How to accept payments online: a setup guide by channel

To accept payments online, you need three things: an account that lets you take cards, a payment gateway that sends card details for approval, and a place where customers type those details. That account can be your own merchant account with an acquiring bank, or a sub-merchant account under a payment facilitator. The third piece is where businesses differ, and it's what this guide is about: how to pick and set up the right online channel for the way your customers actually buy.

An online store needs a checkout on its website. A contractor needs invoices with a pay button. A cake decorator who books orders through Instagram needs payment links, and a business that takes orders by phone needs a virtual terminal. Most businesses end up with two or three of these on the same account.

Online sales are a big slice of retail. The Census Bureau's estimate for the second quarter of 2026 put e-commerce at 17.1% of total US retail sales, seasonally adjusted (US Census Bureau). If you also take cards at a counter or on the road, our broader guide on how to accept credit card payments covers terminals, mobile readers, and the application itself.

What do you need to accept payments online?

Every online payment setup, even a single payment link, has the same four parts behind it.

You can get the first three from one company or piece them together. We think one provider is the better default for a small business. You get one support line and one statement, and nobody blames someone else when a payment fails. If you're unsure which kind of account to open, our comparison of payment facilitators and merchant accounts lays out the trade-offs.

Which online payment method fits your business?

Start with how the sale happens, not with the software. This table matches each online channel to the businesses it suits and the PCI questionnaire it usually leads to.

Your acquirer has the final word on which questionnaire you file, but these are the usual outcomes. Some quick decision rules:

• You sell products at set prices to people who browse: add a checkout to your website.
• You quote each job before you get paid: send online invoices, with a link for the deposit.
• Your sales happen in direct messages, texts, or email threads: use payment links.
• Customers call to order: use a virtual terminal, or text them a link while they're on the line.
• You charge the same customer on a schedule: set up recurring billing.
• You sell higher-priced items to shoppers who'd rather pay over time: look at buy now, pay later, where a lender carries the installments.
• You sell in a store as well as online: plan both together, as our guide to omnichannel payments explains.

Here's how that looks for one business. Take a bakery in Seattle that sells cakes for pickup. Custom orders arrive by email and get a payment link for the deposit. Holiday preorders run through a hosted checkout on the bakery's website. Two coffee shops that buy pastries wholesale get an invoice at the end of each month. That's three tools on one account, and none of them puts a card number on the bakery's computer.

How do you add payments to your website?

You either send customers to a payment page your provider hosts, or you build card entry into your own checkout with the provider's embedded fields or its API. The hosted route is faster to launch and keeps your PCI work smallest. A custom integration gives you more design control in exchange for more security work.

1. Hosted payment page. The customer clicks Pay, finishes on the provider's page, and comes back to your site. Card data never touches your website. Our guide to the hosted payment page covers how it works and how to make it convert.
2. Embedded fields. The provider's card fields sit inside your checkout page in a frame. Since March 31, 2025, merchants using SAQ A have had to confirm their site isn't susceptible to script attacks that could affect their e-commerce systems (PCI SSC). PCI SSC's FAQ says you can meet that with your own protections or with your gateway's confirmation that its embedded form includes them (PCI SSC FAQ 1588).
3. Your own form or a direct API. If your page builds the form and posts card data to the gateway, you're likely looking at SAQ A-EP, which covers sites that don't receive card data but can affect the security of the payment (PCI SSC). If card data passes through your servers, expect SAQ D, the questionnaire for every merchant the shorter ones don't describe (PCI SSC).

Our advice: start hosted. If your checkout numbers later show buyers dropping off at the handoff, try embedded fields. Treat a fully custom card form as a project for a business with developers and a security budget.

If you sell through a shopping cart platform, part of this decision is already made. You can only use the gateways the platform connects to, so check that list against your processor before you sign anything. Clearo's online payments include hosted checkout and gateway integration. If you're still choosing a provider, our best payment processor for ecommerce list compares seven on checkout security, PCI scope, fraud screening and recurring billing. And before you apply, read our checklist for an ecommerce merchant account. Underwriters look at your website, and a missing refund policy can stall an application.

How do payment links and online invoices work?

A payment link is a web address that opens a payment page for a set amount. You paste it into a text, an email, or a direct message, and the customer pays on a page your provider hosts. An online invoice does the same job with more paperwork attached: line items, tax, a due date, and a pay button.

Use a link when speed matters and the sale is simple, like a deposit to hold a date or a one-off custom order. Use an invoice when the customer needs a document, such as a business whose accounts payable team won't pay without one, or when you want automatic reminders as the due date approaches. Link types, expiry settings, and how to keep a link from looking like a scam text are all in our payment link guide.

A few habits make both work better:

• Put the invoice or order number in the payment description so you can match payments without guesswork.
• Set links to expire when your quote does, so nobody pays an old price.
• Send links from your business email or phone number, in a thread the customer already knows.
• Turn on automatic receipts so the customer has a record with your business name on it.

How do you take phone and email orders?

Use a virtual terminal, a secure web page where your staff key in card details while the customer is on the phone. For orders that arrive by email, reply with a payment link instead of asking for a card number. Card numbers should never sit in an inbox.

A virtual terminal can keep your PCI work small too. SAQ C-VT is written for merchants who key one transaction at a time into a third-party virtual terminal on the internet, working from an isolated device (PCI SSC). The rules that keep you there are simple: one login per staff member, no paper notes of card numbers, and no security codes kept after the sale. PCI DSS prohibits storing card verification codes after authorization, even encrypted (PCI SSC).

Clearo's virtual terminal handles phone and email payments, invoices, payment links, and recurring billing in one place. For scripts, call recordings, and the other details of phone sales, see our guide on taking card payments by phone.

How do you set up recurring billing online?

Collect the card once, with the customer's agreement to the terms, store it with your payment provider, and let the system charge it on schedule. Visa's stored credential rules require cardholder consent before you store card details for future charges, and they require the first storage and each later charge to be flagged in the transaction data (Visa). Your gateway sets those flags; your job is the consent step.

Plan for cards going stale. Visa's account updater FAQ says that on average, 30% of the participating card accounts in an issuer's portfolio change their number or expiration date, or close, every year (Visa). An account updater service catches most of those changes before the next charge fails. The details, from consent wording to retry limits and cancellations, are in our recurring billing guide.

What does it cost to accept payments online?

Online sales cost more than card-present sales, mostly because of interchange, the part of each fee that goes to the card issuer. On Visa's US schedule with rates effective April 18, 2026, a standard consumer credit card in the "all other products" group carries 1.89% + $0.10 in Visa's main card-not-present program, against 1.51% + $0.10 in the matching card-present program (Visa USA Interchange Reimbursement Fees).

Here's a worked example. Say a candle shop in San Diego sells $25,000 a month online across 500 orders, and every order is paid with one of those standard Visa credit cards. Real card mixes are messier, but the math shows the layers.

• Interchange: 1.89% of $25,000 is $472.50, plus 500 × $0.10, or $50, for $522.50.
• A made-up interchange-plus markup of 0.20% + $0.08: $50 + $40 = $90.
• A made-up $15 monthly gateway fee.
• Total before network fees: $627.50, an effective rate of about 2.51%.

The markup and gateway figures are invented for the math. They aren't a quote from us or anyone else. The lesson is in the structure: interchange is the same no matter who processes your cards, so compare providers on everything layered on top of it. Our page on credit card processing fees explains each line, and interchange-plus vs flat-rate pricing shows why the model matters more when most of your sales are online.

How do you keep online payments safe?

Turn on the checks your gateway offers before your first sale: address verification, the card security code check, and velocity limits on repeated attempts. Add 3-D Secure for riskier orders.

The reason is liability. The US chip liability shift that took effect October 1, 2015 targets counterfeit fraud at the point of sale (Visa), so it does nothing for online orders. When a cardholder says they didn't make an online purchase, the loss usually lands on you. 3-D Secure changes that: under Visa Secure, a successfully authenticated transaction, or one where the issuer or cardholder doesn't take part in the attempt, protects you from fraud-related disputes (Visa).

Fraud screening with AVS, CVV checks, and velocity rules is part of Clearo's online payments. For how to tune each layer without declining good customers, read our guide to ecommerce fraud prevention. For the cost and liability rules behind all this, see card-not-present transactions.

Online payment setup checklist

1. List how customers buy from you today and pick the matching tools from the table above.
2. Apply for a merchant account or payfac account, with your website, refund policy, and contact details ready.
3. Choose a hosted checkout unless you have a clear reason to build your own.
4. Set up payment link and invoice templates with your business name and logo.
5. Give each staff member their own virtual terminal login.
6. Turn on AVS, CVV, and velocity rules, and decide which results you'll decline.
7. Confirm with your processor which PCI questionnaire you'll file.
8. Set a statement descriptor customers will recognize.
9. Run a live payment on each channel with your own card, then refund it.
10. Match your first week of deposits to your sales records.

Common mistakes when you start taking payments online

• Asking customers to email a card number when checkout gives them trouble. Send a payment link instead.
• Building a custom card form for looks, then finding out it moved you from SAQ A to SAQ A-EP.
• Using one business name on the website, another on receipts, and a third on card statements.
• Leaving fraud filters at their defaults and never looking at the orders they declined.
• Paying for two gateways after switching platforms because nobody canceled the old one.
• Sending a link for a sale you could have tapped in person, which turns a card-present sale into a pricier card-not-present one.

If you sell from Canada, the channels work the same way, though some rules differ. Our Canada overview covers the national picture, and our guide to payment gateways in Canada covers what to check in a checkout.

Your next step

If you already take some payments online, send us a recent statement for a free statement review. We'll show you what your online sales cost next to your in-person ones and whether you're paying for anything twice. Starting from scratch? Contact us and we'll map the tools above to how your customers buy, on interchange-plus pricing with no long-term contract.