Online payment processing for your website

How does online payment processing work?

Online payment processing is the chain that takes a card payment from your checkout to the bank that issued the card and back while the customer waits, then moves the money into your account. The payment gateway carries the card details, and your processor and the card network route each request. Here is one order, start to finish:

1. The customer enters a card on your checkout: a page your provider hosts, the provider's card fields inside your page, or a form you build yourself.
2. The gateway encrypts the details and runs your fraud rules, such as address verification, the security code check and limits on repeated attempts.
3. The authorization request travels through your processor and the card network to the bank that issued the card, which approves or declines the sale.
4. Approved sales are captured, either right away or when the order ships, and go out in a daily batch for clearing and settlement.
5. Your acquiring bank deposits the money in your business bank account on its funding schedule.

The Federal Reserve's reports on debit card costs sort this work into three stages: authorization, clearing and settlement (Federal Reserve). The first three steps happen while the customer is still on your page. The deposit comes later, and Clearo offers same-day or next-day funding options. Our guide to what a payment gateway is separates the gateway from the processor and the merchant account.

What does online payment processing cost?

Expect to pay more per sale online than at a counter. Interchange, the part of each fee that goes to the card's issuing bank, is higher when the card isn't present. Visa's US schedule shows the gap for a standard consumer credit card in its "all other products" group, with rates effective April 18, 2026 (Visa):

Say you sell $20,000 a month online across 400 orders, all on those standard cards. Interchange alone comes to $418: 1.89% of $20,000 is $378, plus 400 × $0.10. The same sales dipped or tapped at a counter would carry $342 in interchange, $76 less. That's before network fees and before any provider's markup. Interchange doesn't change with the processor, so the markup and the fees on top are the parts worth comparing.

What moves your cost up or down:

• Card mix. On the same Visa schedule, a Traditional Rewards credit card costs 2.04% + $0.10 when it isn't present, against 1.89% + $0.10 for the standard card above.
• Order size. The fixed $0.10 is 1% of a $10 order but 0.05% of a $200 one, so small baskets pay more as a share of the sale.
• Gateway and account fees. A monthly or per-transaction gateway fee sits outside interchange, so get each one in writing.
• Fraud and disputes. A chargeback takes back the sale and can bring a fee, and online orders carry fraud risk that a chip can't cover.
• Pricing model. A flat rate folds all of this into one rate; interchange-plus shows each part on your statement.

What security rules apply to online payments?

Two sets of rules decide most of the work: PCI DSS, which sets how much security work your checkout creates, and the card networks' fraud and dispute rules, which decide who pays when a stolen card gets through. How you take the card decides your PCI questionnaire:

PCI SSC added the script-attack check to SAQ A from March 31, 2025 (PCI SSC), and its FAQ says the check applies to embedded forms, not to a plain redirect (PCI SSC). SAQ A-EP is written for sites that don't receive card data but can still affect the payment's security (PCI SSC), and SAQ D covers merchants the shorter forms don't describe (PCI SSC). Your acquirer confirms which one you file. Whatever the setup, PCI DSS bars keeping a card's security code after the sale is authorized, even encrypted (PCI SSC). Our hosted payment page guide covers the trade-offs, and our PCI compliance page covers the rest of the standard.

Fraud rules work differently online. The US chip liability shift that began October 1, 2015 targets counterfeit fraud at the point of sale (Visa), so it does nothing for a website, and when a cardholder disputes an online order as fraud, the loss usually lands on the merchant. 3-D Secure can shift that: Visa says a transaction successfully authenticated through Visa Secure is protected from fraud-related disputes (Visa). Our 3-D Secure guide explains when it's worth the extra step.

Visa keeps score, too. Its Acquirer Monitoring Program divides a merchant's fraud reports and disputes by its settled card-not-present transactions, and from April 1, 2026 it treats a US or Canadian merchant as excessive at 1.5% once the month's count reaches 1,500 (Visa). Card testing, where bots try stolen card numbers on your checkout, is one way a small shop's fraud numbers climb; our guides to card testing fraud and ecommerce fraud prevention cover the defenses.