What happens when you enter your card number online
A payment gateway is the software that sits between you and the merchant's bank. When you type your card number into a checkout form, the gateway encrypts it, sends it to the card network (Visa, Mastercard, Amex), which routes it to your bank, which approves or declines it in seconds, and then the gateway tells the merchant whether the sale went through. The whole chain takes 2 to 5 seconds. The gateway itself does not hold your money or decide whether you can afford the purchase — it is a messenger that speaks the language of banks and card networks.
The gateway is owned by a third party, not by the merchant. Common gateways include Stripe, Square, PayPal, Authorize.net, and Adyen. The merchant pays a fee per transaction (usually 2.2% to 3.5% plus 30 cents) to use it. That fee covers the gateway's cost to connect to the card networks, maintain security, and handle disputes if something goes wrong.
Key Takeaways
- A payment gateway encrypts your card data and routes it through card networks to your bank, which approves or declines the charge in seconds.
- The gateway does not store your card number after the transaction — it passes the data through and then discards it, which is why you have to enter it again on your next purchase.
- If a charge is fraudulent or the merchant never ships the item, you dispute it with your bank, not with the gateway — the gateway just processes the initial transaction.
- The merchant pays the gateway a fee per transaction, which is why some businesses offer discounts for cash or ACH payments instead.
- A gateway is different from a payment processor, which actually moves the money from your bank account to the merchant's — the gateway just authorizes it.
The exact path your card data takes
When you submit your card at checkout, the gateway immediately encrypts it using a standard called TLS (Transport Layer Security). This encryption happens on your device before the data leaves your browser, so the merchant's website never sees your actual card number. The encrypted data travels to the gateway's server.
The gateway then sends that encrypted data to the card network — Visa, Mastercard, or Amex — which acts as a middleman. The network does not approve the charge itself; it routes the request to your bank (the issuer). Your bank checks whether the card is active, whether you have enough available credit or funds, and whether the charge matches your typical spending pattern. Your bank sends back an approval code or a decline code in seconds.
The card network passes that response back to the gateway, which displays it to the merchant and to you. If approved, the merchant sees a confirmation and ships the item or delivers the service. If declined, you see an error message and the charge never posts to your account. At no point does the gateway hold the money — it only authorizes the merchant to collect it.
Why the gateway does not store your card number
After the transaction completes, the gateway discards your card data. It does not keep a copy on file unless you explicitly ask it to (for example, if you check a box that says "save this card for next time"). This is why you have to enter your card number again on your next purchase at a different merchant — each gateway only stores what you tell it to store, and only for merchants you have authorized.
This design protects you. If a gateway's database is breached, hackers cannot steal card numbers that were never stored there. The gateway only holds a token — a random string of characters that represents your card but has no value on its own. If you save your card with a merchant, the merchant stores the token, not the card number. When you make a repeat purchase, the merchant sends the token to the gateway, which uses it to charge your card without you having to type the number again.
Some gateways offer a service called tokenization, which lets merchants store tokens securely. This is how subscription services charge you every month without asking for your card each time. The token is useless to a thief because it only works with that specific merchant and that specific gateway.
What the gateway does during a dispute
If you see a charge you did not make, or if a merchant never ships an item you paid for, you contact your bank and file a dispute. Your bank then contacts the card network, which contacts the merchant's bank, which contacts the merchant. The gateway is notified that a dispute exists, but it does not investigate or decide the outcome.
The merchant has a window (usually 7 to 10 days) to respond with proof that the transaction was legitimate — a tracking number, a signed delivery confirmation, or evidence that you authorized the charge. If the merchant cannot prove it, your bank refunds the money to your account. If the merchant provides proof, your bank may side with the merchant and leave the charge in place.
The gateway's role is to provide transaction records to both sides. It stores logs of when the charge occurred, what IP address it came from, and what authorization code your bank issued. These records help your bank and the merchant's bank settle the dispute. The gateway itself never reverses a charge or decides who is right.
The difference between a gateway and a processor
A payment gateway authorizes the transaction. A payment processor actually moves the money. These are sometimes the same company (Stripe does both), but they are two separate functions.
The gateway tells the merchant "yes, this card is good" in real time. The processor collects all the approved charges from the day, batches them together, and sends them to the merchant's bank. The merchant's bank then pulls the money from customers' banks and deposits it into the merchant's account. This settlement usually takes 1 to 3 business days, which is why you might see a charge pending on your card for a day or two before it actually posts.
If you use a gateway like Stripe or Square, they handle both functions — they authorize the charge and then settle it. If you use an older system, you might have a separate gateway (to authorize) and a separate processor (to settle). Understanding which company does which job matters when something goes wrong, because you contact the processor about missing deposits and the gateway about transaction records.
How gateways handle different payment types
Most gateways started with credit and debit cards, but now they handle ACH transfers, digital wallets (Apple Pay, Google Pay), and buy-now-pay-later services. Each type takes a different path through the system.
A credit card goes through the card network as described above. A debit card goes through the same network but pulls directly from your checking account instead of creating a bill. An ACH transfer (bank-to-bank) bypasses the card networks entirely and goes directly to the Federal Reserve's ACH system, which is slower (1 to 3 business days) but cheaper for the merchant. A digital wallet like Apple Pay stores an encrypted version of your card and sends it to the gateway the same way a physical card would, except the wallet provider (Apple) handles the encryption instead of the gateway.
Buy-now-pay-later services like Affirm or Klarna are their own gateways. When you choose that option at checkout, the merchant's gateway passes you to Affirm's gateway, which handles the installment plan separately. The merchant gets paid in full immediately (by Affirm), and you pay Affirm in installments.
Security standards gateways must follow
Every payment gateway must comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules created by Visa, Mastercard, Amex, and Discover. PCI DSS requires gateways to encrypt data, use firewalls, test for vulnerabilities regularly, and limit who can access card information. A gateway that fails a PCI audit loses the right to process cards.
This is why gateways ask merchants to use HTTPS (the padlock icon in your browser) and why they encrypt data before storing it. It is also why gateways charge fees — much of that fee goes to security infrastructure, fraud detection, and compliance audits.
If you use a gateway that is not PCI compliant, you are at risk. Your card data could be stored unencrypted, stolen in a breach, and sold on the dark web. Always check that a merchant's checkout page shows a padlock icon and that the URL starts with https://, not http://.
Frequently Asked Questions
Can a payment gateway see my card number?
The gateway's servers see your encrypted card number briefly while processing the transaction, but they cannot read it — only your bank can decrypt it. After the transaction completes, the gateway discards the card data and keeps only a token if you asked it to save your card. The gateway never stores the full card number permanently.
Why does a charge show as pending for days after I buy something?
The gateway authorizes the charge in seconds, but the processor takes 1 to 3 business days to settle it. During that time, the charge appears as pending on your account — your bank is holding the money but has not yet pulled it from your account. Once settlement completes, the charge moves from pending to posted.
What happens if the gateway goes down during my purchase?
If the gateway is offline, the merchant cannot process your card and will ask you to try again later or offer an alternative payment method. Your card is not charged if the gateway never receives the request. If the gateway goes down after authorizing but before settlement, the charge may still post to your account 1 to 3 days later because the authorization was already sent to your bank.
Does the gateway protect me from fraud?
The gateway provides tools to detect fraud — it flags unusual patterns like multiple charges from different countries in minutes — but your bank makes the final decision about whether to approve a charge. If a fraudulent charge posts to your account, you dispute it with your bank, not the gateway. Your bank's fraud protection is what refunds you.
Why do some merchants charge extra for credit cards but not for ACH?
Credit card transactions cost merchants 2.2% to 3.5% in gateway and processing fees. ACH transfers cost less than 1%. Merchants pass that savings to you when you pay by ACH or cash. The gateway is what enables the merchant to offer different prices for different payment methods.