What you need to decide before choosing a payment processor
Before you sign up with any payment processor, you need to know what kinds of transactions you'll actually be handling. Are you selling physical goods that ship, digital products that download, subscriptions that renew monthly, or services you bill after delivery? Each one has different fraud risk, different refund patterns, and different processor requirements. A processor built for SaaS subscriptions may charge you more per transaction if you're selling t-shirts, and vice versa.
You also need to know your monthly volume — roughly how many transactions and how much money. Processors tier their fees based on volume, and some have monthly minimums or caps. If you're doing $500 a month, a flat-fee processor might cost you less than one charging 2.9% per transaction. If you're doing $50,000 a month, the percentage-based model usually wins.
Finally, decide whether you want to own the payment experience or outsource it. A hosted payment page (like Stripe Checkout or Square Online) means the customer leaves your site to pay, then returns. A payment form embedded on your site (like Stripe Elements or PayPal Commerce Platform) keeps them on your domain the whole time. Embedded forms convert better but require more technical setup and PCI compliance work on your end.
Key Takeaways
- Payment processors charge a combination of per-transaction fees (usually 2.2% to 3.5%), flat fees per transaction ($0.30 to $0.50), and sometimes monthly minimums or gateway fees.
- Stripe, Square, PayPal, and Authorize.net are the most common processors for small to mid-size businesses, each with different fee structures and integrations.
- You'll need a merchant account (which most modern processors bundle) and a payment gateway (the software that encrypts and routes the transaction).
- PCI compliance is required by law if you handle credit card data; most processors handle this for you if you use their hosted or embedded forms rather than storing cards yourself.
- Test your payment flow thoroughly in sandbox mode before going live, including declined cards, refunds, and what happens when a customer's bank rejects the charge.
The three main processor types and how they differ
All-in-one platforms like Square, Shopify Payments, and PayPal Commerce Platform bundle the merchant account, gateway, and payment form into one product. You sign up, connect your bank account, and start accepting payments. They handle PCI compliance for you. The tradeoff: you pay their fees and use their forms, and switching later means rebuilding your checkout. These work well if you're starting out or don't have a developer on staff.
Standalone gateways like Stripe and Authorize.net are software layers that sit between your website and the banking system. You still need a merchant account (which you can get from the gateway itself, or from a separate bank). Stripe is developer-friendly and has excellent documentation; Authorize.net is older and more common in enterprise settings. These give you more control over the checkout experience and lower per-transaction fees if you have volume.
Payment aggregators like Square Cash for Business and PayPal Here are designed for in-person or mobile payments, though some now offer online options too. They're simpler than gateways but less flexible. Use these if you're primarily taking payments on a phone or tablet, not a website.
Understanding processor fees and how they stack
Most processors charge three things: a percentage per transaction (2.2% to 3.5% depending on card type and processor), a flat fee per transaction ($0.30 to $0.50), and sometimes a monthly gateway fee ($10 to $30). Some also charge for refunds, chargebacks, or failed transactions. A few charge monthly minimums if you don't hit a certain volume.
Here's how the math works for a $100 transaction with Stripe (one of the most common): Stripe charges 2.9% + $0.30, so you pay $3.20 and receive $96.80. If you process $10,000 a month, that's roughly $320 in fees. With Square, the rate is 2.6% + $0.30 for online payments, so the same $10,000 costs $290. PayPal Commerce Platform charges 2.99% + $0.30 for standard transactions.
International cards, American Express, and certain card types cost more. Some processors charge 3.5% or higher for Amex. If you're selling internationally, factor in currency conversion fees (usually 1% to 3% on top of the transaction fee). Always read the processor's fee schedule before signing up — they're usually on their pricing page, but call if something isn't clear.
How to integrate a payment processor into your website
If you use a website builder like Shopify, Wix, or Squarespace, payment processing is built in — you just connect your bank account and turn it on. The builder handles the technical work. If you're building a custom website or using WordPress, you have more options.
For a custom site, you'll typically use one of three approaches. Hosted checkout means you add a button or link to your site that sends the customer to the processor's payment page (like Stripe Checkout). The processor handles the form, security, and card data. You get a confirmation, and the customer returns to your site. This is the easiest and safest for beginners. Embedded formsServer-to-server APIs
Most processors provide code samples in multiple languages (JavaScript, Python, PHP, Ruby, etc.). If you don't have a developer, use a hosted checkout or a website builder. If you do, start with the processor's documentation and their sandbox environment (a testing version where charges don't actually go through).
PCI compliance and why it matters
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules you must follow if you handle credit card data. The rule is simple: never store or transmit raw card numbers yourself. If you do, you're liable for breaches, and the fines are steep — sometimes $5,000 to $100,000 per incident, plus legal costs.
The easiest way to stay compliant is to use a processor's hosted form or embedded form. When you do, the processor handles the card data, and you're mostly off the hook. You still need to use HTTPS (encrypted connections) on your site, not store card data in your database, and follow basic security practices (strong passwords, regular updates, no hardcoded API keys in your code).
If you're using a custom payment form, you'll need to complete a PCI self-assessment questionnaire (SAQ) and possibly undergo an audit. Most small businesses don't need a full audit, but you do need to document your security practices. Talk to your processor about which SAQ level applies to you — they usually have resources to help.
Testing your payment flow before launch
Every processor provides a sandbox — a testing environment where you can process fake transactions without real money changing hands. Use it. Create test cards (the processor provides these), run through your entire checkout flow, and test the things that usually break: declined cards, expired cards, 3D Secure authentication (the extra verification step some banks require), refunds, and what happens when a customer closes the browser mid-payment.
Test on mobile too. Many payment forms break on small screens, and mobile is where most of your customers will be. Check that the form loads fast, the fields are easy to tap, and the confirmation page appears after payment.
Also test your refund flow. Log into your processor's dashboard and process a refund on one of your test transactions. See how long it takes to appear in your testing bank account (usually 1 to 3 business days). Make sure you know how to issue partial refunds and how to handle disputes if a customer claims they never received the product.
Handling failed payments and chargebacks
Not every payment goes through. A card might be declined because the customer entered the wrong CVV, their bank flagged it as fraud, or they don't have enough funds. Your processor will tell you why and give you an error code. Common ones: "insufficient_funds", "card_declined", "expired_card", "lost_card".
When a payment fails, you have a few options. You can ask the customer to try again with a different card. You can retry the payment automatically after a few days (some processors do this for you). Or you can send them an email with a link to retry. Most processors let you customize the error message the customer sees, so tell them what went wrong and how to fix it — "Your card was declined. Please check the expiration date and try again" is better than a generic error code.
Chargebacks happen when a customer disputes a charge with their bank. The bank pulls the money back from you, and you have to prove the transaction was legitimate. Keep records: order confirmation, shipping tracking, customer email, anything that shows the customer received what they paid for. Most processors give you tools to upload evidence and contest the chargeback. If you lose, you pay the chargeback fee (usually $15 to $100) plus the refund amount. Too many chargebacks and your processor will close your account.
Choosing between processors: a comparison
| Processor | Online Fee | Monthly Minimum | Best For | Setup Complexity |
|---|---|---|---|---|
| Stripe | 2.9% + $0.30 | None | Custom websites, developers, subscriptions | Medium (good docs) |
| Square Online | 2.6% + $0.30 | None | Small businesses, simple stores | Low (built-in website builder) |
| PayPal Commerce Platform | 2.99% + $0.30 | None | Existing PayPal users, marketplaces | Medium |
| Authorize.net | 2.9% + $0.30 (varies) | $25 | Enterprise, recurring billing | High (older platform) |
| Shopify Payments | 2.9% + $0.30 | None | Shopify stores only | Low (integrated) |
Fees and features change, so check the processor's current pricing page. Also ask about volume discounts — if you're processing more than $100,000 a month, you can often negotiate lower rates.
Frequently Asked Questions
Do I need a separate merchant account, or does the processor provide one?
Most modern processors (Stripe, Square, PayPal) provide a merchant account as part of their service. You sign up, connect your bank account, and you're done. Older processors like Authorize.net sometimes require you to get a merchant account from a bank separately, then connect it to the gateway. Ask the processor during signup — they'll tell you what you need.
What happens if my processor goes out of business or I want to switch?
Your transactions are safe — the processor doesn't hold your money, your bank does. But switching is a hassle because you'll need to update your website code or settings to point to the new processor. Hosted checkouts are easier to switch than embedded forms. Keep your transaction history and customer data backed up so you can migrate if needed.
Can I accept payments without a website?
Yes. Square, PayPal, and Stripe all offer payment links — you generate a unique URL and send it to customers via email or text. They click the link, pay, and you get the money. No website required. This works for invoices, donations, or one-off sales.
How long does it take for money to show up in my bank account?
Usually 1 to 3 business days, depending on your bank and processor. Some processors offer next-day payouts for an extra fee. Weekends and holidays slow things down. Check your processor's payout schedule on their dashboard — they'll show you exactly when money will arrive.
What if I'm selling internationally?
Most processors accept cards from many countries, but you'll pay currency conversion fees (usually 1% to 3%) and may face higher fraud rates. Some processors (like Stripe) have local payment methods for specific countries — iDEAL in the Netherlands, Alipay in China, etc. If you're selling a lot internationally, look for a processor with good international support and local payment options in your target countries.