For a customer, paying online looks simple: enter card details or pick a wallet, click pay, and a confirmation appears a few seconds later. Behind that, the payment details are protected, checked for fraud, sent through the card network to the customer’s bank, and an answer comes back. The technology that carries the payment through all of that is the payment gateway.
This guide explains what a payment gateway is, how it processes a transaction, how it differs from a payment processor and a merchant account, the main integration types, and what to look for when choosing one.
Key takeaways
- A payment gateway is the technology that securely captures payment details at checkout and sends them for authorisation, then returns the result.
- The gateway carries the data. The processor and acquirer move the money. The merchant account is your agreement with the acquirer.
- Hosted payment pages keep card data off your servers and reduce your PCI DSS burden. Direct API integrations give more control but more responsibility.
- A good gateway supports 3D Secure, tokenisation, local payment methods and recurring billing, and gives clear reporting.
- High-risk merchants need a gateway that works with acquirers who accept their industry.
What is a payment gateway?
A payment gateway is the technology that connects your checkout to the payment system. It takes the customer’s payment details, protects them, sends the transaction to your acquirer for authorisation, and returns the approval or decline to your website, app or terminal.
Think of it as the secure messenger between your checkout and the banks. It doesn’t decide whether a payment is approved, and it doesn’t hold the money. It makes sure the request gets to the right place safely and the answer comes back quickly.
How a payment gateway processes a transaction
- The customer pays. They enter card details or choose a payment method at checkout.
- The gateway protects the data. Card details are encrypted in transit and often replaced with a token.
- Fraud checks and authentication. The gateway or the merchant’s fraud tools screen the payment, and the customer may be asked to complete 3D Secure. In the EEA and UK, strong customer authentication is required for most online card payments.
- Authorisation request. The gateway sends the transaction to the acquirer, which passes it through the card scheme to the customer’s bank (the issuer).
- The issuer decides. It checks funds, card status and its own risk rules, then approves or declines.
- The answer comes back. The response travels back to the gateway, which shows the result at checkout.
- Capture and settlement. Approved payments are captured and later settled by the acquirer to the merchant, usually in a daily batch.
Payment gateway vs payment processor vs merchant account
| What it is | Its job | |
|---|---|---|
| Payment gateway | Technology | Captures and protects payment details, sends the request, returns the result |
| Payment processor | A company handling transaction processing for the acquirer | Passes authorisations and clearing data between acquirer, card schemes and issuers |
| Acquirer and merchant account | A licensed card scheme member, and your agreement with it | Accepts card payments on your behalf and settles the funds to you |
| Payment service provider | A company bundling the above | Gives you gateway, acquiring access and payment methods in one contract |
In practice, many providers combine roles. A payment service provider often offers the gateway and the acquiring together, while some merchants use one gateway connected to several acquirers. When routing across several providers becomes a layer of its own, it is called payment orchestration.
Types of payment gateway integration
Hosted payment page
The customer is redirected to, or shown, a payment page run by the gateway. Card data never touches your servers, which keeps your PCI DSS obligations to a minimum. The trade-off is less control over the look and flow of checkout.
Embedded fields or iframe
The gateway’s payment fields sit inside your own checkout page. The customer stays on your site, while the card data still goes straight to the gateway. This balances control and compliance.
Direct API integration
Your systems collect the card data and send it to the gateway through its API. You get full control of the experience, but card data passes through your environment, so your PCI DSS scope and responsibilities are much larger.
Plugins and point of sale
Many gateways offer ready-made plugins for e-commerce platforms, and the same gateway can connect card terminals in physical locations.
What a modern payment gateway should offer
Security and fraud tools
PCI DSS compliance is the baseline. Look for 3D Secure, tokenisation, address and CVV checks, velocity rules and the ability to set your own risk rules. See our guide to fraud protection and prevention.
Payment methods
Cards are the start. Depending on your markets, you may need wallets and local payment methods such as iDEAL, Bancontact or MobilePay.
Recurring billing
For subscriptions, the gateway needs to store credentials securely, run scheduled charges and handle failed renewals sensibly. Network tokens help keep stored card details up to date. More in our guide to recurring billing.
Approval rate tools
Some gateways can retry recoverable declines and route payments to the acquirer that performs best for a card’s country or BIN range. See our guide to improving approval rates.
Reporting and reconciliation
Clear transaction, settlement, refund and chargeback reports save your finance team hours, especially across several currencies.
Costs to look at
Gateway pricing varies widely, so compare the total, not just the headline rate. Typical items are a per-transaction fee, setup or monthly fees, fees for refunds and chargebacks, currency conversion and cross-border fees, and charges for extra features such as fraud tools or tokenisation. When the gateway comes bundled with acquiring, the acquiring fees and any rolling reserve are part of the same picture.
Payment gateways for high-risk merchants
A gateway on its own doesn’t get a high-risk business approved. What matters is whether the acquirers behind it accept your industry. Adult, dating, gaming, nutraceutical and subscription merchants need a high-risk payment gateway connected to acquirers that work with their merchant category, plus tools to keep disputes low, such as 3D Secure, clear billing descriptors and pre-dispute services.
Frequently asked questions
What is a payment gateway?
A payment gateway is the technology that securely captures a customer’s payment details at checkout, sends the transaction to the acquirer for authorisation and returns the approval or decline.
What is the difference between a payment gateway and a payment processor?
The gateway captures and transmits the payment data from your checkout. The processor handles the transaction messages between the acquirer, the card schemes and the issuer. The acquirer then settles the money to you.
Do I need a merchant account as well as a payment gateway?
To accept cards you need acquiring, which comes with a merchant account. Some providers bundle the gateway and acquiring together, while others offer only the gateway, which you connect to your own acquirer.
What is a hosted payment page?
A hosted payment page is a checkout page run by the gateway. Card details are entered there instead of on your servers, which keeps most PCI DSS requirements with the gateway.
Do payment gateways support recurring payments?
Most do. They store card details as tokens and use them for scheduled charges, which is how subscriptions and memberships are billed.
How does a payment gateway help prevent fraud?
Through encryption, tokenisation, 3D Secure authentication, address and CVV checks, velocity rules and configurable risk rules, which stop many fraudulent payments before they are authorised.
Do I need a payment gateway for in-store payments?
Card terminals connect to the payment system in a similar way, often through the same provider. Many gateways handle online and in-person payments together.
Next step
For a high-risk business, the gateway is only as good as the acquirers behind it. Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants, and approval typically takes two to three weeks.
Get a free quote and tell us about your checkout.
Source: PCI Security Standards Council.
