What a payment gateway does
A payment gateway is the software that captures your payment information when you buy something online or in person, then sends it securely to the bank or processor that actually moves the money. It is the middleman between you, the merchant, and the financial system. Without it, a store would have to handle your card number directly—which is why they do not.
The gateway does not hold money or make the final decision to approve or decline. It collects your card details (or digital wallet, or bank account), encrypts them, and passes them to a payment processor. The processor talks to your bank and the merchant's bank to confirm the funds exist and the transaction is legitimate. The gateway then tells the merchant whether to complete the sale or refuse it.
You interact with the gateway every time you enter your card at checkout, tap your phone to pay, or authorize a recurring charge. You do not see the gateway's name—you see the merchant's checkout page. But the gateway is running behind it.
Key Takeaways
- A payment gateway encrypts and routes your payment information to the processor and banks, but does not approve or decline the transaction itself.
- The gateway collects your card, digital wallet, or bank account details and sends them through secure channels so the merchant never handles your raw payment data.
- Approval or decline happens at the processor and bank level, not at the gateway, and takes seconds to a few minutes depending on the payment method.
- Different gateways support different payment methods—some handle cards only, others add digital wallets, bank transfers, and buy-now-pay-later options.
- The gateway is responsible for PCI compliance, meaning it must meet security standards set by the card networks to protect your information.
How the transaction flows through a gateway
When you enter your card number at checkout, the gateway immediately encrypts it using a security protocol called TLS (Transport Layer Security). This means the data is scrambled so that even if someone intercepts it, they cannot read it. The encrypted data travels to the payment processor's server, not directly to the merchant's.
The processor receives the encrypted payment details and forwards them to the card networks—Visa, Mastercard, American Express, or Discover. The network routes the request to your bank (the issuer). Your bank checks whether the card is active, whether you have enough funds or available credit, and whether the transaction looks fraudulent. This check takes a few seconds to a few minutes.
Your bank sends back an approval or decline code. The processor receives it and sends that result back through the gateway to the merchant's checkout page. If approved, the merchant shows a confirmation and the sale completes. If declined, the customer sees an error message and can try a different card or payment method.
The actual transfer of money happens later, usually within one to three business days. The gateway and processor coordinate the settlement—the movement of funds from your bank to the merchant's bank. Until settlement, the transaction is authorized but not yet finalized.
What makes a gateway secure
Payment gateways must meet PCI DSS (Payment Card Industry Data Security Standard), a set of rules created by Visa, Mastercard, and other card networks. PCI compliance means the gateway encrypts data, limits who can access it, logs all transactions, and tests its security regularly. A gateway that is not PCI-compliant is breaking the law and putting customers at risk.
The gateway also uses tokenization to reduce risk. Instead of storing your actual card number, the gateway creates a token—a unique code that represents your card but is useless to a thief. When you make a repeat purchase, the merchant sends the token, not your card number. Even if a hacker breaks into the merchant's system, they get tokens, not cards.
Many gateways add 3D Secure (also called Verified by Visa or Mastercard SecureCode), an extra layer where your bank sends you a code or asks a security question before the transaction completes. This slows checkout slightly but makes fraud much harder because the thief would need access to your phone or email, not just your card number.
Fraud detection happens at multiple points. The processor and your bank both scan for suspicious patterns—a card used in two countries in one hour, a purchase amount much larger than your normal spending, or a card number that matches known stolen lists. The gateway logs all of this so disputes can be investigated later.
Different gateways, different payment methods
Not all gateways handle the same payment methods. Some process cards only. Others add digital wallets like Apple Pay, Google Pay, and PayPal. Some include bank transfers (ACH in the US), buy-now-pay-later services like Affirm or Klarna, or international payment methods like iDEAL or Alipay.
When you choose a payment method at checkout, you are choosing which path the gateway will route your information through. If you tap Apple Pay, the gateway receives an encrypted token from your phone, not your card number. If you select PayPal, the gateway redirects you to PayPal's site, where you log in and authorize the payment, then PayPal tells the gateway the transaction is approved.
Merchants choose which gateways to use based on which payment methods their customers need and which fees they can afford. A small business might use Stripe or Square because they are simple and affordable. A large retailer might use a custom gateway built by their processor because it handles high volume and integrates with their inventory system.
What happens when a transaction is declined
When your bank declines a transaction, the gateway receives a code explaining why. Common reasons include insufficient funds, a card that has expired, a card reported stolen, or a transaction that looks fraudulent. The gateway displays a message to you at checkout—usually something like "Your bank declined this transaction" or "Please contact your card issuer."
You can try again with the same card (if the problem was a temporary glitch), use a different card, or call your bank to ask why it was declined. If your bank blocked it for fraud protection, you may need to confirm the purchase with them before trying again. If the card is expired or you do not have enough funds, you will need to fix that before the transaction can go through.
The merchant does not see your bank's specific reason—they only see that the transaction was declined. This protects your privacy. The gateway keeps a record of the decline for your bank's records and for dispute investigation if you later claim you did not authorize it.
Gateways versus processors versus banks
These three roles are often confused because they work together so closely. The gateway is the software that collects and encrypts your payment information. The processor is the company that routes that information to the banks and handles settlement. The bank (your issuer) is the one that actually approves or declines based on your account.
Some companies do multiple jobs. Stripe, for example, acts as both gateway and processor. Square does the same. PayPal is a gateway, processor, and also holds money in accounts. Your bank is only a bank—it does not build gateways or process transactions for merchants.
When something goes wrong—a transaction you did not authorize, a charge that appears twice, a refund that never arrived—you may need to contact multiple parties. The merchant handles the refund request. The processor coordinates between the merchant and the banks. Your bank investigates whether the charge was legitimate and whether to reverse it. The gateway logs the transaction details so everyone can see what happened.
Fees and how gateways make money
Payment gateways charge merchants a fee for each transaction, usually a percentage of the sale plus a flat amount. Stripe charges around 2.9% plus $0.30 per card transaction in the US, though this varies by country and payment method. Square charges similar rates. These fees vary widely depending on the gateway, the payment method, and the merchant's volume.
You do not pay the gateway directly—the merchant does. But the merchant often builds the cost into prices, so you pay for it indirectly. Some merchants absorb the cost themselves. A few try to pass it directly to customers by charging a "convenience fee" for card payments, though this is less common than it used to be.
Gateways also charge setup fees, monthly minimums, or fees for features like recurring billing or international payments. A merchant should compare gateways based on total cost, not just the per-transaction rate, because a cheap per-transaction fee with a high monthly minimum might cost more than a slightly higher per-transaction rate with no minimum.
Frequently Asked Questions
Does the payment gateway store my card number?
No. The gateway encrypts your card number and sends it to the processor, then deletes it from its own servers. If you save your card for future purchases, the gateway stores a token—a unique code that represents your card but is not your actual card number. A thief who steals the token cannot use it anywhere else.
Why does my transaction say "pending" if it was approved?
Approval and settlement are two different things. When you see "pending," the gateway and processor have approved the transaction and your bank has reserved the funds. But the money has not actually moved yet. Settlement happens later, usually within one to three business days, when the funds transfer from your bank to the merchant's bank. Once settled, the transaction stops showing as pending.
Can a payment gateway reverse a transaction?
The gateway cannot reverse a transaction on its own—only your bank can do that through a dispute or refund process. If a merchant wants to refund you, they request it through the gateway, the processor coordinates it, and your bank approves the reversal. This usually takes three to five business days.
What if I use a digital wallet instead of entering my card?
The gateway still encrypts and routes your payment, but it receives a token from your digital wallet instead of your card number. Apple Pay, Google Pay, and PayPal all send encrypted tokens to the gateway. Your actual card number stays on your phone or in your digital wallet account, never reaching the merchant or the gateway directly.
Is it safe to use the same payment gateway on different websites?
Yes. Many websites use the same gateway—Stripe, Square, or PayPal—because it is cheaper and easier than building their own. The gateway encrypts your information separately for each merchant, so one website cannot see your transactions on another. Your bank and the card networks see all your transactions, but that is normal and necessary for fraud detection.