The basic setup: what you need before your first payment
To accept credit card payments online, you need three things: a payment processor (the company that handles the transaction), a merchant account (your connection to the banking system), and a payment gateway (the software that secures the data). Most modern payment processors bundle these together, so you do not order them separately — you sign up with one company and they provide all three.
The processor takes the card details, verifies the funds with the cardholder's bank, deposits money into your business account, and handles refunds. They charge you a percentage of each transaction (typically 2.2% to 3.5% plus a flat fee per transaction) and sometimes a monthly account fee. You do not need to be incorporated or have a business license to start, though you will need a Social Security number or EIN, a bank account in your business name, and basic information about what you sell.
The payment gateway is the form or page where your customer enters their card number. It encrypts that data so neither you nor your website ever sees the raw card details — the processor receives them directly. This protects you from storing sensitive information and from the liability if that data were breached.
Key Takeaways
- You need a payment processor (like Stripe, Square, or PayPal), a merchant account, and a payment gateway, but most processors bundle these into one signup.
- Transaction fees typically run 2.2% to 3.5% of the sale plus a flat fee per transaction, and some processors charge a monthly minimum or account fee.
- The payment gateway encrypts card data so your business never handles the raw card number, reducing your fraud liability.
- Different processors suit different business models: e-commerce sites, in-person retail, invoicing, and subscription billing each have processors optimized for that use.
- You will need a business bank account, a Social Security number or EIN, and basic business information to open a merchant account.
Choosing between hosted pages, embedded forms, and point-of-sale systems
A hosted payment page redirects your customer to the processor's website to enter their card details, then sends them back to you. This is the simplest to set up — you do not need a developer — but it interrupts the customer's experience on your site. Processors like PayPal and Square offer this option at no extra cost.
An embedded payment form sits on your own website or app and collects the card details without leaving your page. This feels more seamless to the customer and typically converts better. It requires more technical setup (you or a developer integrate the processor's code into your site), but most modern processors provide pre-built code that makes this straightforward. Stripe, Square, and Authorize.net all support embedded forms.
A point-of-sale system is hardware and software for in-person payments — a card reader that plugs into a tablet or phone. Square Reader, Clover, and Toast are common examples. If you sell in person or want to accept payments both online and at a physical location, a POS system may be more efficient than juggling two separate processors.
Your choice depends on your business model. A freelancer sending invoices might use a processor with built-in invoicing (like Stripe Billing or FreshBooks). An e-commerce store needs a processor that integrates with shopping cart software (Shopify, WooCommerce, BigCommerce). A retail shop needs a POS system. Start by listing what your customer sees — do they enter a card on your website, on a phone, or in person? — and choose the processor built for that.
How to connect a payment processor to your website or app
If you use a website builder like Shopify, Wix, or Squarespace, payment processing is built in. You sign up for a merchant account through their dashboard, and they handle the integration for you. You do not write any code. The trade-off is that you pay their transaction fees (often slightly higher than standalone processors) and you are locked into their ecosystem.
If you have a custom website or app, you integrate a processor's API (process programming interface). This means a developer adds code that sends card data to the processor's servers and receives a response confirming or declining the transaction. Stripe and Authorize.net have the most detailed documentation and the most developer support, so they are common choices for custom builds. The integration typically takes a few hours to a few days depending on complexity.
For straightforward invoicing or one-off payments, you can use a processor's hosted page without any integration. You generate a payment link in your processor's dashboard, send it to the customer via email, and they pay on the processor's page. Square, PayPal, and Stripe all offer this. No coding required, and it works from any device.
Understanding fees and how they affect your pricing
Most processors charge a percentage fee (2.2% to 3.5% of the transaction) plus a per-transaction fee (typically $0.30). Some also charge a monthly account fee ($10 to $50) or a minimum monthly processing volume. A few charge a flat monthly fee instead of per-transaction fees, which makes sense if you process high volume.
The exact rate depends on the processor, your industry, your sales volume, and whether the card is present (swiped in person) or not present (entered online). Online transactions carry higher fraud risk, so they cost more. A restaurant processing in-person card payments might pay 2.2% plus $0.10 per transaction. An e-commerce store processing online payments might pay 2.9% plus $0.30.
You can pass these costs to the customer by building them into your prices, or you can absorb them as a business expense. Some businesses add a "processing fee" to the invoice, but this can reduce conversion — customers see a higher total and may abandon the purchase. Most successful businesses price their product or service to cover processing costs invisibly.
Compare processors by calculating the total cost of a typical transaction for your business. If you sell a $100 item online, Processor A at 2.9% plus $0.30 costs $3.20. Processor B at 3.5% plus $0.10 costs $3.60. Over a year of 1,000 sales, that is a $400 difference. But if Processor B integrates better with your software or has better customer support, the extra cost may be worth it.
Security requirements and PCI compliance
The Payment Card Industry Data Security Standard (PCI DSS) is a set of rules that protect card data. If you collect card details yourself — even if you encrypt them — you must comply with PCI DSS, which involves regular security audits, firewalls, and strict access controls. This is expensive and complicated for most small businesses.
The easiest way to avoid PCI compliance is to never touch the card data. Use a payment processor with a hosted page or embedded form, and the processor handles PCI compliance for you. You are responsible only for protecting your own login credentials and not storing card numbers on your servers. This is why most small businesses use a processor's payment gateway rather than building their own.
If you use a shopping cart platform like Shopify or WooCommerce, the platform handles PCI compliance as part of their service. You do not need to do anything beyond keeping your login password find.
Comparing popular processors for different business types
Stripe is built for developers and e-commerce. It has excellent documentation, flexible APIs, and low fees (2.2% plus $0.30 for online card payments). It does not charge a monthly fee. It works well for subscription billing, invoicing, and custom integrations. The downside is that setup requires some technical knowledge or a developer.
Square works for both in-person and online payments. It offers a free point-of-sale app, a payment form for websites, and invoicing. Fees are 2.6% plus $0.10 for in-person payments and 2.9% plus $0.30 for online payments. It is easier for non-technical users than Stripe, but less flexible for complex custom builds.
PayPal is the oldest and most recognizable. It charges 2.99% plus $0.30 for online payments. It works for invoicing, shopping carts, and one-off payments. The downside is that some customers distrust PayPal or do not have an account, which can reduce conversion. PayPal is a good choice if your customers are already familiar with it.
Authorize.net is common for traditional e-commerce and has been around for decades. It charges a monthly gateway fee ($25 to $35) plus per-transaction fees (typically 2.9% plus $0.30). It is a good choice if you process high volume and want to negotiate custom rates, but it is more complex to set up than Stripe or Square.
For invoicing-heavy businesses, FreshBooks or Wave bundle payment processing with accounting software. For subscription billing, Recurly or Chargify specialize in recurring charges. For nonprofits, Donorbox and GiveWP offer lower fees on donations.
Testing your payment setup before going live
Every processor provides a test mode where you can process fake transactions without charging real cards. Before you launch, switch to test mode, create a test payment, and verify that the money appears in your test account and that your customer receives a confirmation email. Use the processor's test card numbers (usually something like 4111 1111 1111 1111) to simulate different scenarios: successful payments, declined cards, and expired cards.
Test the full customer journey: they land on your payment page, enter the test card, submit, and see a confirmation. Check that your confirmation email is formatted correctly and arrives quickly. Test a refund by processing one in your processor's dashboard and verify that the test card is credited. Test on mobile, because many customers pay on phones and a form that works on desktop may break on a small screen.
Once everything works in test mode, switch to live mode and process a small real transaction to yourself (if your processor allows it) or a trusted friend. Verify that the money arrives in your business bank account and that the timing matches what the processor promised. Only then should you announce that you accept payments.
Frequently Asked Questions
What happens if a customer disputes a charge?
The customer contacts their bank and files a chargeback, claiming they did not authorize the charge or did not receive the product. The processor notifies you and temporarily removes the funds from your account. You can dispute the chargeback by providing evidence (an order confirmation, shipping receipt, or email from the customer). If you win, the funds return to your account. If you lose, you lose the money and may pay a chargeback fee ($15 to $100).
Can I accept payments without a business bank account?
Most processors require a business bank account to deposit funds. Some allow a personal account if you are a sole proprietor, but this blurs the line between personal and business finances and makes accounting harder. Open a business account — it is inexpensive and protects you legally.
What if I want to accept payments but do not have a website?
You can generate a payment link in your processor's dashboard and send it via email, text, or social media. The customer clicks the link, enters their card, and pays. No website needed. Square, PayPal, and Stripe all offer this.
How long does it take for money to appear in my bank account?
Most processors deposit funds within one to three business days. Some offer faster deposits (next day or same day) for a higher fee. Check your processor's settlement schedule before signing up if timing matters to your cash flow.
Do I need to report credit card payments to the IRS?
Yes. Your processor will send you a 1099-K form at the end of the year if you process more than a certain threshold (currently $20,000 and 200 transactions, though this may change). You report this income on your tax return. Keep records of all transactions for your accountant.