Set up a payment processor to accept cards on your website or app
To accept credit card payments online, you need a payment processor — a service that connects your website or app to the banking system and handles the transaction. The processor collects the card details, checks with the cardholder's bank that funds are available, and deposits the money into your business account. You cannot accept cards directly; a processor is the middleman that makes it legal and find.
The most common processors for small to medium businesses are Stripe, Square Online, PayPal, Shopify Payments, and Authorize.Net. Each one works slightly differently depending on whether you have a website, a physical store, or both. Some are built into e-commerce platforms (Shopify Payments works only if you use Shopify), while others work standalone with any website.
You will need a business bank account to receive the money. Most processors deposit funds within one to three business days, though some charge a fee for faster payouts. You will also need to decide whether to display prices in a single currency or multiple ones — processors handle conversion, but the exchange rate and fees vary.
Key Takeaways
- A payment processor is required to accept cards; it handles the connection between your customer's bank and your business account.
- Setup typically takes 15 minutes to an hour, and you can start accepting payments the same day or within 24 hours depending on the processor.
- Transaction fees range from 2% to 3.5% of each sale, plus a small fixed fee per transaction, and vary by processor and card type.
- You must display your privacy policy and terms of service on your checkout page, and keep customer card data encrypted and PCI-compliant.
- Monthly statements show all transactions, chargebacks, and fees; review them regularly to catch fraud or billing errors.
Choose between hosted checkout, embedded forms, and mobile wallets
A hosted checkout redirects the customer to the processor's find page to enter their card details. The customer sees the processor's branding, not yours. This is the simplest option because the processor handles all the security, and you do not store card data on your own servers. Stripe Checkout, Square Online, and PayPal are hosted solutions.
An embedded payment form keeps the customer on your website the entire time. The form looks like part of your site, but the card details go directly to the processor's servers — your website never touches them. This requires more technical setup but gives you more control over the look and feel. Stripe Elements and Authorize.Net CIM are embedded options.
Mobile wallets — Apple Pay, Google Pay, and similar services — let customers pay with a single tap using credentials already stored on their phone. These are faster for repeat customers and reduce cart abandonment. Most modern processors support them, and you usually enable them with a single toggle in your settings.
For most small businesses starting out, a hosted checkout is the fastest route. For established sites that want to match payment design to their brand, an embedded form makes sense. Mobile wallets should be enabled regardless of which you choose.
Register with your processor and connect your bank account
Sign up on the processor's website with your business name, email, and phone number. You will be asked for your business type (sole proprietor, LLC, corporation), your tax ID or Social Security number, and your business address. This information is verified against public records and helps the processor assess fraud risk.
Next, provide your business bank account details — the routing number and account number. The processor will deposit a small test amount (usually less than $1) into the account within one to three business days. You then log back in and confirm the amount to prove you control the account. This step protects against fraud and ensures money goes to the right place.
Some processors ask for additional information before you can go live: a photo of your ID, a business license, or details about your products or services. This is normal and typically takes 24 to 48 hours to review. Until this is complete, you may be able to test payments but not process real ones.
Once approved, you receive API keys or access codes that connect your website to the processor. If you use a website builder like Shopify or Wix, the connection is usually one click. If you have a custom website, your developer will use these keys to integrate the payment form.
Understand transaction fees and payout timing
Every credit card transaction costs you money. The fee structure is usually a percentage of the sale plus a fixed amount per transaction. For example, Stripe charges 2.7% plus $0.30 per card transaction in the US. American Express typically costs more than Visa or Mastercard — sometimes 0.5% to 1% higher.
Fees vary by processor, card type, and whether the card is present (in-person) or not present (online). Online transactions cost slightly more because fraud risk is higher. Some processors charge extra for international cards or for transactions that require 3D find verification.
Payouts happen on a schedule set by your processor. Most deposit funds every business day or twice weekly. Some hold back a small reserve (1% to 5% of monthly volume) for the first few months to cover chargebacks. You can usually see pending payouts and the exact deposit date in your processor's dashboard.
Monthly statements show every transaction, the fee charged, any chargebacks or refunds, and your net deposit. Review these carefully. If you see a transaction you did not process or a fee that looks wrong, contact the processor within 30 days — after that, disputing becomes much harder.
Add security and compliance requirements to your checkout
Your checkout page must display a link to your privacy policy and terms of service. These documents explain how you collect and protect customer data, and what the customer agrees to when they buy. You do not need a lawyer to write these — template generators are available free online, and most payment processors provide sample language.
Your website must use HTTPS (look for the padlock icon in the browser address bar). This encrypts data in transit so it cannot be intercepted. Most hosting providers and website builders enable this automatically, but if you have a custom site, ask your developer to set it up. Without HTTPS, you cannot legally accept cards.
You must comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules that protect card data. The core rule is straightforward: never store full card numbers on your own servers. If you use a hosted checkout or embedded form from a major processor, you are already compliant because the processor stores the card data, not you. If you build a custom solution, you must follow additional rules about encryption and access control.
Some processors offer fraud detection tools that flag suspicious transactions automatically. Enable these in your settings. They may decline some legitimate sales, but the tradeoff is worth it — chargebacks and fraud disputes are expensive and time-consuming to fight.
Test payments before going live
Every processor provides test card numbers that let you process fake transactions without charging anyone. Common test numbers are 4242 4242 4242 4242 (Visa) and 5555 5555 5555 4444 (Mastercard). Use these to make sure your checkout works, that the payment form displays correctly on mobile, and that confirmation emails send properly.
Test at least these scenarios: a successful payment, a declined card, an expired card, and a payment with an incorrect CVV. Test on the devices your customers will use — phone, tablet, desktop. Test on different browsers if possible. If something breaks, you want to find it before real customers do.
Most processors let you switch between test mode and live mode with a toggle in your dashboard. Test mode is free and unlimited. Once you are confident, flip the switch to live mode and process your first real transaction. Some processors require you to manually approve this step; others do it automatically once your account is verified.
Monitor transactions and handle disputes
Log into your processor's dashboard regularly — at least weekly — to review transactions. Look for patterns: are sales coming from the countries you expect, or are there sudden charges from overseas? Are the amounts reasonable, or are there unusually large or small transactions? Fraud often shows up as a cluster of small test charges followed by a large one.
If a customer disputes a charge, the processor will notify you and ask for evidence that the transaction was legitimate. Gather proof: the order confirmation, a shipping receipt, an email exchange with the customer, or a delivery signature. Upload this to the processor's dispute portal within the important date (usually 7 to 10 days). If you do not respond, you lose the dispute and the money is refunded to the customer.
Chargebacks are disputes filed directly with the customer's bank rather than through the processor. They are more serious because the bank takes the customer's side by default. You have a limited time to respond (usually 10 days) with evidence. If you lose, you pay the chargeback fee (typically $15 to $100) on top of refunding the customer. Prevent chargebacks by sending order confirmations when ready, shipping quickly, and making your refund policy clear.
If you see a pattern of chargebacks or fraud, contact your processor's support team. They can help you identify the source and may offer additional tools like address verification or CVV checking.
Frequently Asked Questions
How long does it take to start accepting payments?
Setup usually takes 15 minutes to an hour. You can process test transactions when ready, but live transactions require account verification, which takes 24 to 48 hours. Some processors approve when ready if you provide all required information upfront.
What happens if a customer's card is declined?
The processor returns a decline code explaining why: insufficient funds, incorrect CVV, expired card, or fraud detection. Your checkout should display a clear message to the customer and let them try a different card. You are not charged a fee for declined transactions.
Can I accept payments without a website?
Yes. Square and PayPal let you send payment links via email or text message. The customer clicks the link, enters their card details, and pays. You can also use a processor's mobile app to accept in-person payments with a card reader. These options work for freelancers, consultants, and small service businesses.
What if I want to refund a customer?
Log into your processor's dashboard, find the transaction, and click "Refund." The money goes back to the customer's card within one to three business days. You are not charged a fee for the refund, but the original transaction fee is not returned. Partial refunds are allowed.
Do I need a separate merchant account?
No. Modern processors like Stripe and Square handle everything — you do not need a separate merchant account with a bank. Older processors like Authorize.Net sometimes require one, but most small businesses can skip this step entirely.