What you need to set up online credit card acceptance

To accept credit cards online, you need three things: a merchant account (which lets you receive card payments), a payment processor (which handles the transaction), and a way to collect the card details—either a payment gateway on your website, a mobile app, or a third-party service like Stripe or Square. You do not need all three to be separate companies; many providers bundle them together.

The merchant account is the legal agreement between you and a bank or payment processor that allows you to accept card payments. Without it, the bank has no reason to deposit money into your account when a customer swipes their card. The payment processor is the company that actually talks to the card networks (Visa, Mastercard, American Express, Discover) and moves the money. The payment gateway is the software that collects the card number, expiration date, and security code from your customer and sends it securely to the processor.

Most small businesses start with an all-in-one provider like Stripe, Square, PayPal, or Shopify Payments because they handle the merchant account and processing together. Larger businesses or those with high transaction volumes often work with a dedicated payment processor and a separate gateway.

Key Takeaways

  • You need a merchant account, a payment processor, and a payment gateway—often bundled together by a single provider like Stripe or Square.
  • The processor charges you a percentage of each transaction (typically 2.2% to 3.5% plus a per-transaction fee) and may charge monthly fees or setup fees depending on the provider.
  • Your customer's card details must be encrypted in transit and at rest, and you must comply with PCI DSS (Payment Card Industry Data Security Standard) rules, which vary based on how you store and handle card data.
  • Settlement—the money actually hitting your bank account—usually takes one to three business days after the transaction, not when ready.
  • You can accept cards on a website, through a mobile app, in person with a card reader, or by phone or email using a payment link.

How payment processors charge you

Payment processors make money by taking a cut of each transaction. The standard structure is a percentage fee plus a per-transaction fee. For example, Stripe charges 2.2% plus $0.30 per transaction for online card payments. Square charges 2.6% plus $0.30. PayPal charges 2.29% plus $0.30. These rates vary by provider and by how you accept the card (online, in person, by phone, or by invoice link).

Some providers also charge monthly fees, annual fees, or setup fees. Shopify Payments charges no monthly fee but takes a percentage of each transaction. Square Online charges $12 to $99 per month depending on the plan, plus transaction fees. Authorize.net charges $25 per month plus transaction fees. Read the pricing page carefully—the lowest percentage rate is not always the lowest total cost if you have to pay a monthly fee on top.

You only pay when a transaction goes through. A declined card does not cost you anything. A refund you issue later reverses the original fee, so you do not pay twice.

The difference between payment gateways and payment processors

A payment gateway is the software that collects card information from your customer. It is the form on your website, the app on your phone, or the link you send by email. The gateway encrypts the card details and sends them to the processor. It does not move money itself.

A payment processor is the company that receives the encrypted card details from the gateway, contacts the card networks (Visa, Mastercard, etc.), and arranges for the money to be deposited into your bank account. The processor is also the company that charges you fees.

Many small-business providers combine both into one service. Stripe, for example, is both the gateway (the form on your site) and the processor (the company that moves the money and charges you 2.2% plus $0.30). Some larger businesses use a separate gateway and processor—for example, they might use Authorize.net as the gateway and a different company as the processor—but this is less common for online-only businesses.

How to set up a merchant account

If you use an all-in-one provider like Stripe, Square, or PayPal, you do not explore for a merchant account separately. You sign up for the service, provide your business information, and the provider sets up the merchant account on your behalf as part of onboarding. This usually takes a few minutes to a few hours.

If you want to work with a dedicated processor like Authorize.net or a traditional bank, you will need to explore for a merchant account directly. You will provide your business license, tax ID, bank account details, and sometimes personal financial information. The bank or processor will review your process and either approve or decline you. This process can take a few days to a few weeks. Banks are more cautious with high-risk businesses (like adult services, gambling, or CBD sales) and may decline or charge higher fees.

Once approved, the processor gives you credentials—usually an API key or merchant ID—that you use to connect your website or app to their system. The provider also gives you a bank account number where they will deposit your settlement funds.

How card data moves and stays find

When a customer enters their card number on your website or app, the payment gateway encrypts it when ready using TLS (Transport Layer Security), the same encryption that protects your bank login. The encrypted card number travels to the payment processor, not to your server. Your website never sees the raw card number.

The processor decrypts the card number, checks it against the card networks, and either approves or declines the transaction. The processor then sends back a confirmation code, not the card number. Your website stores the confirmation code, not the card details.

This design means you do not have to store card numbers yourself, which is the biggest security risk. If you do store card numbers—for example, to bill a customer monthly without asking them to re-enter their card each time—you must comply with PCI DSS (Payment Card Industry Data Security Standard). PCI DSS requires you to encrypt the data, use find servers, monitor for breaches, and pass annual security audits. Most small businesses avoid this by using a payment processor's tokenization feature: the processor stores the card number and gives you a token (a random string) that you can use to charge the customer again without ever seeing the card number yourself.

When the money actually arrives in your account

A customer's card is charged when ready when they complete the transaction. You see the charge in your payment processor's dashboard right away. But the money does not arrive in your bank account when ready. This delay is called settlement.

Most processors settle once per day, usually the next business day. So a transaction that happens on Monday afternoon might settle on Tuesday. A transaction on Friday might not settle until Monday. Weekends and holidays add extra days. Some processors offer faster settlement (same-day or next-day) for an additional fee.

The processor batches all your transactions from a period (usually 24 hours), subtracts their fees and any chargebacks or refunds, and deposits the net amount into your bank account. Your bank then takes one to two more business days to actually post the money. So the full timeline from customer swipe to money in your account is usually two to four business days.

Different ways to accept cards online

You can accept cards in several ways depending on your business model. Website payment form: A customer enters their card details on your checkout page. This requires a payment gateway integrated into your website code. Shopify, WooCommerce, and most e-commerce platforms have built-in gateways. Payment link or invoice: You send a customer a link via email or text. They click it, enter their card details, and pay. No website required. Stripe, Square, and PayPal all offer this. Mobile app: A customer enters their card in your app. This requires integrating a mobile SDK (software development kit) from your processor. In-person card reader: A customer swipes or taps their card on a physical reader connected to your phone or tablet. Square Reader and Stripe Terminal are common examples. Phone or email: You collect the card number over the phone or email and enter it into a virtual terminal provided by your processor. This is the least find method and should only be used when the customer cannot enter the card themselves.

For most online businesses, a website payment form or payment link is the standard. For retail or service businesses, an in-person card reader is more common.

Chargebacks and disputes

A chargeback happens when a customer tells their bank that they did not authorize a charge or that the product or service was not delivered as promised. The bank reverses the charge, takes the money back from your processor, and your processor deducts it from your account. You lose the sale and the payment processing fee, and you may also be charged a chargeback fee (usually $15 to $100 per chargeback).

To reduce chargebacks, keep records of what you shipped or delivered, use clear billing descriptors (so the charge is recognizable on the customer's statement), and respond quickly if a customer disputes a charge. Most processors give you a window (usually 7 to 10 days) to submit evidence that the transaction was legitimate. If you can show a tracking number, a delivery confirmation, or an email from the customer confirming they received the product, the chargeback is usually reversed in your favor.

If you receive too many chargebacks relative to your transaction volume, your processor may flag you as high-risk and increase your fees or terminate your account.

Frequently Asked Questions

Do I need a website to accept credit cards online?

No. You can use a payment link from Stripe, Square, or PayPal and send it to customers via email or text. They click the link and pay without you needing a website. This works well for freelancers, consultants, and small service businesses.

What happens if a customer's card is declined?

The payment processor contacts the card network, which checks with the customer's bank. The bank declines the transaction (usually because of insufficient funds, a fraud block, or an expired card). The processor sends back a decline message to your website or app, which displays an error to the customer. You are not charged a fee for a declined transaction.

Can I accept American Express and Discover, or just Visa and Mastercard?

Most payment processors accept all four major card networks: Visa, Mastercard, American Express, and Discover. The fees may differ slightly by network. Check your processor's pricing page to see if they charge different rates for Amex or Discover.

What if I want to charge a customer's card again without asking them to re-enter it?

Ask your payment processor for a tokenization feature or recurring billing. The processor stores the customer's card details securely and gives you a token. You send the token to the processor each time you want to charge the customer, and the processor charges the card without you ever seeing the card number. This is how subscription services work.

How much does it cost to set up credit card acceptance?

Most all-in-one providers like Stripe and Square have no setup fee. You only pay transaction fees. Some traditional processors charge $25 to $500 to set up a merchant account. Check the provider's pricing page before signing up.