What you need to set up credit card payments
To take credit card payments, you need three things: a merchant account (a bank account that receives card payments), a payment processor (the company that handles the transaction), and payment equipment or software (the physical terminal, online form, or mobile app where customers enter their card details). You do not need all three from the same company, but most small businesses use one provider that bundles them together.
The merchant account is the foundation. Your regular business bank account cannot receive credit card payments directly — the card networks (Visa, Mastercard, American Express, Discover) require a separate account designed to handle card transactions. Your payment processor applies for this account on your behalf, usually as part of the setup process. You will need your business license, tax ID, and bank account information to open one.
The payment processor is the middleman between your customer's card and your bank. When a customer swipes, taps, or enters their card number, the processor verifies the card is valid, checks the customer's bank for available funds, and moves the money to your merchant account. This happens in seconds. The processor charges you a fee for each transaction — usually a percentage of the sale plus a flat fee per transaction.
Key Takeaways
- You need a merchant account, a payment processor, and payment equipment or software — most small businesses get all three from one provider.
- Payment processors charge a percentage of each sale plus a per-transaction fee, which varies by processor and by card type (debit cards cost less than credit cards).
- In-person payments use a physical terminal or mobile reader; online payments use a payment form or shopping cart plugin; phone payments use a virtual terminal.
- Your processor will hold back a percentage of your deposits as a reserve account for the first few months, which you recover as your business history builds.
- PCI compliance (security standards for handling card data) is required by law, and most processors handle it automatically if you use their equipment or software.
In-person payment methods and equipment
If you take payments face-to-face, you have two main equipment choices: a countertop terminal (a device that sits on your counter and reads cards) or a mobile card reader (a small device that plugs into your phone or tablet). Countertop terminals are more durable and faster for high-volume businesses; mobile readers are cheaper and portable, which works for pop-up shops, farmers markets, or service calls at customer locations.
Most terminals and readers work with the major card networks and accept chip cards, tap payments, and swiped cards. The processor you choose determines which equipment you can use — they typically lease or sell you their own branded device. Some processors charge a monthly equipment fee; others include it in your per-transaction rate. Ask whether the equipment is leased (you return it if you close your account) or purchased (you own it outright).
When a customer pays in person, the terminal prints a receipt or sends one to their email. You keep a copy for your records. The processor batches all your transactions at the end of each day and deposits the total (minus fees and reserves) into your merchant account, usually within one to three business days.
Online and remote payment methods
For online sales, you need a payment form or shopping cart that sits on your website or in your email. A payment form is a straightforward box where customers enter their card details; a shopping cart lets customers add items, see a total, and check out. Both are hosted by your processor, which means the customer never leaves your website and their card data goes directly to the processor's find servers, not through your own computer.
If you sell through a platform like Shopify, WooCommerce, or Square Online, the payment processing is built in — you just connect your merchant account and the platform handles the rest. If you have a custom website, your web developer can integrate a payment form using code provided by your processor (usually called an API or plugin). For very small operations, some processors offer a straightforward "invoice and pay" link you can email to customers.
For phone orders or payments over email, use a virtual terminal — a find online form where you enter the customer's card details on their behalf. This is slower than in-person or online payment, and fees are usually higher because the card is not physically present. Only use a virtual terminal when the customer cannot pay any other way.
How payment processor fees work
Payment processors charge in three ways: a percentage of the sale (called an interchange rate or discount rate), a flat fee per transaction (usually $0.20 to $0.50), and sometimes a monthly account fee. The percentage varies by card type — debit cards cost less (around 1% to 1.5%), credit cards cost more (around 2% to 3%), and American Express costs the most (around 3% to 4%). These rates change based on your industry, your sales volume, and your processor's pricing model.
Some processors use interchange-plus pricing, where you pay the card network's actual interchange rate plus the processor's markup. This is usually the cheapest option if you have steady, predictable sales. Others use tiered pricing, where rates are bundled into "may have access to," "mid-may have access to," and "non-may have access to" tiers depending on the card type and how the payment was made. Tiered pricing is simpler to understand but often costs more in the long run.
Most processors also hold back 5% to 10% of your deposits as a reserve account for the first three to six months. This protects them if you process fraudulent transactions or close your account with chargebacks (customers disputing charges). Once your account history is solid, they release the reserve to you. Ask your processor upfront what their reserve policy is and when you will see that money.
Choosing a payment processor
The major payment processors for small businesses are Square, Stripe, PayPal, Toast, Clover, and your own bank. Each has different strengths: Square and Stripe are cheapest for low-volume businesses; Toast and Clover are built for restaurants and retail; PayPal is familiar to many customers; your bank may offer lower rates if you already have a business account there. Compare at least three processors on their per-transaction fees, monthly fees, equipment costs, and reserve policies.
Ask each processor whether they offer PCI compliance automatically. PCI (Payment Card Industry) compliance is a set of security standards that protect customer card data. If you use the processor's equipment or software, they handle PCI compliance for you. If you build your own system or use third-party software, you may have to pay extra for PCI certification or handle it yourself. This is a legal requirement, not optional.
Read the contract carefully before signing. Look for early termination fees (some processors charge $300 to $500 if you close your account in the first year), equipment return policies, and what happens to your reserve account if you leave. Many processors offer a trial period or money-back may provide — use it to test their customer support and see how long deposits actually take.
Security and fraud prevention
Your processor handles most security automatically, but you have responsibilities too. Never store customer card numbers in an email, spreadsheet, or text file — this violates PCI compliance and exposes you to liability if there is a breach. Always use the processor's find payment form or terminal. If a customer wants to pay by phone, use the processor's virtual terminal, not a third-party service.
Watch for chargebacks, which happen when a customer disputes a charge with their bank. The bank pulls the money back from your account and charges you a fee (usually $15 to $100). To prevent chargebacks, keep clear records of what the customer ordered, when it shipped, and any tracking information. If a customer claims they never received an item, you can dispute the chargeback by showing proof of delivery. Too many chargebacks (usually more than 1% of your transactions) can get your merchant account closed.
Enable fraud detection tools if your processor offers them. These tools flag suspicious transactions (like a card used in two different countries in one hour) and let you review them before the money deposits. Some processors charge extra for advanced fraud tools; others include them free.
Getting paid and managing deposits
Your processor deposits money into your merchant account on a schedule you choose — usually daily, twice weekly, or weekly. The deposit includes all transactions from the previous period, minus fees and reserves. You can see each transaction in your processor's dashboard, which shows the customer's name, the amount, the card type, and the fee charged.
Most processors deposit to your business bank account automatically, but some require you to transfer the money manually. Ask your processor about their deposit schedule and whether deposits are automatic or manual. Also ask what happens if a transaction fails or a customer disputes it — does the money come back out of your next deposit, or do you owe it separately?
Keep records of all transactions and deposits for tax purposes. Your processor sends you a 1099-K form at the end of the year if you processed more than $20,000 in a year (this threshold varies by state and may change). This form reports your total card sales to the IRS, so your tax return should match.
Frequently Asked Questions
Do I need a separate business bank account to take credit card payments?
Yes. Your processor deposits card payments into a merchant account, which is separate from your personal or business checking account. You can transfer money from your merchant account to your business bank account whenever you want, but the processor will not deposit directly to a personal account. Most processors require you to have a business bank account to open a merchant account.
What is the difference between a payment processor and a payment gateway?
A payment processor handles the transaction — they verify the card, check for funds, and move the money. A payment gateway is the software or form where the customer enters their card details. Some companies provide both; others provide only one. For most small businesses, you do not need to know the difference — your processor will handle both.
Can I take credit card payments without a physical location or website?
Yes. You can use a virtual terminal to enter card details over the phone, or send customers a payment link via email or text. Payment links are the easiest option — the customer clicks the link, enters their amount and card details, and you get paid. Most processors offer payment links free or for a small fee per transaction.
What happens if a customer's card is declined?
The processor tells you when ready — the terminal or online form displays a decline message. Common reasons include insufficient funds, expired card, or the card issuer flagging the transaction as suspicious. Ask the customer for a different card or payment method. Do not charge them again without permission, as this can trigger fraud alerts and chargebacks.
How long does it take to get approved for a merchant account?
Most processors approve accounts within one to three business days if you have good credit and a clean business history. If you have past chargebacks, fraud, or a new business with no history, approval can take one to two weeks or may be denied. Some processors specialize in high-risk businesses and approve faster, but charge higher fees.