A payment gateway is the technology service that securely captures a customer’s payment details at checkout, encrypts or tokenizes them and forwards the authorization request from the merchant to the payment processor and card networks, then returns the approval or decline. In e-commerce checkout and payments, it is the bridge between the online store and the financial system.
The gateway does not move money by itself. It handles data transmission, security and the response, while acquiring banks and processors handle clearing and settlement. Many modern providers bundle these roles, which is why the terms are often blurred.
How a payment gateway processes a transaction
A card payment passes through a fixed sequence of parties in about one to three seconds. The gateway sits at the start of that chain and at its end, because it both sends the request and delivers the result back to the checkout.
- The customer enters card or wallet details in a hosted payment field or redirect page controlled by the gateway.
- The gateway tokenizes the card data and sends an authorization request to the processor or acquirer.
- The card network routes the request to the issuing bank, which checks funds, limits and fraud signals.
- The issuer returns an approval or decline code, often after a 3D Secure authentication step.
- The gateway passes the result to the store, which confirms the order; capture and settlement follow later.
Authorization only reserves the funds. The merchant later captures the amount, often at shipment, and settlement transfers the money to the merchant account, typically within one to three business days depending on the acquirer and region.
Integration types and their trade-offs
The integration method decides how much card data touches the merchant’s systems, and therefore how heavy the PCI DSS compliance burden is. It also shapes how much control the merchant has over checkout design.
| Integration type | How it works | PCI DSS scope | Checkout control |
|---|---|---|---|
| Hosted payment page | Customer is redirected to the gateway | Smallest, often SAQ A | Low |
| Embedded fields or iframe | Gateway fields sit inside the store page | Small, SAQ A or A-EP | Medium to high |
| Direct API | Store servers receive card data | Large, SAQ D | Full |
| Wallet button | Apple Pay or Google Pay supplies a token | Small | Limited to wallet flow |
| Platform plugin | Prebuilt module for a store platform | Depends on method used | Template-based |
For most stores, embedded fields with tokenization offer the best balance. The page looks native, but the raw card number never reaches the merchant’s server.
Security functions inside the gateway
A gateway carries much of the security load of online payments. It encrypts data in transit with TLS, replaces card numbers with tokens that are useless outside the merchant relationship and stores the real card data in a vault certified under PCI DSS Level 1, the highest service provider tier.
In the European Economic Area and the United Kingdom, strong customer authentication under PSD2 requires two-factor verification for many online card payments. The gateway runs the 3D Secure 2 protocol, which sends rich device and transaction data to the issuer so that low-risk payments can pass without a visible challenge.
Stored tokens also enable recurring and one-click payments. When a customer saves a card, the gateway keeps the token and, with network tokens and account updater services, can refresh expired card details automatically, which reduces involuntary churn in subscription businesses.
Payment gateway versus processor and related roles
The clearest distinction is that the gateway is the front door and the payment processor is the engine behind it. A processor executes the transaction with the card networks and banks, while the gateway collects data and connects the store.
| Role | Main function | Visible to the customer |
|---|---|---|
| Payment gateway | Captures, secures and routes payment data | Yes, payment form |
| Payment processor | Executes authorization and clearing | No |
| Acquiring bank | Holds the merchant account and receives funds | No |
| Card network | Sets rules and connects acquirers and issuers | Brand logo only |
| Issuing bank | Approves or declines the cardholder payment | Through 3D Secure prompts |
| Payment service provider | Bundles gateway, processing and merchant account | Yes, as one brand |
Choosing a payment gateway
The choice of gateway affects conversion rate, costs and international reach more than most store owners expect. A gateway that does not support the payment methods customers prefer in a given country loses orders at the final step.
| Criterion | What to check | Why it matters |
|---|---|---|
| Fees | Percentage plus fixed fee, cross-border surcharges | Determines margin per order |
| Payment methods | Cards, wallets, bank transfers, buy now pay later | Matches local preferences |
| Authorization rate | Share of approved legitimate payments | Directly affects revenue |
| Fraud tools | Risk scoring, 3D Secure rules, velocity checks | Reduces chargebacks |
| Payout schedule | Settlement delay and reserves | Affects cash flow |
| Platform support | Native plugin for the store platform | Reduces integration effort |
Larger merchants often use two or more gateways with smart routing, which sends each payment to the provider most likely to approve it and provides failover during outages.
Risks and common mistakes
The most expensive mistake is storing or logging raw card data on merchant systems, which expands compliance scope and creates breach liability. A second is treating every decline as fraud, when many declines are soft declines that succeed after authentication or a retry.
- Capturing funds long after authorization, after the authorization hold has expired.
- Ignoring webhook notifications, which leaves orders marked unpaid when payment succeeded.
- Applying 3D Secure to every payment without considering exemptions under SCA rules.
- Comparing gateways only by headline fee and missing currency conversion and refund costs.
A non-technical view
A payment gateway works like a secure courier at the shop’s till. When you pay online, it takes your card details in a sealed envelope, carries them to your bank and returns with a yes or a no in a few seconds.
The shop never needs to open the envelope. That is the point: your card number stays protected, and the shop only learns whether the payment went through.
A concrete example
A midsize online bookstore that sells across several European countries uses a single gateway with embedded card fields on its checkout page. Customers pay with cards, digital wallets and local bank transfer methods, and the gateway applies 3D Secure only when the risk score or regulation requires it.
The store authorizes each order at checkout and captures the payment when the warehouse ships the parcel, usually within two days. After adding a popular local payment method for one market, the store sees fewer abandoned checkouts in that country, and because card numbers never touch its servers, it completes the simplest PCI DSS self-assessment each year.