Quick definition
A payment gateway is the service that securely passes a customer's card or bank payment details from a website, app or terminal on for approval, then returns the approved or declined result to the business.
Several organizations are involved when a customer pays by card: the business, the customer's card issuer, the business's acquiring bank, the card networks and one or more processors. The payment gateway is the piece the business connects to directly. It accepts the payment details from the checkout or terminal, sends them on for approval, and reports the result back.
How a card payment flows
- Checkout. The customer enters card details on a payment form, or taps or inserts a card at a terminal.
- Authorization. The gateway passes the transaction on to check that funds are available. The customer's card issuer approves or declines it and, if approved, places a hold on the funds.
- Capture. The business confirms it wants to collect the authorized amount, often straight away for services and digital goods, or when an order ships.
- Settlement. Captured transactions are typically gathered into a batch once a day and sent for settlement. Funds then move to the business's bank, which typically takes a couple of days.
What else a gateway provides
- Hosted or embedded payment forms, so customers type card numbers into the provider's page rather than one served by the business's own server.
- Tokenization, which replaces stored card details with a reference token so repeat and recurring charges can be made without the business keeping card numbers.
- Fraud screening tools, such as address verification and card security code checks.
- Refunds, voids, reporting and APIs for connecting websites, invoicing and accounting systems.
Gateway, processor and merchant account
These are separate roles, even when one company sells them together. The gateway carries transactions from your checkout. The processor handles transaction processing between the gateway, the card networks and the banks. The merchant account is a special type of bank account, set up through an acquiring bank or payment provider after an underwriting review, that receives card sale funds before they reach your business bank account. To accept cards you need a merchant account as well as a gateway, although some providers bundle the two.
Limitations
A gateway does not make a business automatically compliant with card security rules, and it does not make every fraud decision for you. Fees, supported payment methods, compatible processors and contract terms vary widely between providers. Rules on adding surcharges or convenience fees for card payments also vary by card network, processor contract and jurisdiction, so check them before charging customers extra.
A practical example
An outdoor guide service takes trip deposits through a form on its website that emails card numbers to the office, where staff type them into a terminal.
The company switches to a gateway's hosted payment page. Customers enter their card details on the provider's page, and the website receives only the result and a transaction reference. For the balance due before each trip, the gateway keeps the card as a token, so the company can charge it without anyone seeing or storing the card number. Staff no longer handle card numbers by email, which removes a serious security risk.
Why it matters
The gateway is where your customers' payment experience and your security obligations meet. The choice and the way it is integrated affect how easy checkout is, how quickly money arrives, and how much of the card-security burden falls on your own systems.
For example, the PCI Security Standards Council allows a simpler self-assessment questionnaire, SAQ A, for e-commerce merchants whose payment pages are entirely delivered by a PCI DSS validated third-party provider, whether through a redirect or an embedded frame. If any element of the payment page comes from the merchant's own website, that simpler route is not available.
Common mistakes
- Storing card security codes. PCI DSS does not permit keeping card verification codes (CVV, CVC and similar) once the transaction they were collected for has been authorized, even if they are encrypted and even for recurring billing.
- Collecting card numbers by email, notes or self-hosted forms when a hosted or tokenized option is available.
- Mixing up test and live credentials, which can create real charges during testing or failed payments after launch.
- Authorizing without capturing. An authorization only places a hold; if the business never captures it, the money is never collected.
- No plan for declined recurring payments. Cards expire and get replaced, so recurring billing needs a process for updating them.
- Assuming surcharges are always allowed. Card-network rules, processor contracts and local laws can differ; confirm before adding a fee.
Payment gateway vs. payment processor vs. merchant account
| Payment gateway | Payment processor | Merchant account | |
|---|---|---|---|
| What it is | Service that takes payment details from your checkout or terminal and sends them on for approval | Company that handles transaction processing between the gateway, card networks and banks | Special account through an acquiring bank or provider that receives card sale funds for your business |
| What you deal with | Payment forms, terminal setup, API, reporting dashboard | Usually indirectly, through your merchant provider | Application, underwriting, deposits and statements |
| Setup | Account setup and integration | Arranged with the merchant account | Underwriting review of the business |
Some providers sell all three as a single package; others let you connect a gateway to a merchant account you already have.
Frequently asked questions
Do I need both a payment gateway and a merchant account?
To accept card payments you need a merchant account as well as a way to submit transactions, such as a gateway. Some providers bundle both into one sign-up, so it can look like a single product.
What is a hosted payment page?
A payment form served by the payment provider instead of your own website, either as a separate page the customer is sent to or embedded in your page. Because card details are entered on the provider's systems, it can reduce the card-security requirements that apply to your website.
Can a gateway save cards for recurring billing?
Yes. Most gateways offer tokenization or customer profiles, which store the card on the provider's side and give you a reference to charge later. The card security code cannot be kept after authorization.
Sources
- How payment processing systems work, Authorize.Net (accessed November 9, 2026)
- What is a merchant account and why do you need one?, Authorize.Net (accessed November 9, 2026)
- FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions?, PCI Security Standards Council (accessed November 9, 2026)
- FAQ 1292: Why is there a different approach for Direct Post implementations than for iFrame and URL redirect?, PCI Security Standards Council (accessed November 9, 2026)