What Is a Payment Gateway? How It Works

‍A payment gateway is the technology that captures a customer's card details at checkout, encrypts them, and transmits them for authorization in real time. It sends the request toward the customer's bank and returns the answer in seconds. A separate processor holds your merchant agreement, moves the money, and takes your disputes, even though your gateway settings shape how often those disputes happen.

A gateway is the front end of the sale.

Most merchants buy both from one vendor and never see the seam. Because of that bundling, four different words end up describing the same checkout. Merchants then call the wrong company when a charge goes wrong.

Here's who does what:

• Payment gateway: Captures and encrypts the card details at checkout.
• Payment processor: Holds your merchant agreement and moves the money.
• Payment service provider: Sells gateway, processing, and often the merchant account as one package, like Stripe or Adyen.
• Payment terminal: The card reader on your counter, which is hardware that feeds a gateway.

When a charge goes wrong, call whoever holds your merchant agreement. Our payment gateway vs. payment processor entry covers the two that get mixed up most.

How a payment gateway processes a transaction

A gateway runs one sale through four steps in a few seconds.

Here's what happens between the click and the answer:

1. Capture: Your customer enters their card details at checkout.
2. Encrypt: The gateway scrambles that data so it can travel safely.
3. Transmit: The gateway sends the request toward the issuing bank.
4. Return: The approval or decline lands back on your checkout page.

In the middle of that, the gateway does translation work nobody sees. Your checkout speaks the language of the web, and the banks read something else. So the gateway rewrites the message into a format the card networks read.

It also runs any checks you've turned on, like address verification, before the request leaves.

All four steps run while your customer watches a spinner. A slow gateway shows up in your reports as abandoned carts.

A gateway that adds two seconds to step three costs you sales you never see reported as failures.

The funds land later in a batch, so an approved charge can still fail to pay out. Watch for it when a customer says they were charged and your dashboard shows nothing settled.

That gap is also where the customer's view and yours drift apart. They see a pending line on their statement the same day. You see the money two or three days later, which is why "you already took my money" reaches you before the payout does.

Types of payment gateways

Gateways are hosted, on-site with off-site payment, or fully integrated by API.

Where the card number gets typed decides your compliance load.

The three shapes trade PCI scope against checkout control:

Keep raw card numbers off your servers with hosted fields or a vault. Less of your business then falls inside a PCI DSS check, because the rules only cover systems that touch that data.

That clean scope costs you checkout control. A hosted page sends your customer to another domain right when they're deciding to buy, and some don't come back.

Most sellers land in the middle shape without choosing it. Your platform's built-in checkout keeps the payment form on your page and hands the card data straight to the gateway. The checkout looks like yours, and the card number never touches your server.

Go fully integrated when you need a checkout nobody else offers, and budget for the compliance work before you start.

Vendors slice this list differently, so you'll see counts of three, four, or five.

The split that matters stays the same across all of them. Whose page holds the card number?

Gateway features that change your chargeback exposure

3D Secure, your statement descriptor, address and code checks, and tokenization each change how likely a sale is to end in a chargeback.

Four things to check in your dashboard today:

1. Turn on 3D Secure for card-not-present orders: You'll find it under your gateway's authentication settings.
2. Set your statement descriptor to your domain or business name: Stripe caps it at 5 to 22 characters.
3. Require postal code and security code at checkout: Decline on a mismatch.
4. Use your gateway's hosted fields or vault: Raw card numbers then never reach your server.

3D Secure checks the cardholder is who they say at checkout.

Visa describes it as a protocol that shifts liability for those sales, so the fraud loss becomes the bank's.

A clear statement descriptor stops the dispute before anyone files it, and Stripe names it in its dispute-prevention guidance. A customer who recognizes the charge lets it stand.

Address and code checks screen the order before you've shipped. Tokenization swaps the card number for a stand-in, so a breach on your side never turns into fraud disputes.

An authenticated sale can still be charged back for a cancelled plan, an order that never arrived, or the wrong product. All four settings only cover fraud. Our reason code lookup tool covers what the rest need.

Among the alerts we see, only a small share had 3D Secure on.

How to choose a payment gateway

Take a bundled provider to be live in an afternoon, or your own merchant account plus a standalone gateway to be underwritten on your business alone.

The two routes differ on three things:

Which route you get depends on whether you pass underwriting. High-risk sellers usually end up on their own merchant account, after the bundled providers say no.

For most sellers the gateway arrives with the provider they picked. Buy one on its own when your current merchant account already clears your volume at a rate you'd have to re-underwrite to match.

On the bundled route, one company decides whether you keep processing. That's the trade you make for the fast setup, and it only shows up on the day they decide.

Once you're picking a named provider and not a route, our guide to the best Shopify payment gateways compares the ones merchants run.

Popularity is a weak tiebreaker here. Our Stripe statistics post shows how far the published share numbers drift apart.

Ask each provider what chargeback rate triggers review and how much notice they give before termination. That answer matters more to you than a tenth of a percent on your rate.

Refunding a customer before their bank files the chargeback costs you less. We offer chargeback alerts from every provider, so you hear about a dispute in time to do that.

FAQ

What is the most used payment gateway?

Each tracker names a different leader, because each counts a different type of software. Check whether a figure counts gateways, full payment service providers, or ecommerce plugins, since each ranking puts a different company first.

Do I need a payment gateway if I only sell in person?

Your card reader already has a gateway built in, so a counter sale is covered. You'll need an online gateway the day you start taking orders by web, phone, or invoice.

Can switching payment gateways affect my open chargebacks?

Your open disputes stay with the processor that handled the original sales, since they follow that agreement. Keep the old account open until every live case closes, or you'll lose your chance to respond.