What an e-commerce payment gateway does

An e-commerce payment gateway is the tool that captures your payment information when you buy something online and sends it to the bank or payment processor that actually moves the money. It sits between the customer (you), the merchant's website, and the financial institutions involved. When you enter your card number on a checkout page, the gateway encrypts that data, verifies the card is real and has funds, and then routes the transaction to your bank and the seller's bank to complete the transfer.

The gateway does not hold money or move it itself — it is the messenger and the security checkpoint. It checks that your card has not been reported stolen, that the address you entered matches your bank's records, and that you have not exceeded your daily spending limit. If any of those checks fail, the gateway stops the transaction before your bank even sees it. This happens in seconds, usually while you are still on the checkout page.

Key Takeaways

  • A payment gateway encrypts your card data and sends it to banks to verify the transaction, but does not hold or transfer the money itself.
  • The gateway performs fraud checks like address verification and card-not-present detection before your bank processes the payment.
  • Different gateways charge different fees — typically a percentage of the sale plus a flat per-transaction fee — and those costs are built into the price you pay.
  • Popular gateways include Stripe, Square, PayPal, and Authorize.net, each with different features and fee structures for different business sizes.
  • If a transaction is declined or disputed, the gateway logs the reason and provides records that both you and the merchant can use to investigate.

How the transaction flows from your card to the merchant

When you submit your payment, the gateway immediately encrypts your card number using SSL encryption — the same technology that protects your bank login. Your actual card number never appears in plain text on the merchant's server. The gateway then sends an encrypted token to the payment processor, which is usually a separate company that specializes in moving money between banks.

The processor contacts your bank (the issuing bank) to ask if the transaction should be approved. Your bank checks your available balance, looks for fraud patterns, and sends back a yes or no. This whole exchange takes two to five seconds. If approved, the processor sends a confirmation back to the gateway, which tells the merchant's website to show you a receipt and process your order. The actual money transfer — from your bank account to the merchant's bank account — happens over the next one to three business days through the banking system.

If your bank declines the transaction, the gateway receives that decline message and displays it on the checkout page. You see something like "Card declined" or "Insufficient funds." The merchant never learns your card number, and your bank has a record of the attempt.

Fraud detection and security checks the gateway performs

Before your bank even sees the transaction, the gateway runs several automated checks. Address Verification Service (AVS) compares the billing address you entered with the address your bank has on file. If they do not match, the gateway flags it as a potential fraud risk. Card Verification Value (CVV) — the three-digit code on the back of your card — is checked to confirm you physically have the card or have seen it recently.

The gateway also watches for patterns that suggest fraud: multiple transactions from different countries in minutes, purchases that are wildly different from your normal spending, or a card being used after it was reported stolen. These checks happen silently in the background. Most of the time you do not notice them. If the gateway is very suspicious, it may decline the transaction outright or ask you to verify your identity through a text message or email before the payment goes through.

Some gateways offer 3D Secure (also called Verified by Visa or Mastercard SecureCode), which adds an extra verification step where your bank sends you a code to enter before the transaction completes. This is more common for high-value purchases or international transactions.

Different gateways and how they charge merchants

Stripe, Square, PayPal, Authorize.net, and Adyen are among the most widely used gateways. Each one charges the merchant a fee for processing the transaction, and that fee is typically passed along to you in the form of slightly higher prices. A typical structure is 2.9% of the transaction amount plus $0.30 per transaction, though this varies by gateway, by the merchant's industry, and by the payment method used (credit card, debit card, digital wallet).

Stripe and Square are popular with small online businesses because they are easy to set up and charge per transaction with no monthly minimum. Authorize.net and similar gateways often charge a monthly fee plus per-transaction fees, which makes sense for high-volume merchants. PayPal's gateway charges differently depending on whether you use it as a standalone processor or integrate it into your own website. Digital wallets like Apple Pay and Google Pay sometimes have lower fees than traditional cards because they reduce fraud risk.

The merchant chooses the gateway, not you. When you shop online, you do not pick which gateway processes your payment — the store has already decided that. But the gateway choice affects how secure the checkout is, how fast transactions process, and whether certain payment methods (like PayPal or Apple Pay) are available to you.

What happens when a transaction is declined

When the gateway receives a decline from your bank, it logs the reason code — a two-digit number that tells you why. Common codes include "05" (card not authorized), "51" (insufficient funds), "54" (expired card), and "41" (lost card). The merchant sees this code in their dashboard, and you see a customer-facing message on the checkout page, usually something like "Your card was declined. Please try another payment method."

A decline does not mean your money was taken. The transaction never reached your bank account. You can try again immediately with a different card, or contact your bank to ask why the card was declined. If your bank declined it because of a fraud alert, you may need to call your bank to confirm the purchase is legitimate before trying again. Some merchants allow you to save your card for future purchases, which can help if the decline was a one-time glitch.

Disputes and chargebacks through the gateway

If you make a purchase through a gateway and later dispute it — either because the item never arrived, the charge was unauthorized, or the merchant refused a refund — the dispute goes back through the same gateway. You contact your bank or credit card company and file a chargeback, which is a formal request to reverse the charge. Your bank then contacts the payment processor and the merchant's bank to investigate.

The gateway provides both your bank and the merchant with transaction records: the exact time of the purchase, the IP address you used, the device type, the billing and shipping addresses, and any fraud checks that ran. If you claim you never received the item, the merchant can provide proof of shipment. If you claim the charge was unauthorized, the gateway's records show whether you entered the correct CVV and billing address, which suggests you had the card in your possession.

The chargeback process typically takes 30 to 90 days. During that time, the merchant may temporarily refund you while the investigation happens. If the merchant wins the dispute, the charge goes back on your account. If you win, the charge stays reversed and the merchant loses the money.

International transactions and currency conversion

When you buy from a merchant in another country, the gateway handles currency conversion. If you are in the United States and buy from a UK merchant, the gateway converts the price from British pounds to US dollars at the current exchange rate, usually adding a small markup (typically 1 to 3 percent) for the conversion service. You see the converted amount on your receipt.

Some gateways offer dynamic currency conversion, which means you can choose to be charged in your home currency instead of the merchant's currency. This sounds convenient, but the exchange rate offered is usually worse than what your bank would give you, so it often costs you more. Most payment experts recommend letting your bank handle the conversion instead.

International transactions also trigger more fraud checks because they are higher-risk. The gateway may require 3D Secure verification or ask you to confirm the purchase through your bank before it goes through.

Frequently Asked Questions

Does the payment gateway store my card number?

No. The gateway encrypts your card number and passes it to the processor, but does not store it on the merchant's server. If the merchant wants to store your card for future purchases, they store a token — a unique code that represents your card — not the card number itself. Only the gateway or processor holds the actual card data, and they keep it in a secure vault.

Why was my transaction declined even though I have money in my account?

The gateway or your bank may have flagged the transaction as suspicious based on your location, the merchant's location, the amount, or your recent spending patterns. Call your bank to confirm the purchase is legitimate, and they can approve it for future attempts. Some banks also have daily spending limits that can trigger a decline even if you have the balance.

Can I see which gateway a merchant uses?

Sometimes. If you look at your receipt or the payment page source code, you might see the gateway's name. But most merchants do not advertise it. What matters to you is whether the checkout page shows a padlock icon (indicating encryption) and whether your payment method is accepted.

What if I enter the wrong billing address?

The gateway's Address Verification Service will flag the mismatch. The transaction may still go through if the CVV is correct, but it is marked as higher-risk. If the address is very wrong, the gateway may decline it outright. Always enter the address exactly as your bank has it on file.

How long does it take for a refund to appear after a merchant processes it?

The merchant initiates the refund through the gateway immediately, but the money takes one to three business days to reach your account because it travels back through the banking system. Weekends and holidays extend this timeline. Check your bank account rather than the merchant's refund confirmation, since the merchant's system may show "refunded" before your bank actually receives it.