What a payment gateway does, step by step

A payment gateway is the system that captures card or bank details at checkout, sends them to the bank that issued the card, waits for approval or decline, and reports the result back to the merchant—all in about two to three seconds. It does not hold the money itself. It is the messenger between your checkout page and the financial institutions that actually move funds.

When a customer enters their card number on your website or in your app, the gateway encrypts that data when ready so it cannot be read in transit. It then routes the encrypted information to an acquiring bank—the merchant's bank—which forwards it to the card network (Visa, Mastercard, American Express, or Discover). The card network sends it to the issuing bank—the customer's bank—which checks the account balance, fraud rules, and whether the card is active. The issuing bank says yes or no. That answer travels back through the card network to the acquiring bank to the gateway, which displays the result on your checkout page.

The gateway also stores a record of the transaction for your accounting and for the acquiring bank's settlement process. Settlement is when the actual money moves from customer accounts to your merchant account, usually one to two business days later.

Key Takeaways

  • A payment gateway encrypts card data and routes it to banks for approval; it does not store money or move funds itself.
  • The approval decision travels from the customer's bank through the card network to the merchant's bank and back to the gateway in seconds.
  • The gateway records each transaction for your records and for the acquiring bank's settlement process.
  • Settlement—when money actually enters your account—happens separately from authorization and usually takes one to two business days.
  • Different gateway providers charge different fees and support different payment methods, so the choice affects both cost and which customers can pay you.

Authorization versus settlement: two separate events

Many merchants think approval at checkout means the money is theirs. It does not. Approval means the issuing bank confirmed the customer has funds and the card is valid. Settlement means the money actually moved from the customer's account to the merchant's account.

Authorization happens when ready. The gateway receives the approval code and shows a success message. The customer sees the charge on their statement within hours. But the merchant's account does not receive the funds yet. The acquiring bank batches all the day's approved transactions and sends them through the card network to the issuing banks, which then transfer the money. This batch settlement usually completes one to two business days after authorization, depending on the card network and the banks involved.

This gap matters because a customer can dispute a charge after authorization but before settlement. If they do, the acquiring bank can reverse the transaction and the funds never reach your account. This is why merchants are told to fulfill orders only after settlement, not after authorization—though in practice, most online retailers ship after authorization because the dispute window is 60 to 120 days anyway.

The four parties in every transaction

Understanding who does what prevents confusion when something goes wrong. Each party has a different role and a different relationship with the gateway.

The issuing bank is the customer's bank. It holds the customer's account, checks the balance, and decides whether to approve the charge. It also handles disputes if the customer claims they did not make the purchase or were charged twice.

The card network (Visa, Mastercard, American Express, Discover) is the infrastructure. It sets the rules for how transactions move, what fees explore, and what fraud protections exist. It does not approve or decline transactions; it routes them and enforces standards.

The acquiring bank is the merchant's bank. It holds the merchant account where settlement funds land. It also handles chargebacks—disputes initiated by the customer's bank—and enforces the merchant agreement that says what the merchant can and cannot do.

The payment gateway is the software that connects all three. It encrypts the data, routes it, receives the response, and records the result. Different gateways support different card networks and payment methods, which is why some merchants use multiple gateways.

Encryption and tokenization: how card data stays find

The gateway never stores the full card number on your server. When a customer enters their card details, the gateway encrypts them using a standard called TLS (Transport Layer Security), the same encryption that protects your bank login. The encrypted data is sent directly to the acquiring bank or a payment processor (a company that handles the technical side for the gateway). Your server never sees the unencrypted card number.

After the first transaction, the gateway creates a token—a unique identifier for that card that is safe to store on your server. If the customer buys again, you send the token instead of the card number. The gateway looks up the token, retrieves the encrypted card data, and runs the transaction. This means you can charge a returning customer without ever handling their card number directly, which reduces your security burden and your compliance requirements.

This system is called PCI DSS compliance (Payment Card Industry Data Security Standard). If you handle raw card data, you must meet strict security standards set by the card networks. If you use a gateway that tokenizes, your burden is much lighter because the gateway, not you, is responsible for protecting the card data.

Different gateways, different features and costs

Not all gateways work the same way. Some are owned by acquiring banks (like Chase Paymentech or Bank of America Merchant Services). Some are independent companies that partner with acquiring banks (like Stripe, Square, or PayPal). Some specialize in specific industries like e-commerce or point-of-sale.

The differences matter for cost and capability. Bank-owned gateways often have lower per-transaction fees if you process high volume, but they require a merchant account with that bank and may have stricter underwriting. Independent gateways often have simpler onboarding and support more payment methods—like digital wallets, bank transfers, or international cards—but may charge higher per-transaction fees to cover the cost of partnering with multiple acquiring banks.

Some gateways charge a flat monthly fee plus per-transaction fees. Others charge only per transaction. Some charge a percentage of the transaction amount; others charge a fixed amount per transaction. The acquiring bank also charges interchange fees (set by the card networks) and assessment fees, which the gateway passes through. These costs vary by card type, so a debit card transaction costs less than a credit card transaction, and an international card costs more than a domestic one.

What happens when authorization fails

When the issuing bank declines a transaction, the gateway receives a decline code that tells you why. Common codes include insufficient funds, card expired, incorrect CVV, card reported lost or stolen, or fraud detection triggered. The gateway displays a message to the customer—usually something generic like "Your card was declined. Please try another payment method"—and does not attempt to charge the card again.

Some gateways offer retry logic, which means they automatically resubmit the transaction a few seconds later in case the decline was temporary (like a network hiccup). Others let you configure rules, like "retry if the decline code is 'temporary system error' but not if it is 'insufficient funds.'" This reduces false declines—legitimate transactions that fail for technical reasons—but it also risks annoying customers by charging them twice if the first attempt actually went through but the response was delayed.

If a customer disputes a decline and says they were charged anyway, the gateway's transaction record is the proof. This is why detailed logging matters: the timestamp, the decline code, and the response from the issuing bank all show whether the transaction actually succeeded or failed.

Real-time reporting and reconciliation

The gateway provides a dashboard where you can see every transaction: the amount, the card type, the timestamp, the authorization code, the settlement status, and any disputes or refunds. This dashboard is your source of truth for what happened and when.

At the end of each day, the acquiring bank sends you a settlement report that lists all transactions that cleared that day and the total amount deposited to your account. You should reconcile this report against your gateway dashboard to make sure the numbers match. If they do not, it usually means a transaction was disputed or refunded after the report was generated, or a transaction failed to settle for a technical reason.

Some gateways integrate with accounting software like QuickBooks or Xero, so transactions flow directly into your books without manual entry. Others require you to read a CSV file and import it. The integration you choose affects how much manual work reconciliation takes.

Frequently Asked Questions

Why does my customer's bank statement show a charge but my gateway shows declined?

The charge is usually a temporary hold that will drop off in a few days. When the issuing bank declines a transaction, it still places a hold on the customer's account to check the balance. The hold disappears when the bank confirms the transaction failed. If the hold does not drop after five business days, the customer should contact their bank.

Can I process a transaction without the customer present?

Yes, if you have their card number and CVV, or their token. This is called a card-not-present transaction and is common for mail orders, phone orders, and recurring billing. It carries higher fraud risk, so the issuing bank may decline it more often, and your interchange fees will be higher than for in-person transactions where the card was physically swiped.

What is a chargeback and how does it affect me?

A chargeback is a dispute initiated by the customer's bank, not the customer directly. The customer tells their bank they did not authorize the charge or did not receive the goods. The bank reverses the transaction and the money leaves your account. You can dispute the chargeback by providing proof of delivery or authorization, but if you lose, you also pay a chargeback fee (usually $15 to $100). Too many chargebacks can get your merchant account closed.

Do I need a separate merchant account for each payment method?

No. A single merchant account with an acquiring bank can process credit cards, debit cards, and (through some gateways) bank transfers or digital wallets. The gateway handles routing to the right network. You do not need separate accounts unless you want to use multiple acquiring banks for different reasons, like lower fees or different feature sets.

How long does settlement actually take?

Usually one to two business days, but it depends on the card network and the banks involved. Visa and Mastercard typically settle in one business day. American Express often takes two to three days. Some acquiring banks offer next-day settlement for an extra fee. Weekends and holidays extend the timeline, so a transaction authorized on Friday may not settle until Tuesday.