Intro
Payment gateways allow merchants to accept credit card payments by connecting payment processors (the service charging the card) and merchant account providers (the service providing your payment systems). Gateways are payment services — typically provided for an additional fee — that process credit cards online through an e-commerce site or in-person through a credit card terminal.
FAQs
Five Frequently Asked Questions About Payment Gateways
What’s the difference between a virtual terminal and a payment gateway?
Payment gateways let you accept credit card payments (in person or online) by transferring money between your merchant account and a payment processor through a credit card terminal or processor.
A virtual terminal — sometimes referred to as a web POS or cloud POS — is software that lets you take payments from any device (e.g., desktop, phone, or tablet) running it, which turns the device into a point-of-sale terminal. For example, Square’s free virtual terminal software is accessible via your Dashboard and capable of accepting payments right away, with no setup or engineering resources required. Virtual terminals are ideal for businesses that don’t need an online store but do need to accept remote payments through phone, mail, or fax.
How much do payment gateways cost?
Payment gateway providers are not transparent about their credit card machine prices. Each payment may have different fees associated with it and it’s not always clear why those fees are (or aren’t) applied to a given transaction.
In addition to a per-transaction percentage, many payment gateway and payment processing providers charge all or some of the following:
- Monthly account fees
- Membership fees
- PCI-compliance fees
- Initial setup fees
- Batch fees
- Refund/chargeback fees
- Higher prices for cards like American Express
What’s the relationship between merchant accounts, payment processors, and payment gateways?
| Payment Gateway | Payment Processers | Acquirers | Merchant Account |
|---|---|---|---|
| The technology that moves money between your business’s bank account (merchant account) and your client’s credit card bank | The bank or entity that processes your payments | The banks or financial institutions that manage your merchant account | Essentially a bank account for your business |
A merchant account is what establishes a business relationship between you and your merchant services provider (e.g., the bank account for your business). With traditional credit card processing services, you cannot take payments until after you apply and are approved for a merchant account. A payment processor is the bank that actually processes the payment request. When customers pay with a credit card, payment gateways connect merchant accounts with payment processors by transferring credit card information between the bank that issued the credit card and the bank account for your business.
What’s the difference between a payment gateway and a payment switch?
The payment switch is part of the payment gateway and is responsible for making sure incoming payment requests (transactions) are directed to the right place. When the gateway receives a payment request, the transaction is routed to the payment switch (this process is called “transaction switching”), then the switch routes the transaction to the correct issuing bank for approval.
If I already have a payment gateway provider do I still need to worry about PCI compliance?
Yes. All merchants who process credit card information must be PCI compliant, and having a PCI-compliant gateway is only one part of that requirement. Fortunately, if you use Square for payment processing, we make PCI compliance easy because we provide all the pieces in your payment workflow and protect cardholder data from the moment it’s recorded at the point of sale to the time we deliver funds to your merchant account.
Deep Dive
Payment gateways: A closer look
Payment gateways act as conduits, passing credit card transaction information from the merchant to the relevant banks via the appropriate credit card network through one of the following mechanisms:
- Credit card terminals in brick-and-mortar stores (think of this as a physical payment gateway)
- Payment services and APIs for websites and mobile applications (think of this as a virtual payment gateway)
How payment gateways work
The transaction flow is the same whether you’re using a physical or virtual payment gateway, but mobile and online payments use digital capture files to package the credit card information rather than output from a credit card reader:
- The buyer makes a credit card payment through the merchant’s credit card reader or e-commerce site.
- The payment gateway:
- Pushes the transaction information to the acquiring bank (the merchant bank or acquirer)
- Determines which credit card network (Visa, Mastercard, Discover, or American Express) issued the buyer’s card
- Routes the transaction information to the correct payment switch
- The payment switch routes the request to the bank that issued the buyer’s credit card (the issuing bank) and pushes the transaction information onto the correct credit card network.
- The issuing bank applies fraud detection procedures to determine the legitimacy of the transaction and confirms the buyer has sufficient credit in their account to accommodate the purchase.
- The issuing bank approves (or rejects) the transaction and sends this information back through the credit card network to the merchant bank and the payment gateway.
You can think of the payment gateway as a train passing between stations, where the conductor talks with the station master at each stop.
Credit card payments are authorized (through the payment gateway) by the issuing bank at the point of sale. An authorized transaction means that the bank has put a hold on the funds but the merchant hasn’t actually received payment. Customers see this as a “pending” transaction on their credit card statement. At some later point, typically at the end of the day, the merchant must reconcile payments, add in tips (if needed), and manually send a batch capture, or “clearing” file, for all the pending credit card transactions. At this point the pending transactions are committed, which means the merchant is now entitled to the funds previously put on hold by the issuing bank. The funds are then credited to the merchant’s bank and made available once they post in the merchant account.
Payment gateways and security standards
Encryption
Gateways encrypt data using SSL before sending it through the credit card network to protect the buyer’s sensitive account information. That means the buyer’s credit card information is coded in a way that makes it difficult for fraudsters to access it as the data is shuttled between the different players in the payment chain.
PCI compliance
PCI compliance is a security checklist created by the Payment Card Industry Data Security Standard (PCI DSS) to help reduce fraud. All organizations that process credit and debit card payments, and all merchants that accept card payments, are responsible for their own PCI compliance.
For a variety of reasons, merchants often end up cobbling together a payment processing system from a number of different companies. They might use a payment terminal from one vendor, payment gateways from another, and a point-of-sale system from a third.
While each individual product or service might be PCI compliant, it doesn’t guarantee that the merchant, as the entity accepting card payments, is PCI compliant. That’s because PCI compliance pertains to the entire payment landscape, which includes how merchants process payments, how merchants connect those systems, and how merchants manage their customers’ data.
Why you don’t need a payment gateway with Square
You don’t need a payment gateway with Square because Square’s hardware and services create an end-to-end payment processing system: We capture your customers’ payment information at the point of sale (no manual reconciling), work directly with credit card payment gateways to securely route those payments to the right place, and deposit the funds into your bank account in one to two business days.
Square software is also PCI compliant. As an end-to-end payment processor, our systems are fully integrated, which means we make PCI compliance easy for you. When you process payments through Square, using Square hardware, your customers’ card information never touches an independent device. It’s encrypted from the moment you collect the card information, and our systems securely transmit your customers’ payment information through the payment chain and to the acquirer without the need for a separate payment gateway.
Similarly, you don’t need a separate merchant account or a special relationship with a bank. Traditional payment processors require merchants to open their own merchant account (a special bank account that might come with a lot of paperwork and its own fees), but when you use Square, Square becomes the merchant of record. We take on the responsibility (and fees) for maintaining a merchant account so you don’t have to. All card payments are sent to our shared merchant account, then securely forwarded to your business bank account.
| Solution | The Traditional Payment Gateway Process | Square |
|---|---|---|
| What it costs | Variable: Potentially hundreds of dollars in initial setup fees, merchant account fees, payment gateway fees, and PCI-compliance fees | Account sign-up: free. Payment activation: free. Payment processing: flat transaction fee based on transaction type. |
| What’s included | The ability to process payments on your site after signing up for a merchant account | Secure payment APIs for e-commerce and in-person sales with a built-in payment gateway and merchant account. PCI compliant software, quick account setup in minutes (sign up here). |
Transparent pricing
Even better, a simplified payment flow means simplified pricing based strictly on transaction fees:
- 2.6% + 10¢ transaction fee for all swiped, dipped (chip cards), or tapped (NFC) in-person payments
- 3.5% + 15¢ transaction fee for in-person payments where the card number is entered manually
- 2.9% + 30¢ transaction fee for online payments with our e-commerce API
There are no monthly charges and no additional fees. Our flat rates include everything from SaaS and PCI-compliance fees to interchange and chargeback fees.
Fast payments
Square merchants receive their funds in one to two business days. If you need access to your money faster, we offer two options (at a cost of 1% of the total deposit):
- Scheduled Deposit sends your daily sales to your bank account the same day (including weekends and holidays).
- Instant Deposit is a one-off deposit that goes to your bank account instantly (including weekends and holidays). Currently, Instant Deposit is only available through the Point of Sale API.
Conclusion
Before you sign up with a payment gateway, be sure to do your homework and find out if there are any hidden fees or costs and make sure you understand how it fits into your existing solutions. For example, if you have an online payment gateway for e-commerce and a physical payment gateway for in-person payments, you want both systems to feed into your POS to simplify bookkeeping. And if your gateway solutions aren’t integrated with the rest of your payment landscape, you want to make sure they maintain PCI compliance or you could be on the hook for some kinds of fraud.
If you’re growing your business, launching a new location, or taking credit card payments for the first time, it’s important to have a clear understanding of what different combinations of payment gateways, payment processors, and merchant accounts cost before you sign anything.
