Table of contents
Introduction to Payment Gateways
What is a payment gateway?
Payment gateways allow merchants to accept credit card payments by connecting payment processors (the service charging the card) and merchant account providers (the service providing your payment systems). Gateways are payment services — typically provided for an additional fee — that process credit cards online through an e-commerce site or in-person through a credit card terminal.
Importance of payment gateways for online transactions
Payment gateways let you accept credit card payments (in person or online) by transferring money between your merchant account and a payment processor through a credit card terminal or processor.
In order to process credit card payments, you’ll need a virtual terminal — sometimes referred to as a web POS or cloud POS. A virtual terminal is software that lets you take payments from any device (e.g., desktop, phone, or tablet) running it, which turns the device into a point-of-sale terminal. For example, Square’s free virtual terminal software is accessible via your Dashboard and capable of accepting payments right away, with no setup or engineering resources required. Virtual terminals are ideal for businesses that don’t need an online store but do need to accept remote payments through phone, mail, or fax.
How payment gateways work
Payment gateways: A closer look
Credit card payment gateways act as conduits, passing credit card transaction information from the merchant to the relevant banks via the appropriate credit card network through one of the following mechanisms:
- Credit card terminals in brick-and-mortar stores (think of this as a physical payment gateway)
- Payment services and APIs for websites and mobile applications (think of this as a virtual payment gateway)
Transaction process explained
The transaction flow is the same whether you’re using a physical or virtual payment gateway, but mobile and online payments use digital capture files to package the credit card information rather than output from a credit card reader:
- The buyer makes a credit card payment through the merchant’s credit card reader or e-commerce site.
- The credit card payment gateway:
- Pushes the transaction information to the acquiring bank (the merchant bank or acquirer)
- Determines which credit card network (Visa, Mastercard, Discover, or American Express) issued the buyer’s card
- Routes the transaction information to the correct payment switch
- The payment switch routes the request to the bank that issued the buyer’s credit card (the issuing bank) and pushes the transaction information onto the correct credit card network.
- The issuing bank applies fraud detection procedures to determine the legitimacy of the transaction and confirms the buyer has sufficient credit in their account to accommodate the purchase.
- The issuing bank approves (or rejects) the transaction and sends this information back through the credit card network to the merchant bank and the payment gateway.
You can think of the payment gateway as a train passing between stations, where the conductor talks with the station master at each stop.
How do payment gateways enhance security?
Credit card payments are authorized (through the credit card payment gateway) by the issuing bank at the point of sale. An authorized transaction means that the bank has put a hold on the funds but the merchant hasn’t actually received payment. Customers see this as a “pending” transaction on their credit card statement. At some later point, typically at the end of the day, the merchant must reconcile payments, add in tips (if needed), and manually send a batch capture, or “clearing” file, for all the pending credit card transactions. At this point the pending transactions are committed, which means the merchant is now entitled to the funds previously put on hold by the issuing bank. The funds are then credited to the merchant’s bank and made available once they post in the merchant account.
Types of payment gateways (and how they differ)
Hosted payment gateways
A hosted payment gateway is a secure, third-party service that processes online transactions by redirecting customers to an external payment page. When a customer proceeds to checkout, they are seamlessly directed to the gateway’s secure platform to enter their payment details, such as credit card information. This ensures that sensitive data is handled by the gateway, reducing the merchant’s responsibility for PCI compliance and enhancing security.
Self-hosted and third-party gateways
Self-hosted payment gateways allow merchants to process payments directly on their own website, giving them full control over the checkout experience. Customers enter their payment details on the merchant’s site, and the data is then transmitted securely to the payment processor. While a self-hosted credit card payment gateway offers a seamless user experience, it requires the merchant to handle PCI compliance and ensure robust security measures.
On the other hand, third-party payment gateways redirect customers to an external platform to complete their payment. This offloads the responsibility of securing sensitive data to the gateway provider, simplifying compliance and reducing risk for the merchant.
While hosted payment gateways are popular for their ease of integration, robust security features, and ability to support multiple payment methods, self-hosted gateways offer customization.
The cost of payment gateways
Payment gateway providers are not transparent about their credit card machine prices. Each payment may have different fees associated with it, and it’s not always clear why those fees are (or aren’t) applied to a given transaction.
In addition to a per-transaction percentage, many credit card payment gateway and payment processing providers charge all or some of the following:
- Monthly account fees
- Membership fees
- PCI-compliance fees
- Initial setup fees
- Batch fees
- Refund/chargeback fees
- Higher prices for cards like American Express
Understanding the relationship among merchant accounts, payment processors, and payment gateways
| Payment Gateway | Payment Processors | Acquirers | Merchant Account |
|---|---|---|---|
| The technology that moves money between your business’s bank account (merchant account) and your client’s credit card bank | The bank or entity that processes your payments | The banks or financial institutions that manage your merchant account | Essentially a bank account for your business |
A merchant account is what establishes a business relationship between you and your merchant services provider (e.g., the bank account for your business). With traditional credit card processing services, you cannot take payments until after you apply and are approved for a merchant account. A payment processor is the bank that actually processes the payment request. When customers pay with a credit card, payment gateways connect merchant accounts with payment processors by transferring credit card information between the bank that issued the credit card and the bank account for your business.
Relationship between a payment gateway and a payment switch
The payment switch is part of the payment gateway and is responsible for making sure incoming payment requests (transactions) are directed to the right place. When the gateway receives a payment request, the transaction is routed to the payment switch (this process is called “transaction switching”), then the switch routes the transaction to the correct issuing bank for approval.
PCI compliance considerations
All merchants who process credit card information must be PCI compliant, and having a PCI-compliant payment gateway is only one part of that requirement. Fortunately, if you use Square for payment processing, we make PCI compliance easy because we provide all the pieces in your payment workflow and protect cardholder data from the moment it’s recorded at the point of sale to the time we deliver funds to your merchant account.
Selecting the Right Payment Gateways
Factors to consider
Encryption
Payment gateways encrypt data using SSL before sending it through the credit card network to protect the buyer’s sensitive account information. That means the buyer’s credit card information is coded in a way that makes it difficult for fraudsters to access it as the data is shuttled between the different players in the payment chain.
PCI compliance
PCI compliance is a security checklist created by the Payment Card Industry Data Security Standard (PCI DSS) to help reduce fraud. All organizations that process credit and debit card payments, and all merchants that accept card payments, are responsible for their own PCI compliance.
For a variety of reasons, merchants often end up cobbling together a payment processing system from a number of different companies. They might use a payment terminal from one vendor, payment gateways from another, and a point-of-sale system from a third.
While each individual product or service might be PCI compliant, it doesn’t guarantee that the merchant, as the entity accepting card payments, is PCI compliant. That’s because PCI compliance pertains to the entire payment landscape, which includes how merchants process payments, how merchants connect those systems, and how merchants manage their customers’ data.
Comparing costs and fees
You don’t need a payment gateway with Square because Square’s hardware and services create an end-to-end payment processing system: We capture your customers’ payment information at the point of sale (no manual reconciling), work directly with credit card payment gateways to securely route those payments to the right place, and deposit the funds into your bank account in one to two business days.
Square hardware is PCI-DSS certified and end-to-end encrypted. As an end-to-end payment processor, our systems are fully integrated, which means we make PCI compliance easy for you. When you use Square as a payment gateway, using Square hardware, your customers’ card information never touches an independent device. It’s encrypted from the moment you collect the card information, and our systems securely transmit your customers’ payment information through the payment chain and to the acquirer without the need for a separate payment gateway.
Similarly, you don’t need a separate merchant account or a special relationship with a bank. Traditional payment processors require merchants to open their own merchant account (a special bank account that might come with a lot of paperwork and its own fees), but when you use Square as a payment gateway, Square becomes the merchant of record. We take on the responsibility (and fees) for maintaining a merchant account so you don’t have to. All card payments are sent to our shared merchant account, then securely forwarded to your business bank account.
| Solution | The Traditional Payment Gateway Process | Square |
|---|---|---|
| What it costs | Variable: Potentially hundreds of dollars in initial setup fees, merchant account fees, payment gateway fees, and PCI-compliance fees | Account sign-up: free. Payment activation: free. Payment processing: flat transaction fee based on transaction type. |
| What’s included | The ability to process payments on your site after signing up for a merchant account | Secure payment APIs for e-commerce and in-person sales with a built-in payment gateway and merchant account. PCI compliant software, quick account setup in minutes (sign up here). |
Transparent pricing
Even better, a simplified payment flow means simplified pricing based strictly on transaction fees:
- 2.6% + 15¢ transaction fee for all swiped, dipped (chip cards), or tapped (NFC) in-person payments
- 3.5% + 15¢ transaction fee for in-person payments where the card number is entered manually
- 2.9% + 30¢ transaction fee for online payments with our e-commerce API
There are no monthly charges and no additional fees. Our flat rates include everything from SaaS and PCI-compliance fees to interchange and chargeback fees.
Fast payments
Square merchants receive their funds in one to two business days. If you need access to your money faster, we offer two options (at a cost of 1% of the total deposit):
- Scheduled Deposit sends your daily sales to your bank account the same day (including weekends and holidays).
- Instant Deposit is a one-off deposit that goes to your bank account instantly (including weekends and holidays). Currently, Instant Deposit is only available through the Point of Sale API.
The Future of Payment Gateways
Industry Trends
The payment gateway industry is evolving rapidly, driven by trends that include the rise of omnichannel payments, which enable seamless transactions across online, in-store, and mobile platforms as well as Buy Now, Pay Later (BNPL) options that offer flexible payment plans to attract customers. Enhanced security measures, such as tokenization and biometric authentication, are becoming standard to combat fraud and build trust. Additionally, payment processors are increasingly leveraging AI and machine learning to optimize payment processes, detect anomalies, and personalize user experiences. Meanwhile cryptocurrency payments are becoming more common.
Impact of technology on payment solutions
Before you sign up with a payment gateway, be sure to do your homework and find out if there are any hidden fees or costs, and make sure you understand how it fits into your existing solutions. For example, if you have an online payment gateway for e-commerce and a physical payment gateway for in-person payments, you want both systems to feed into your POS to simplify bookkeeping. And if your credit card payment gateway solutions aren’t integrated with the rest of your payment landscape, you want to make sure they maintain PCI compliance or you could be on the hook for some kinds of fraud.
If you’re growing your business, launching a new location, or taking credit card payments for the first time, it’s important to have a clear understanding of what different combinations of payment gateways, payment processors, and merchant accounts cost before you sign anything.
