funds to your merchant account.

Deep Dive

Payment gateways: A closer look

Payment gateways act as conduits, passing card transaction information from the merchant to the relevant banks through one of the following mechanisms:

• EFTPOS card terminals in brick-and-mortar stores (think of this as a physical payment gateway)
• Payment services and APIs for websites and mobile applications (think of this as a virtual payment gateway)

How payment gateways work

The transaction flow is the same whether you’re using a physical or virtual payment gateway, but mobile and online payments use digital capture files to package the card information rather than output from a card reader:

1. The buyer makes a card payment through your card reader or e-commerce site.
2. The payment gateway:
   • Pushes the transaction information to the acquiring bank (the merchant bank or acquirer)
   • Determines which card network (Visa, MasterCard, eftpos, American Express or JCB) the card belongs to
   • Routes the transaction information to the correct payment switch
3. The payment switch routes the request to the issuing bank (the bank that issued the card) and pushes the transaction information to the correct card network.
4. The issuing bank applies fraud detection procedures to check the legitimacy of the transaction and confirms the buyer has sufficient funds to cover the purchase.
5. The issuing bank approves (or rejects) the transaction and sends this information back through the card network to the merchant bank and the payment gateway.

You can think of the payment gateway as a train passing between stations, where the conductor talks with the station master at each stop.

Credit card payments are authorised (through the payment gateway) by the issuing bank at the point of sale. An authorised transaction means that the bank has put a hold on the funds but the merchant hasn’t actually received payment. Customers see this as a “pending” transaction on their statement. Some debit card payments are authorised and settled at the same time, so the transactions immediately show up on the customer’s account.

Then later, typically at the end of the day, the merchant must reconcile payments, add in tips (if needed), and manually send a batch capture, or “clearing” file, for all the pending card transactions. At this point the pending transactions are committed, which means the merchant is now entitled to the funds previously put on hold by the issuing bank. The funds are then credited and cleared to the merchant’s bank and made available once they post in the merchant account.

Payment gateways and security standards

Encryption

Gateways encrypt data using SSL before sending it through the card network to protect the buyer’s sensitive account information. That means the buyer’s card information is coded in a way that makes it difficult for fraudsters to access it as the data is shuttled between the different players in the payment chain.

PCI compliance

PCI compliance is a security checklist designed to protect your customers’ security and reduce fraud. All organisations that process card payments, and all merchants that accept card payments, are responsible for their own PCI compliance.

For a variety of reasons, merchants often end up cobbling together a payment processing system from a number of different companies. They might use a payment terminal from one vendor, payment gateways from another and a point-of-sale system from a third.

While each individual product or service might be PCI compliant, it doesn’t guarantee that the merchant, as the entity accepting card payments, is PCI compliant. That’s because PCI compliance pertains to the entire payment landscape, which includes how merchants process payments, how merchants connect those systems, and how merchants manage their customers’ data.

Why you don’t need a payment gateway with Square

You don’t need a payment gateway with Square because Square’s hardware and services create an end-to-end payment processing system: We capture your customers’ payment information at the point of sale (no manual reconciling), work directly with card payment gateways to securely route those payments to the right place, and deposit the funds into your bank account as soon as the next day.

Square software is also PCI compliant. As an end-to-end payment processor, our systems are fully integrated, which means we make PCI compliance easy for you. When you process payments through Square, using Square hardware, your customers’ card information never touches an independent device. It’s encrypted from the moment you collect the card information, and our systems securely transmit your customers’ payment information through the payment chain and to the acquirer without the need for a separate payment gateway.

Similarly, you don’t need a separate merchant account. Traditional payment processors require merchants to open their own merchant account (a special bank account that might come with a lot of paperwork and its own fees), but when you use Square, Square becomes the merchant of record. We take on the responsibility (and fees) for maintaining a merchant account so you don’t have to. All card payments are sent to our shared merchant account, then securely forwarded to your business bank account.

Transparent pricing

Even better, a simplified payment flow means simplified pricing based strictly on transaction fees:

• 1.6% transaction fee for every tap, insert or swipe.
• 2.2% transaction fee for every transaction where the card is not physically present, such as Square Online purchases, or manually keyed-in transactions.

There are no monthly charges and no additional fees. Our flat rates include everything from PCI-compliance fees to interchange and chargeback fees.

Conclusion

Before you sign up with a payment gateway, be sure to do your homework and find out if there are any hidden fees or costs and make sure you understand how it fits into your existing solutions. For example, if you have an online payment gateway for your ecommerce site and a physical payment gateway for in-person payments, both systems should feed into your POS to simplify bookkeeping. And if your gateway solutions aren’t integrated with the rest of your payment landscape, you want to make sure they maintain PCI compliance or you could be at risk for some kinds of fraud.

If you’re growing your business, launching a new location, or taking card payments for the first time, it’s important to have a clear understanding of what different combinations of payment gateways, payment processors and merchant accounts cost before you sign anything.

Easily accept and process payments with Square

See how -/^

This article is for informational purposes only and does not constitute legal, personal, or tax advice. The information contained herein is subject to change and may vary from time to time. For specific advice applicable to your business, please contact a professional.