What a payment gateway does

A payment gateway is the software and service that captures your payment information when you buy something online or over the phone, then sends it to the bank or payment processor that actually moves the money. It sits between you and the merchant's bank account—it does not hold the money itself, and it does not decide whether the transaction goes through. That decision comes from your bank (the issuer) and the merchant's bank (the acquirer), based on whether the card is valid, whether you have enough funds or credit, and whether the transaction looks suspicious.

The gateway's job is to encrypt your card details so they travel safely, route the request to the right processor, wait for approval or denial, and tell the merchant and you the result in seconds. Common gateways include Stripe, Square, PayPal, Authorize.net, and Braintree. Your bank may also run a gateway if you are paying a bill directly through their website.

The merchant pays a fee to the gateway for each transaction—usually a percentage of the sale plus a flat per-transaction charge. That cost is built into the price you pay or absorbed by the business.

Key Takeaways

  • A payment gateway encrypts your card data and routes it to banks and processors; it does not hold money or make the approval decision.
  • The entire process from swipe to approval typically takes two to five seconds, though settlement (when money actually moves) happens later.
  • Your card issuer (your bank) and the merchant's acquiring bank both check the transaction; either can decline it.
  • If a transaction is declined, the gateway shows an error code that tells you whether the problem is insufficient funds, a bad card number, fraud detection, or something else.
  • Chargebacks and disputes go through the card networks and banks, not through the gateway, though the gateway keeps records the merchant can use to fight them.

The path a transaction takes in real time

When you enter your card number on a checkout page or hand your card to a reader, the gateway immediately encrypts that data using SSL encryption (the same technology that protects your bank login). The unencrypted card number never travels across the internet and never sits on the merchant's server.

The encrypted data goes to the payment processor—a company like First Data, Global Payments, or Chase Paymentech that specializes in moving money between banks. The processor sends the request to your card issuer (Visa, Mastercard, American Express, or Discover, or your actual bank if it issued the card). Your issuer checks whether the card is active, whether you have available credit or funds, and whether the transaction matches your spending patterns.

Your issuer sends back an approval code or a decline code. The processor receives it and passes it back to the gateway. The gateway displays the result to the merchant and to you—usually within two to five seconds. If approved, the transaction is now authorized, meaning the money is temporarily held. If declined, you see an error message and the transaction stops.

Authorization is not the same as settlement. Settlement happens later—usually the next business day—when the merchant's bank actually pulls the money from your account and deposits it into the merchant's account. Until settlement, the hold can theoretically be reversed, though in practice it almost never is once authorization is complete.

Why transactions get declined and what the codes mean

A decline code tells you why the transaction failed. Common codes include:

  • Insufficient funds: Your account does not have enough money or available credit. Wait until funds clear or pay down a credit card balance.
  • Invalid card number: You or the merchant entered the number wrong, or the card is expired or closed. Check the number and expiration date.
  • Lost or stolen card: Your issuer flagged the card as compromised. Call your bank to confirm the card is still yours and ask them to reactivate it.
  • Fraud detection: The transaction looks unusual—wrong location, unusual amount, or a pattern that does not match your history. Your issuer may decline it to protect you. Call your bank to verify it was you.
  • AVS mismatch: The billing address you entered does not match what your bank has on file. Re-enter the address exactly as it appears on your statement.
  • CVV mismatch: The three-digit security code on the back of your card does not match. Enter it again carefully.

If a decline code does not match any of these, the merchant or gateway can look up the specific code in the processor's documentation. Some declines are temporary (your bank is having a system issue) and retrying in a few minutes works. Others are permanent until you fix the underlying problem.

How gateways protect your card information

Payment gateways use PCI DSS compliance (Payment Card Industry Data Security Standard) to keep card data safe. This means the gateway and merchant must encrypt data in transit and at rest, limit who can access it, monitor for breaches, and pass annual security audits. Merchants are not allowed to store your full card number after the transaction is complete—the gateway or processor keeps it in a secure vault if the merchant wants to charge you again later (for subscriptions or recurring bills).

When you see a padlock icon on a checkout page, that means the connection between your browser and the merchant's server is encrypted. That protects the data in transit. The gateway adds another layer by encrypting the card number before it even leaves the merchant's server, so even if a hacker breaks into the merchant's system, they cannot read the card data.

If a merchant gets hacked and card data is stolen, the gateway and processor are usually not responsible—the merchant is. However, if the gateway itself is breached, the gateway company is liable for the damage and must notify cardholders. Major breaches are rare because gateways are high-value targets and invest heavily in security.

Settlement and when money actually arrives

Authorization happens in seconds. Settlement takes longer. When you see "transaction approved" on your screen, the money is authorized but not yet moved. Your issuer puts a temporary hold on the funds to make sure they will be there when settlement happens.

Settlement usually occurs the next business day. The merchant's acquiring bank collects all the day's approved transactions, batches them, and sends them to the card networks (Visa, Mastercard, etc.). The networks route each transaction to your issuer. Your issuer pulls the money from your account and sends it to the merchant's acquiring bank, which deposits it into the merchant's account.

During this window—between authorization and settlement—the transaction can theoretically be voided by the merchant if they realize they made a mistake. Once settlement is complete, the only way to reverse it is through a chargeback or refund, which is a separate process.

For ACH transfers (bank-to-bank payments), settlement takes one to three business days. For wire transfers, it can be same-day or next-day depending on the banks and the time of day. For credit cards, it is almost always next business day.

Disputes and chargebacks after the transaction settles

If you dispute a charge after settlement is complete, the process goes through your card issuer and the card networks, not through the gateway. You contact your bank and say the charge was unauthorized, fraudulent, or not as described. Your bank opens a dispute case and asks the merchant's bank for evidence that the transaction was legitimate.

The merchant can use records from the gateway to fight the dispute—proof that you authorized the transaction, delivery confirmation, your IP address, the AVS and CVV match, and any communication between you and the merchant. If the merchant provides strong evidence, your bank may side with them and close the dispute. If the merchant does not respond or the evidence is weak, your bank may refund you and charge the merchant a chargeback fee (usually $15 to $100).

Chargebacks are expensive for merchants and damage their reputation with their acquiring bank. If a merchant gets too many chargebacks, the bank may close their account. This is why merchants care about keeping good records and why gateways store transaction details for months or years.

Different types of gateways and how they differ

Not all gateways work the same way. Hosted gateways (like PayPal or Square) redirect you to their own secure page to enter your card information. You never enter your card on the merchant's website, so the merchant never sees your card number. This is safest for you but requires you to trust the gateway company.

Integrated gateways (like Stripe or Authorize.net) let you enter your card on the merchant's checkout page, but the gateway intercepts the data before it reaches the merchant's server. The merchant sees the transaction but not the card number. This is faster and feels more seamless but requires the merchant to follow strict security rules.

API gateways let developers build custom checkout experiences. The merchant's software talks directly to the gateway's servers and handles the card data programmatically. This is most common for large companies and apps.

All three types use encryption and PCI compliance. The difference is where you enter your information and how much the merchant's website handles. Hosted gateways are generally safest for one-time purchases. Integrated gateways are faster and more common for everyday shopping.

Frequently Asked Questions

Why does my transaction show as pending for days after I was approved?

Authorization and settlement are different. You were approved in seconds, but settlement—when money actually moves—takes one to three business days. During that time, the hold shows as pending on your account. Once settlement completes, it changes to posted. This is normal and does not mean anything went wrong.

Can a merchant charge my card without using a gateway?

No. Any merchant processing a card payment must use a gateway or processor to stay legal and secure. If someone asks for your card number over email or text and promises to "run it manually," that is a red flag for fraud. Legitimate merchants always use an encrypted gateway.

What happens if the gateway goes down during my checkout?

If the gateway is temporarily unavailable, your transaction will not go through and you will see an error message. You can try again in a few minutes. If the outage lasts hours, the merchant may offer an alternative payment method (phone, email, or a different gateway). Major gateways have backup systems to prevent outages, but they do happen occasionally.

Does the gateway know what I am buying?

The gateway sees the transaction amount and the merchant's name, but not the item details. Only the merchant knows what you ordered. This is why your bank statement shows the merchant's name, not the product name. The gateway is designed to move money, not to track what you spend it on.

Can I use the same gateway for different types of payments?

Yes. Most gateways handle credit cards, debit cards, and sometimes digital wallets like Apple Pay or Google Pay. Some also handle ACH transfers or bank transfers. Check the gateway's documentation to see which payment methods it supports. The merchant chooses which methods to offer at checkout.