What is a payment gateway? How it works and what it costs

A payment gateway is the software that connects your checkout to the card networks. When a customer types a card number into your website, a payment link, or a virtual terminal, the gateway encrypts it, sends it to your processor for approval, and returns the answer in a second or two. It does for online and phone orders what a card terminal does at the counter. What it doesn't do is hold your money. Settlement runs through your merchant account and the acquiring bank behind it.

The confusion around gateways is understandable. Most providers bundle the gateway, the processing, and the merchant account, then bill for them in different places on your statement. That makes it easy to pay for a gateway twice, or to sign up for one that doesn't fit how you sell.

What does a payment gateway do?

A gateway moves card data safely between your checkout and the payment system. On a typical online sale it handles five jobs:

1. Collects the card number, expiration date, and security code, either on its own hosted page or through fields embedded in yours.
2. Encrypts that data and, in most setups, replaces the card number with a token you can keep on file without holding the card itself.
3. Runs your fraud rules, such as address and security code checks or limits on repeated attempts.
4. Sends the authorization request to your processor and passes back the card issuer's approval or decline.
5. Queues approved sales for settlement and gives you the reports to reconcile them.

Visa treats gateway companies as third-party agents. If you sign with one directly instead of getting it through your acquirer, Visa classifies the company as a merchant servicer, and you're expected to tell your acquirer that you use it, according to Visa's guide to acceptance entities. That rule is one reason we suggest getting your gateway from your processor, or at least confirming your processor supports the one you like before you build around it.

Payment gateway vs payment processor vs merchant account

The gateway handles the front end of an online or phone sale. Everything after the authorization request, including getting you paid, belongs to the processor, the acquiring bank, and the card networks.

Two details trip people up. First, you never pay interchange to Visa directly. Visa's own fee schedule says merchants pay a "merchant discount" to their financial institution, and that one rate can cover a whole bundle of processing services (Visa USA Interchange Reimbursement Fees). Second, one company can fill several rows at once. Visa notes that a payment facilitator may process transactions through a gateway link between the acquirer and the seller, which is why those signups come with a checkout attached (Visa). Sales agents, called ISOs, may resell a gateway alongside a merchant account, but Visa says they don't process transactions or receive settlement funds themselves.

For the account side of this table, read our guide to what a merchant account is. For the all-in-one route, see payment facilitator vs merchant account.

How does an online card payment get from checkout to your bank?

Here is what happens to a $120 order placed on a Friday evening with a small online shop in Denver. The exact timing depends on your provider's batch cutoff and funding schedule.

1. The customer enters a card on your checkout page. With a hosted page or embedded fields, the card data goes to the gateway, not to your server.
2. The gateway encrypts it, runs your fraud rules, and creates a token for the card.
3. The gateway sends an authorization request to your processor, which routes it through the card network to the bank that issued the card.
4. The issuer checks the account and its own fraud models, then approves or declines. The answer comes back along the same path, and your site shows it to the customer.
5. An approval places a $120 hold on the customer's available credit. No money has moved yet.
6. You capture the sale, either right away or when the order ships if your gateway is set to authorize first and capture later.
7. At your daily cutoff, captured sales go out in a batch for clearing and settlement.
8. Your acquirer deposits the money in your business bank account, either net of fees or with fees billed at month end.

The Federal Reserve's reports on debit card costs group this work into three stages: authorization, clearing, and settlement. Steps one through four take seconds. Steps seven and eight take longer, and that gap is where funding speed matters. We offer same-day and next-day funding options, and our guide to same-day funding explains how the timing works.

How does a payment gateway keep card data safe?

Three layers do most of the work: encryption while data moves, tokens instead of stored card numbers, and fraud screening before a sale is approved.

Encryption in transit

PCI DSS Requirement 4 calls for strong cryptography to protect card data during transmission over open, public networks (PCI DSS v4.0.1, SAQ D). A gateway handles that between the customer's browser and its servers, and between its servers and the processor. Your part is keeping your own site on HTTPS and making sure card numbers never detour through systems you control, such as order notes, email, or chat logs.

Tokens instead of card numbers

A token is a stand-in value that replaces the card number, and you'll hear about two kinds. Gateway tokens are created by your gateway so you can charge a returning customer or run recurring billing without keeping the card yourself. Network tokens come from the card networks under an EMVCo specification, which replaces the card number with a unique alternative value that can be restricted to a specific merchant, device, or payment scenario (EMVCo).

PCI SSC's tokenization guidelines describe tokens as a way to minimize how much card data sits in your environment, which in turn affects how much of PCI DSS applies to you. One practical catch: a gateway token generally means nothing to another gateway. Before you sign, ask whether you can export stored cards if you leave. Subscription businesses learn this the hard way.

Fraud screening

Before a sale reaches the issuer, the gateway can check it against rules you set:

• Address verification (AVS) compares the billing address the customer typed with the address the card issuer has on file.
• The security code check confirms the three- or four-digit code printed on the card.
• Velocity rules limit how many attempts one card, email address, or device can make in a set period, which slows down bots testing stolen card numbers.
• 3-D Secure brings the card issuer into the check. EMVCo describes EMV 3-D Secure as an exchange of data between the merchant and the issuer to verify that the person buying is the legitimate cardholder, aimed at card-not-present fraud (EMVCo).

Fraud rules work like a dial. Too loose and you eat chargebacks. Too tight and you decline good customers because their apartment number was typed differently from the bank's records. Our online payments include fraud screening with AVS, CVV checks, and velocity rules.

Hosted vs integrated checkout: which means less PCI work?

The less your own website touches card data, the smaller your PCI workload. A hosted payment page or gateway-hosted fields can qualify you for the shortest questionnaire, SAQ A. Build your own card form and you move to a longer one.

The embedded-fields row changed in 2025. PCI SSC removed two payment-page script requirements from SAQ A and replaced them with an eligibility criterion: the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce systems, effective March 31, 2025 (PCI SSC). A follow-up FAQ says you can meet it with script protections of your own or with confirmation from your gateway that its embedded form includes them, and that the criterion applies to embedded forms, not to plain redirects (PCI SSC FAQ 1588).

SAQ A-EP covers e-commerce merchants whose website doesn't receive card data but can still affect the security of the payment, such as a site that builds its own payment form (PCI SSC). SAQ D is the catch-all for merchants the shorter questionnaires don't describe (PCI SSC). Which one you file is your processor's call, so confirm it before you design your checkout.

Our view: unless you have developers and a security budget, use the hosted page or embedded fields. A slightly more custom checkout rarely justifies a much longer compliance questionnaire.

What should you look for in a payment gateway?

Use this list when you compare options:

• It comes from your processor or is supported by it, so you aren't stuck halfway through setup.
• It offers a hosted page or embedded fields, with written confirmation of the script protections the PCI SSC FAQ describes.
• It tokenizes cards for repeat purchases and subscriptions, and lets you export stored cards if you leave.
• Its fraud tools are adjustable: AVS, security code checks, velocity limits, and 3-D Secure.
• It includes a virtual terminal for phone and email orders, so you aren't running two systems.
• Its reports match your bank deposits line for line.
• Support answers when a checkout breaks on a Saturday night.
• Every fee is in writing before you sign.
• If you sell in Canada, it settles in Canadian dollars and offers the debit options your customers use online. Our guide to payment gateways in Canada covers the rest of that checklist.

How much does a payment gateway cost?

Gateway pricing comes in two shapes: separate gateway fees on top of your merchant account, or a bundled rate that folds the gateway into one percentage. These are the fee types to expect.

Per-transaction fees matter more than they look. Here's a made-up example, not anyone's actual pricing. Say a gateway charges $15 a month plus $0.07 per transaction, and you run 1,200 orders a month averaging $50, or $60,000 in sales. The gateway costs $15 plus 1,200 times $0.07, which is $99 a month, about 0.17% of sales. Now keep the order count but drop the average order to $15. Sales fall to $18,000, the gateway still costs $99, and that's 0.55% of sales. Small-ticket sellers should push hardest on the per-item fee.

Bundled rates are simpler, but you can't see what the gateway costs inside them. We compare the two pricing styles in interchange-plus vs flat-rate pricing, and our Clearo vs Stripe page sets an all-in-one provider beside a merchant account. If your statement shows gateway charges you don't recognize, our list of hidden processing fees will help you sort them.

Do you need a separate payment gateway?

It depends on how you sell:

• In person only: no. Your terminal connects to your processor without a separate gateway purchase.
• All-in-one provider: no. The payment facilitator includes a gateway in its signup.
• Your own merchant account plus online sales: yes. Get it from your processor or from a third party your processor supports.
• Phone and mail orders: yes, in the form of a virtual terminal, which is a gateway with a keypad on the screen.

Card network rules and PCI DSS don't vary by state, so the same choices apply whether you sell locally or ship across the United States. Clearo's online payments include hosted checkout and gateway integration, so your gateway and merchant account come from one provider on interchange-plus pricing.

Common payment gateway mistakes

• Paying for two gateways after a platform switch because nobody canceled the old one.
• Building a custom card form for looks, then discovering it moved you from SAQ A to SAQ A-EP.
• Storing customer cards in a vault you can't take with you.
• Leaving fraud filters at their default settings and never reviewing declines.
• Reconciling gateway reports against sales instead of against bank deposits.

Your next step

If you want to know what your gateway costs today, or whether you're paying for one twice, send us a recent statement for a free statement review. We'll mark every gateway and processing line and tell you what each one is for. If you're setting up online payments from scratch, talk to our team about hosted checkout and gateway integration.