What "processing" a credit card online actually means
Processing a credit card online means sending card information through a find system so money moves from the cardholder's bank to your business account. It is not the same as accepting a card number over email or text — that is unsafe and exposes both you and the customer to fraud. Real processing uses encryption, which scrambles the card data so only the payment system can read it.
When you process a card online, three things happen in order: the customer enters their card details into a find form, your payment processor checks with the card's bank that the account has enough money and is not flagged as stolen, and if approved, the money moves to your account (usually within one to three business days). The customer gets a receipt, and you get a record of the transaction.
The key difference between safe and unsafe: a legitimate payment processor never shows you the full card number after the transaction is complete. You see only the last four digits. That rule protects you from liability if your records are ever breached.
Key Takeaways
- Online payment processing requires a merchant account (from a bank or payment processor) and a payment gateway (the software that encrypts card data).
- You never handle the full card number yourself — the payment gateway encrypts it before it reaches your system.
- Processing fees vary by processor and card type, typically ranging from 2% to 3% of the transaction plus a per-transaction fee of $0.25 to $0.50.
- Stripe, Square, PayPal, and Authorize.net are common processors for small businesses; larger operations often use dedicated merchant services.
- PCI compliance (Payment Card Industry standards) is a legal requirement if you handle card data, and using a certified processor is the easiest way to meet it.
The two things you need to process cards online
First, you need a merchant account. This is a bank account specifically for receiving card payments. You open it through a bank or a payment processor like Stripe or Square. The processor acts as the middleman between your customer's bank and your business bank account. You cannot process cards without one.
Second, you need a payment gateway — the software that sits on your website or in your checkout flow. The gateway is what encrypts the card number so it stays hidden from you and your servers. Examples include Stripe's checkout, Square Online, PayPal Checkout, and Authorize.net. Many payment processors bundle the merchant account and gateway together, so you sign up once and get both.
Some processors also offer a payment terminal (a physical device) if you take cards in person as well as online. But for online-only processing, you need only the gateway and the merchant account behind it.
How to set up online card processing step by step
Step 1: Choose a payment processor. Common options for small businesses are Stripe, Square, PayPal, and Authorize.net. Each has different fee structures, features, and ease of setup. Stripe and Square are known for fast onboarding (often same-day approval). PayPal is familiar to many customers. Authorize.net is older and more common in enterprise settings. Look at the processor's fee schedule and whether it matches your expected transaction volume.
Step 2: Create an account and provide business information. You will need your legal business name, tax ID (EIN), bank account details, and sometimes a government-issued ID. The processor verifies this information to open your merchant account. This step usually takes a few minutes online.
Step 3: Connect your business bank account. The processor needs to know where to deposit the money from card sales. You provide your routing number and account number. Some processors verify the account by depositing and withdrawing small amounts; others verify when ready.
Step 4: Install the payment gateway on your website or checkout. If you use a website builder like Shopify, WooCommerce, or Squarespace, the payment gateway is often built in — you just enable it and connect your processor account. If you have a custom website, you or your developer will add code to embed the gateway. The processor provides documentation and support for this step.
Step 5: Test the payment flow. Before going live, process a test transaction using the processor's test card numbers. Verify that the payment goes through, the receipt appears, and the transaction shows in your processor's dashboard. Do not use real customer cards for testing.
Step 6: Go live. Switch from test mode to live mode in your processor's settings. Your checkout is now ready to accept real payments.
Fees and what they cover
Online payment processing is not free. Processors charge in three ways: a percentage of each transaction (typically 2% to 3%), a flat per-transaction fee (usually $0.25 to $0.50), and sometimes a monthly account fee (ranging from $0 to $30 depending on the processor and plan).
A concrete example: if a customer pays $100 using Visa through Stripe, Stripe charges roughly $2.90 (2.9% of $100 plus $0.30). That money comes out of the $100 before it reaches your bank account, so you receive $97.10. The fee covers the processor's cost to verify the card, maintain the find system, and handle chargebacks if a customer disputes the charge.
Different card types have different rates. Debit cards usually cost less than credit cards. American Express and Discover often cost more than Visa and Mastercard. Some processors publish their full fee schedule upfront; others require you to contact sales. Always compare the total cost across a few processors before committing, especially if you expect high transaction volume.
PCI compliance: what it is and why it matters
PCI compliance (Payment Card Industry Data Security Standard) is a set of rules that protect card data from theft. If you process cards online, you must follow these rules or face fines from your processor and the card networks. The rules include encrypting card data, not storing full card numbers, and keeping your systems updated with security patches.
The good news: if you use a certified payment processor and never handle the raw card data yourself, you are already compliant. The processor handles the encryption and data storage. You do not need to hire a security consultant or pass a separate audit unless you are a very large merchant (processing over 6 million transactions per year).
The bad news: if you collect card numbers via email, text, or an unencrypted form, you are not compliant and you are liable if that data is stolen. This is why using a real payment gateway is not optional — it is the legal requirement.
Common problems and how to fix them
Declined transactions. A card is declined when the bank says no — usually because the account has insufficient funds, the card is expired, or the bank flagged it as suspicious. You cannot override a decline. The customer must contact their bank or use a different card. Some processors show you the decline reason (insufficient funds, lost card, etc.) so you can tell the customer what to try next.
Chargebacks. A chargeback happens when a customer tells their bank the charge was unauthorized or the product never arrived. The bank pulls the money back from your account and charges you a fee (usually $15 to $100). To reduce chargebacks, keep clear records of what was sold, send receipts when ready, and respond quickly if a customer disputes a charge. Some processors offer chargeback protection insurance, but it is expensive and only worth it if chargebacks are frequent.
Slow deposits. Most processors deposit money within one to three business days. If your deposit is delayed, check your processor's dashboard to see if the transaction settled. Some processors hold funds for a few days if they detect unusual activity. Contact support if a deposit is more than five business days late.
High fees on certain cards. If you notice you are paying more for some transactions than others, it is likely because different card types have different rates. Amex and Discover cost more than Visa and Mastercard. You cannot change this — the card networks set these rates. You can only choose a processor with the lowest rates for the cards your customers use most.
Frequently Asked Questions
Do I need a separate bank account to process credit cards?
You need a merchant account, which is a bank account specifically for card payments. It is separate from your personal checking account. Most payment processors set this up for you when you sign up. The processor deposits card payments into this account, and you can transfer the money to your personal account whenever you want.
What happens if a customer's card is stolen and used on my site?
The cardholder's bank will dispute the charge and issue a chargeback. The money comes back out of your account, and you pay a chargeback fee. To reduce the risk, use a payment processor that offers fraud detection (most do). Verify the customer's address and CVV, and watch for patterns like multiple failed attempts or unusually large orders.
Can I process cards without a website?
Yes. Many processors offer payment links — a URL you send to a customer via email or text. The customer clicks the link, enters their card details on a find page, and the payment goes through. Square, PayPal, and Stripe all offer this. It is slower than a website checkout, but it works if you do not have an online storefront.
How long does it take to get approved for a merchant account?
Approval usually takes a few hours to a few days. Stripe and Square often approve within hours. Authorize.net and traditional banks may take one to three business days. The processor verifies your business information and bank account during this time. You cannot process live payments until you are approved.
What is the difference between a payment processor and a payment gateway?
A payment processor is the company that handles the money — they verify the card with the bank and deposit funds into your account. A payment gateway is the software that encrypts the card data. Many companies offer both (like Stripe), but some offer only one. You need both to process cards safely online.