The basic setup: what you need before your first transaction
To take credit card payments, you need three things: a merchant account (a bank account that accepts card deposits), a payment processor (the company that handles the transaction), and a way to actually process the card—either a physical terminal, a mobile reader, or online software. Most small businesses use a single provider that bundles all three together, so you sign one contract instead of three.
The processor is the middleman between your customer's bank and your merchant account. When someone hands you a card or enters their number online, the processor checks with the card issuer (Visa, Mastercard, American Express, Discover), confirms the funds are there, and deposits the money into your account a few days later. You pay the processor a fee for each transaction—usually 2 to 3 percent of the sale plus a small flat fee per transaction, though rates vary widely by provider and business type.
You do not need to be incorporated or have a business license to accept cards, though some processors ask for a business tax ID. Sole proprietors can often use their Social Security number instead. What you do need is a bank account in your business name (or your personal account if you're operating as a sole proprietor under your own name).
Key Takeaways
- A payment processor handles the transaction between your customer's bank and your merchant account, and you pay them a percentage of each sale plus a small per-transaction fee.
- Square, Stripe, PayPal, and Toast are the most common providers for small businesses, each with different fee structures and hardware options.
- In-person payments use a physical terminal or mobile reader; online payments use a payment form on your website or a hosted checkout page.
- Fees vary by how you accept the card—swiping or inserting a chip costs less than typing in the number manually, which costs less than a keyed-in transaction.
- Your processor deposits money into your bank account within one to three business days, though some hold funds longer if your business is new or high-risk.
In-person payment: terminals, readers, and what each costs
If you take payments face-to-face, you have two hardware options. A countertop terminal sits on your desk or counter and the customer inserts or swaps their card. A mobile reader plugs into your phone or tablet and lets you process payments anywhere—at a market, a client's home, or a pop-up location. Mobile readers are cheaper upfront (often free or $30 to $100) but charge slightly higher per-transaction fees. Terminals cost more ($200 to $500) but have lower per-transaction rates if you process a high volume.
The fee you pay depends on how the card is read. If the customer inserts a chip or swaps a contactless card (Apple Pay, Google Pay), you pay the lowest rate—usually 2.6 to 2.9 percent plus $0.10 to $0.30 per transaction. If you swipe the magnetic stripe (older cards), the rate is slightly higher. If you manually type in the card number—because the customer is not present or the card is damaged—you pay the highest rate, sometimes 3.5 percent or more, because the processor has no way to verify the card is real.
Most small-business processors (Square, Stripe, PayPal, Toast, Clover) offer both terminals and mobile readers. Compare their fee structures before you choose, because the difference adds up if you process hundreds of transactions a month. Some also charge a monthly fee ($0 to $50) or require a minimum monthly volume.
Online payment: forms, hosted pages, and embedded checkout
If you sell online, you have three ways to take cards. A payment form on your website collects the card details and sends them securely to your processor. A hosted checkout page is a page the processor hosts for you—you send the customer a link, they enter their card on the processor's site, and you never see the card number. An embedded checkout is a form that looks like part of your website but is actually powered by the processor's software.
Hosted pages are the easiest to set up if you have no technical skills—you just create a link and send it to the customer. They work on any device and you do not have to worry about security compliance. The downside is that the customer leaves your website to pay, which can feel less professional and sometimes increases cart abandonment.
Payment forms and embedded checkouts keep the customer on your site, which feels more seamless. They require more setup—you may need to install code or use a plugin—but most modern processors provide templates or drag-and-drop builders so you do not need a developer. Fees are usually the same as in-person chip transactions (2.6 to 2.9 percent plus a small flat fee), though some processors charge slightly more for online payments because the fraud risk is higher.
Choosing a processor: what to compare
The major processors for small businesses are Square, Stripe, PayPal, Toast, and Clover. Each has a different fee structure, hardware options, and feature set. Square and PayPal are the easiest to start with if you have no technical background; Stripe is best if you want to customize the checkout experience; Toast is built for restaurants; Clover is built for retail.
When comparing, look at: the per-transaction fee (usually 2.6 to 3.5 percent plus $0.10 to $0.30), any monthly fees, the cost of hardware, how long it takes to get paid (usually one to three business days), and whether they charge extra for refunds or chargebacks. Ask whether they offer discounted rates if you process a certain volume, and whether they charge a setup fee. Some processors also charge a fee to close your account or switch providers, so read the contract before you sign.
Call or chat with the processor's support team and ask how long they take to respond. If you process hundreds of transactions a day and one goes wrong, you need help fast. Also ask what happens if a customer disputes a charge—the processor will investigate and may reverse the payment, so you want to know the timeline and what documentation they need from you.
Security, compliance, and what you have to do
You do not have to be a security informed, but you do have to follow PCI DSS (Payment Card Industry Data Security Standard), a set of rules that protect card data. The rules are different depending on how many transactions you process and how you store card information.
The simplest approach is to never store card numbers yourself. Use a hosted checkout page or a payment form that sends the card directly to the processor, and the processor stores the encrypted data. You never see the full card number, so you have almost no compliance burden. If you use a payment form on your website, make sure it is hosted on an HTTPS connection (look for the padlock icon in the address bar) and that your processor handles the encryption.
If you manually type in card numbers, you have higher compliance requirements. You cannot store the card number in an email, a spreadsheet, or a text file. If you need to keep a record, use a processor that lets you store a "token"—a code that represents the card but is not the card number itself. Your processor can help you set this up.
You also need to report any data breach to your processor when ready. If a customer's card is stolen because of something you did wrong, you may be liable for the cost of replacing the card and any fraud that results. This is why using a reputable processor and following their security steps is cheaper than trying to cut corners.
Deposits, holds, and when the money actually arrives
Most processors deposit money into your bank account within one to three business days of the transaction. If you process a payment on Monday, you might see it in your account on Wednesday or Thursday. Some processors offer next-day deposits for an extra fee (usually 1 percent of the transaction).
New businesses and high-risk industries (like cannabis, gambling, or adult services) sometimes face longer holds. A processor may hold 10 to 30 percent of your deposits for 30 to 90 days to protect themselves in case of chargebacks or fraud. This is legal and common, though it can strain cash flow if you are just starting out. Ask the processor upfront whether they use rolling reserves or if they will hold funds, and for how long.
Chargebacks—when a customer disputes a charge and their bank reverses the payment—can take weeks or months to resolve. The processor will deduct the disputed amount from your account while they investigate. If you win the dispute, the money goes back in. If you lose, you keep the loss and may also pay a chargeback fee ($15 to $100). Keep records of every transaction, including receipts and proof of delivery, so you can defend yourself if a dispute comes up.
Common mistakes and how to avoid them
The biggest mistake is choosing a processor based on fee alone. A processor that charges 2.5 percent but takes five business days to deposit and has terrible customer service will cost you more in the long run than one that charges 2.8 percent and deposits in one day. Compare the total cost, not just the per-transaction rate.
Another mistake is not reading the contract. Some processors charge early termination fees, require a minimum monthly volume, or have clauses that let them freeze your account if they suspect fraud. Read the contract or have someone read it for you before you sign.
A third mistake is not keeping records. If a customer disputes a charge, you need to prove the transaction happened and the customer authorized it. Keep receipts, invoices, shipping confirmations, and any emails where the customer agreed to the charge. Digital records are fine as long as they are dated and complete.
Finally, do not store card numbers in plain text or unencrypted files. If you need to keep a record of a card for a repeat customer, ask your processor how to do it securely. Most processors let you store a token or a "vault" of cards so you can charge the customer again without asking for the card number each time.
Frequently Asked Questions
What is the difference between a payment processor and a merchant account?
A merchant account is a bank account that accepts card deposits. A payment processor is the company that handles the transaction and moves the money from the customer's bank to your merchant account. Most small-business providers bundle both together, so you sign one contract and do not have to think about the difference.
Can I accept credit cards without a business license?
Yes. Most processors accept sole proprietors and do not require a business license. You may need a business tax ID or you may be able to use your Social Security number. Check with the processor you choose to see what they require.
What happens if a customer disputes a charge?
The customer's bank investigates and may reverse the payment. The processor deducts the amount from your account while they look into it. If you can prove the customer authorized the charge and received what they paid for, you usually win the dispute and keep the money. If you cannot prove it, you lose the money and may pay a chargeback fee.
Do I have to use the processor's hardware, or can I use my own?
You have to use hardware that is certified to work with your processor. You cannot use a Square reader with a Stripe account, for example. Most processors sell or rent their own hardware, though some let you buy compatible hardware from third parties. Ask your processor what options are available.
How long does it take to set up a merchant account?
Most online processors can approve you in minutes to a few hours. You provide your name, address, bank account information, and tax ID, and they run a background check. Some processors may ask for additional documents if your business is new or high-risk. Once you are approved, you can start processing payments when ready.