Quick definition
A payment gateway is the service that securely passes a customer's card or bank payment details from a website, app or terminal on for approval, then returns the approved or declined result to the business.
Several organizations are involved when a customer pays by card: the business, the customer's card issuer, the business's acquiring bank, the card networks and one or more processors. The payment gateway is the piece the business connects to directly. It accepts the payment details from the checkout or terminal, sends them on for approval, and reports the result back.
How a card payment flows
- Checkout. The customer enters card details on a payment form, or taps or inserts a card at a terminal.
- Authorization. The gateway passes the transaction on to check that funds are available. The customer's card issuer approves or declines it and, if approved, places a hold on the funds.
- Capture. The business confirms it wants to collect the authorized amount, often straight away for services and digital goods, or when an order ships.
- Settlement. Captured transactions are gathered into a batch and sent for settlement on a schedule set by the gateway or processor; Authorize.Net, for example, settles once every 24 hours after a cut-off time the merchant can change. Funds then move to the business's bank account. How long that takes depends on the processor and the merchant agreement, often a few business days, and a reserve or hold placed by the provider can delay it.
What else a gateway provides
- Hosted or embedded payment forms, so customers type card numbers into the provider's page rather than one served by the business's own server.
- Tokenization, which replaces stored card details with a reference token so repeat and recurring charges can be made without the business keeping card numbers.
- Fraud screening tools, such as address verification and card security code checks.
- Refunds, voids, reporting and APIs for connecting websites, invoicing and accounting systems.
Gateway, processor and merchant account
These are separate roles, even when one company sells them together. The gateway carries transactions from your checkout. The processor handles transaction processing between the gateway, the card networks and the banks. A merchant account is an agreement with an acquiring bank (the financial institution that processes card transactions for merchants), set up directly or through a payment provider after an underwriting review; after settlement, the acquirer deposits the card sale funds into your business bank account. A business can also accept cards without a merchant account of its own through a payment facilitator, which contracts with an acquirer, signs up businesses as sponsored merchants and receives settlement funds on their behalf. Some providers bundle a gateway and a merchant account into one sign-up.
Limitations
A gateway does not make a business automatically compliant with card security rules, and it does not make every fraud decision for you. Fees, supported payment methods, compatible processors and contract terms vary widely between providers. Rules on adding surcharges or convenience fees for card payments also vary by card network, processor contract and jurisdiction, so check them before charging customers extra.
A practical example
An outdoor guide service takes trip deposits through a form on its website that emails card numbers to the office, where staff type them into a terminal.
The company switches to a gateway's hosted payment page. Customers enter their card details on the provider's page, and the website receives only the result and a transaction reference. For the balance due before each trip, the booking form asks customers to agree to that later charge and shows the amount, the date and the cancellation policy. The gateway stores the card in a customer profile, and the company charges it on the agreed date, flagged as a merchant-initiated charge, without anyone seeing or storing the card number. Staff no longer handle card numbers by email, which removes a serious security risk.
Why it matters
The gateway is where your customers' payment experience and your security obligations meet. The choice and the way it is integrated affect how easy checkout is, how quickly money arrives, and how much of the card-security burden falls on your own systems.
For example, the PCI Security Standards Council publishes a shorter self-assessment questionnaire, SAQ A, for merchants that have fully outsourced card handling and do not electronically store, process or transmit card account data on their own systems. For an e-commerce merchant, every element of the payment page must come only from a PCI DSS compliant third-party provider, whether through a redirect or an embedded frame, and since 2025 a merchant that embeds the provider's form in its own page must also confirm its site is not susceptible to attacks from scripts. If any element of the payment page comes from the merchant's own website, SAQ A is not available. Every eligibility criterion in the SAQ has to be met, and the merchant's acquirer or the card brands decide which questionnaire applies.
Common mistakes
- Storing card security codes. PCI DSS does not permit keeping card verification codes (CVV, CVC and similar) once the transaction they were collected for has been authorized, even if they are encrypted and even for recurring billing.
- Collecting card numbers by email, notes or self-hosted forms when a hosted or tokenized option is available.
- Mixing up test and live credentials, which can create real charges during testing or failed payments after launch.
- Authorizing without capturing. An authorization only places a hold; if the business never captures it, the money is never collected.
- No plan for declined recurring payments. Cards expire and get replaced, so recurring billing needs a process for updating them.
- Assuming surcharges are always allowed. Card-network rules, processor contracts and local laws can differ; confirm before adding a fee.
Payment gateway vs. payment processor vs. merchant account
| Payment gateway | Payment processor | Merchant account | |
|---|---|---|---|
| What it is | Service that takes payment details from your checkout or terminal and sends them on for approval | Company that handles transaction processing between the gateway, card networks and banks | Agreement with an acquiring bank, made directly or through a provider, that lets your business accept cards and receive the proceeds |
| What you deal with | Payment forms, terminal setup, API, reporting dashboard | Usually indirectly, through your merchant provider | Application, underwriting, deposits and statements |
| Setup | Account setup and integration | Arranged with the merchant account | Underwriting review of the business |
Some providers sell all three as a single package; others let you connect a gateway to a merchant account you already have. A payment facilitator lets a business accept cards as a sponsored merchant under the facilitator's own acquirer relationship, without a merchant account of its own.
Frequently asked questions
Do I need both a payment gateway and a merchant account?
Not always. A business with its own merchant account also needs a way to submit transactions, such as a gateway, and some providers bundle both into one sign-up. Alternatively, a payment facilitator can let a business accept cards as one of its sponsored merchants, without a merchant account of its own. Card-network rules can require a sponsored merchant above a certain annual card volume to sign a direct agreement with an acquirer.
What is a hosted payment page?
A payment form served by the payment provider instead of your own website, either as a separate page the customer is sent to or embedded in your page. Because card details are entered on the provider's systems, it can reduce the card-security requirements that apply to your website. Whether a merchant qualifies for the shorter PCI DSS self-assessment questionnaire still depends on meeting every eligibility criterion in that questionnaire.
Can a gateway save cards for recurring billing?
Yes. Many gateways offer tokenization or customer profiles, which store the card on the provider's side and give you a reference to charge later. A card saved this way is still a stored credential under card-network rules. Before saving it, get the customer's agreement and tell them how it will be used, including the amount or how it is calculated, how often or on what event you will charge, and the cancellation policy. Each later charge must be flagged through the gateway as customer-initiated or merchant-initiated, and recurring or unscheduled charges must stay within the agreed terms. The card security code cannot be kept after authorization.
Sources
- How payment processing systems work, Authorize.Net (accessed November 9, 2026)
- What is a merchant account and why do you need one?, Authorize.Net (accessed November 9, 2026)
- Payment Transactions (API reference), Authorize.Net (accessed November 9, 2026)
- When do transactions batch for settlement, can this timing be changed, and how to find unsettled and settled transactions?, Authorize.Net (accessed November 9, 2026)
- Transaction Cut-Off Time, Authorize.Net (accessed November 9, 2026)
- Reserves, Stripe (accessed November 9, 2026)
- Visa's Payment Facilitator Model, Visa (accessed November 9, 2026)
- Glossary, PCI Security Standards Council (accessed November 9, 2026)
- Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A, PCI Security Standards Council (accessed November 9, 2026)
- FAQ 1588: How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?, PCI Security Standards Council (accessed November 9, 2026)
- FAQ 1293: If a merchant’s e-commerce implementation meets the criteria that all elements of payment pages originate from a PCI DSS compliant service provider, is the merchant eligible to complete SAQ A or SAQ A-EP?, PCI Security Standards Council (accessed November 9, 2026)
- FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions?, PCI Security Standards Council (accessed November 9, 2026)
- Improving Authorization Management for Transactions with Stored Credentials, Visa (accessed November 9, 2026)
- Card-On-File Transactions (API reference), Authorize.Net (accessed November 9, 2026)
- Customer Profiles (API reference), Authorize.Net (accessed November 9, 2026)
- Testing Guide, Authorize.Net (accessed November 9, 2026)