What happens when you click "pay now" on a website

An e-commerce payment gateway is the system that captures your payment information when you buy something online, encrypts it, and sends it to the bank or card network that will actually move the money. It sits between the customer, the merchant's website, and the financial institutions on both sides. When you enter your card number on a checkout page, the gateway is what receives that data before it ever touches the merchant's own servers.

The gateway does not hold the money or decide whether the transaction succeeds. It is a messenger and a security checkpoint. It takes your card details, verifies the format is correct, checks that the card has not been reported stolen, and forwards the request to the card network (Visa, Mastercard, American Express) or directly to your bank. The bank says yes or no within seconds. The gateway receives that answer and tells the website whether to show you a confirmation page or an error message.

This entire process usually takes two to five seconds from the moment you click submit. The merchant never sees your full card number—the gateway handles that encryption and passes only a token or reference number to the merchant's system for record-keeping.

Key Takeaways

  • A payment gateway encrypts your card information and routes it to your bank or card network, keeping the merchant from ever handling your full card number.
  • The gateway checks whether your card is valid and whether you have sufficient funds, then returns an approval or decline within seconds.
  • Different gateways charge different fees—usually a percentage of the transaction plus a flat per-transaction fee—and support different payment methods.
  • Gateways like Stripe, Square, and PayPal are hosted solutions that handle security compliance for you; others like Authorize.Net require more merchant setup.
  • The gateway is separate from the merchant account, which is the bank account where the merchant's money actually lands after the transaction clears.

The three types of gateways and how they differ

Hosted gateways redirect you away from the merchant's website to a find payment page run by the gateway company itself. When you buy from a small business using PayPal or Square, you are usually on a hosted gateway. The merchant never touches your card data at all—you enter it on PayPal's or Square's page, and the gateway sends the merchant a confirmation. This is the simplest setup for small merchants because the gateway company handles all the security compliance and fraud detection.

Self-hosted gateways keep you on the merchant's website the entire time, but the merchant's server never stores your card information. Stripe and Authorize.Net work this way. Your browser sends your card data directly to the gateway's encrypted servers, bypassing the merchant's server entirely. The merchant's website shows the payment form, but the data goes straight to the gateway. This feels seamless to the customer but requires the merchant to maintain higher security standards and pass regular compliance audits.

API gateways are for merchants who build custom checkout experiences. Instead of using a pre-built form, the merchant's developers write code that communicates directly with the gateway's system. This is how large retailers and subscription services work—they control exactly what the checkout looks like, but they are responsible for handling sensitive data securely. API gateways require technical informed and ongoing security maintenance.

What the gateway checks before approving a payment

When you submit your card, the gateway performs several checks in rapid sequence. First, it validates the card number itself using a mathematical formula called the Luhn algorithm—this catches typos and obviously fake numbers before the request ever reaches your bank. Next, it checks the card's expiration date and the three-digit security code on the back.

Then the gateway sends the transaction to your card network and your bank. Your bank checks whether the card is active, whether you have sufficient available credit or funds, and whether the transaction matches your typical spending patterns. If you usually buy from local stores and suddenly a charge appears from another country, your bank might decline it as fraud protection. The bank returns an approval code or a specific decline reason—"insufficient funds," "card expired," "suspected fraud"—within seconds.

Some gateways also run Address Verification Service (AVS), which checks whether the billing address you entered matches the address your bank has on file. Others check the security code against the card issuer's records. These extra checks reduce fraud but can also decline legitimate transactions, so merchants choose which checks to require based on their risk tolerance.

How fees work and what you are actually paying for

E-commerce gateways charge in three ways. The most common is a percentage-plus-fixed fee: typically 2.2% to 3.5% of the transaction amount plus $0.30 per transaction. So a $100 purchase might cost the merchant $2.50 to $3.80 in gateway fees alone. Some gateways charge a flat monthly fee instead of per-transaction fees, which makes sense if you process high volume. A few charge a tiered rate—lower percentage for larger transactions.

What you are paying for is the gateway's infrastructure, the security compliance (PCI DSS certification), fraud detection, and customer support. Hosted gateways like PayPal tend to charge higher percentages because they handle more of the security burden. Self-hosted gateways like Stripe charge lower percentages because the merchant takes on more responsibility. API gateways vary widely depending on transaction volume and the merchant's negotiating power.

The gateway fee is separate from the interchange fee, which is what your bank charges the merchant's bank for processing the card transaction. Interchange is set by Visa and Mastercard and varies by card type and transaction category. The merchant's bank collects both the interchange and the gateway fee, then passes the gateway fee to the gateway company.

Settlement: when the merchant actually receives the money

Approval does not mean the money has moved. When the gateway approves your transaction, it has only confirmed that your bank said yes. The actual transfer of funds happens later, in a process called settlement. Most gateways batch transactions once per day—usually overnight—and send them to the card networks and banks for final clearing.

Settlement typically takes one to three business days. On day one, the merchant's bank receives the batch of approved transactions. On day two or three, the funds appear in the merchant's account. During this window, the transaction is approved but not yet settled. If a customer disputes the charge or the merchant discovers a duplicate, there is still time to cancel it before the money moves.

Some gateways offer faster settlement—same-day or next-day deposits—but charge higher fees for it. Others hold funds for longer (up to seven days) as a fraud buffer, especially for high-risk merchants or new accounts. The settlement timeline is in the merchant's agreement with their bank and gateway, not something the customer controls.

Security: what the gateway does to protect your card information

The gateway encrypts your card data using TLS (Transport Layer Security), the same encryption standard that protects your bank's website. Your card number is converted into an unreadable string of characters the moment it leaves your browser. Even if someone intercepts the transmission, they see only encrypted gibberish.

Gateways also tokenize your card information. Instead of storing your actual card number, the gateway generates a unique token—a random string of characters—that represents your card. The merchant stores the token, not the card number. If the merchant's database is hacked, the attacker gets tokens that are useless without the gateway's decryption key, which is stored separately on the gateway's find servers.

All legitimate gateways maintain PCI DSS (Payment Card Industry Data Security Standard) certification, which means they undergo annual security audits and follow strict rules about data storage, access, and encryption. If a gateway loses its PCI certification, it can no longer legally process card payments. This is why using a reputable, established gateway matters—you are relying on their security infrastructure and their liability insurance if something goes wrong.

Choosing a gateway: what actually matters

The right gateway depends on your business size, technical skill, and payment methods. If you are a solo seller or small shop, a hosted gateway like PayPal or Square is usually the fastest start—you sign up, add a button to your website, and you are done. You pay higher fees, but you have almost no setup work and the gateway handles all compliance.

If you process thousands of transactions per month, a self-hosted gateway like Stripe or Authorize.Net makes sense. The lower per-transaction fees add up to real savings at scale, and you get more control over the customer experience. You will need a developer to integrate it, but the setup is still straightforward.

If you sell internationally, check which gateways support the countries and currencies you need. If you sell subscriptions, make sure the gateway handles recurring billing. If you sell high-value items, look for gateways with strong fraud detection. The cheapest gateway is not always the best one if it does not support your actual business model.

Frequently Asked Questions

Does the gateway hold my money after a transaction?

No. The gateway routes the transaction to your bank and the customer's bank, then steps out of the way. Your bank holds the money during the settlement period (usually one to three days) before depositing it into your merchant account. The gateway never touches the actual funds.

Can a customer's bank decline a transaction even if the gateway approved it?

Yes, though it is rare. The gateway checks with the customer's bank in real time, and the bank's approval is final at that moment. However, if the customer disputes the charge later or if the bank detects fraud after settlement, the bank can reverse the transaction and pull the money back from the merchant's account.

What happens if the gateway goes down during checkout?

If the gateway is unavailable, the checkout page will not load or will show an error. The customer cannot complete the purchase. This is why merchants choose gateways with high uptime guarantees (usually 99.9% or better) and have a backup plan for outages. Some merchants keep a second gateway configured as a fallback.

Why do some transactions take longer to approve than others?

Most approvals happen in seconds, but some cards trigger additional fraud checks—especially if the purchase is large, from an unusual location, or from a new customer. The customer's bank may require extra verification, which can add a few seconds to a few minutes. Occasionally a bank is slow to respond, which can delay approval.

Is my information safer with a gateway than with a merchant who stores my card?

Yes. A legitimate gateway never stores your full card number and encrypts everything in transit. A merchant who stores your card number is responsible for maintaining PCI compliance and is a much larger target for hackers. Using a gateway means your card data is protected by the gateway's security infrastructure, not the merchant's.