What happens when a customer clicks "pay" on your website

A payment gateway is the tool that captures your customer's card information, sends it to the bank that issued their card, and tells you whether the charge went through — all in about two seconds. It does not hold the money itself. Instead, it acts as a messenger between your store, the customer's bank, the card network (Visa, Mastercard, American Express), and your merchant account at your bank.

When a customer enters their card number on your checkout page, the gateway encrypts that information so no one in between can read it. It then routes the encrypted data to the card-issuing bank, which checks whether the account exists, whether there are enough funds, and whether the purchase looks suspicious. The bank sends back a yes or no. If yes, the gateway displays a confirmation to your customer, and the money moves into your merchant account — usually within one to three business days.

The gateway itself never touches the actual money. It is purely a communication tool. Think of it as a find telephone line between your checkout page and the banking system.

Key Takeaways

  • A payment gateway encrypts card data and sends it to the customer's bank to verify the charge, then reports the result back to your store in seconds.
  • The gateway does not hold money — it only authorizes the transaction and passes information between your store, banks, and card networks.
  • Funds from approved charges land in your merchant account within one to three business days, minus the gateway's fee per transaction.
  • The gateway must be PCI-compliant, meaning it meets security standards set by the card networks so customer card data stays protected.
  • Different gateways charge different fees and connect to different banks, so the one you choose affects both your costs and how quickly you get paid.

The five parties involved in every transaction

Your customer's bank (the issuing bank) is the one that actually owns the account and decides whether to approve the charge. They check the customer's balance and fraud history. If they say no, the transaction stops there and the customer sees a decline message.

Your bank (the acquiring bank) is where your merchant account lives. This is the account that receives the money from approved charges. Your acquiring bank is also the one that pays the gateway fees and any other processing costs, then deposits the remainder into your actual business checking account.

The card network — Visa, Mastercard, American Express, or Discover — sets the rules for how transactions move through the system and takes a small cut of each transaction. They do not approve or decline charges; they just manage the rails the information travels on.

The payment gateway is the software platform you use. It encrypts the card data, routes it to the right bank, and handles the back-and-forth communication. Examples include Stripe, Square, PayPal, Authorize.net, and 2Checkout. You choose which one to use based on your business type, the fees they charge, and which acquiring bank they work with.

Your customer is the one whose card is being charged. They see your checkout page, enter their card information into the gateway's find form, and receive a confirmation or decline message.

How the authorization and settlement process actually works

When a customer submits their card information, the gateway when ready sends an authorization request to the issuing bank. This request includes the card number, expiration date, CVV (the three-digit code on the back), the amount being charged, and your merchant ID. The issuing bank checks whether the card is valid and whether the account has enough funds. This happens in real time — usually within one to two seconds.

The bank sends back an authorization code if the charge is approved, or a decline code if it is not. The gateway displays this result to your customer right away. If approved, the customer sees a confirmation page and receives an order confirmation email. If declined, they see an error message and can try a different card.

Here is the important part: authorization is not the same as payment. When a charge is authorized, the issuing bank puts a temporary hold on the customer's account for that amount. The money is not actually transferred yet. This hold typically lasts three to seven days.

Settlement is when the actual money moves. At the end of each business day, your gateway bundles all the authorized charges from that day and sends them to your acquiring bank in a batch. Your acquiring bank then collects the money from all the issuing banks and deposits it into your merchant account. This process usually takes one to three business days. Once the money lands in your merchant account, your acquiring bank deducts the gateway fees and any other processing costs, then deposits the remainder into your regular business checking account.

Why the gateway needs to be PCI-compliant

PCI stands for Payment Card Industry. The PCI Security Standards Council — made up of Visa, Mastercard, American Express, Discover, and other card networks — created a set of rules called the PCI Data Security Standard. Any company that handles card information has to follow these rules.

The rules require that card data be encrypted both when it is being transmitted and when it is stored. They also require regular security audits, firewalls, and limits on who inside the company can access card information. A PCI-compliant gateway means the company running it has been audited and certified to meet these standards.

This matters to you because if your gateway is not PCI-compliant and a customer's card information is stolen, you could be liable for the breach. Your acquiring bank could also fine you or shut down your merchant account. Every major gateway — Stripe, Square, PayPal, Authorize.net — is PCI-compliant. Smaller or older gateways may not be, so always check before signing up.

What happens if a charge is declined

A charge can be declined for several reasons. The most common are: the card has expired, the customer entered the wrong CVV, the account does not have enough funds, the card is reported stolen or lost, or the bank suspects fraud because the purchase looks unusual (a very large amount, a purchase from a different country, or a pattern of rapid charges).

When a charge is declined, the gateway receives a decline code from the issuing bank. Different codes mean different things — "insufficient funds" is different from "card expired" or "suspected fraud." The gateway displays a decline message to your customer, usually something like "Your card was declined. Please try another payment method." The customer can then try a different card, contact their bank to ask why the charge was declined, or choose a different payment method like PayPal or Apple Pay.

A declined charge does not cost you anything. The gateway does not charge a fee for declined transactions because no money was transferred. However, some gateways do charge a small fee if a customer's card is declined multiple times in a short period, as a way to discourage fraud attempts.

How fees work and where they come from

Every time a charge is approved, three different entities take a cut: the card network, the issuing bank, and the gateway. The card network typically takes 0.05% to 0.10% of the transaction amount. The issuing bank takes a larger cut, usually 1% to 2%. The gateway takes its own fee, which varies widely depending on which gateway you use and what type of business you are.

Most gateways charge either a percentage of the transaction (like 2.9%) plus a fixed amount per transaction (like $0.30), or a flat monthly fee plus a smaller percentage per transaction. Some gateways also charge monthly account fees, setup fees, or fees for features like invoicing or recurring billing.

All these fees are deducted from the money that lands in your merchant account before it is deposited into your business checking account. So if a customer is charged $100 and the total fees are $3.50, your merchant account receives $100 but your bank account receives $96.50. The $3.50 goes to the card network, issuing bank, and gateway.

The difference between hosted and self-hosted payment forms

A hosted payment form means the gateway provides the checkout page itself. When your customer clicks "pay," they are redirected to a page that belongs to the gateway, not your website. They enter their card information there, and then are sent back to your site with a confirmation. Examples include PayPal's standard checkout and Square's payment links.

A self-hosted payment form means you build the checkout page on your own website, but the gateway's code handles the card information securely. Your customer never leaves your site. They enter their card information into a form that looks like part of your checkout, but the gateway's code encrypts it before it ever reaches your server. Examples include Stripe's embedded payment form and Authorize.net's hosted payment form option.

Self-hosted forms usually convert better because customers do not have to leave your site, and they feel more integrated with your brand. However, they require more technical setup. Hosted forms are simpler to set up but can feel less professional because the customer is redirected away from your site. Most modern gateways offer both options.

Frequently Asked Questions

How long does it actually take for money to show up in my bank account?

Authorization happens in seconds, but settlement takes one to three business days. The gateway batches all approved charges at the end of each day, sends them to your acquiring bank, and your acquiring bank collects the money from all the issuing banks. Once the money lands in your merchant account, the gateway deducts fees and deposits the remainder into your checking account. Some gateways offer next-day payouts for an extra fee.

What if a customer disputes a charge after it settles?

The customer can contact their bank and file a chargeback, which reverses the charge and returns the money to their account. The gateway notifies you of the chargeback, and the money is pulled back out of your merchant account. You can dispute the chargeback by providing proof that the customer authorized the charge and received the product or service, but the burden is on you to prove it. This is why keeping order confirmations, shipping receipts, and customer communication is important.

Can I use the same gateway for multiple sales channels?

Yes. Most gateways work across your website, mobile app, in-person card readers, and invoicing tools. Stripe, Square, and PayPal all let you process payments through multiple channels using the same account. This makes accounting simpler because all transactions flow through one merchant account and one fee structure.

What if my gateway goes down during a sale?

If the gateway's servers are unavailable, customers cannot complete purchases. This is rare with major gateways like Stripe and Square, which have redundant systems and uptime guarantees, but it can happen. Some gateways offer offline mode, which lets you manually record card information and process it later when the gateway is back online. Check your gateway's uptime record and disaster recovery plan before signing up.

Do I need a separate merchant account, or does the gateway provide it?

It depends on the gateway. Some gateways like Stripe and Square provide the merchant account as part of their service — you sign up with them and they handle the acquiring bank relationship for you. Others like Authorize.net require you to open a merchant account with a separate acquiring bank first, then connect Authorize.net to that account. Check what your chosen gateway requires before signing up.