What you need to set up credit card payments

To accept credit cards, you need three things: a merchant account (which lets you receive card payments), a payment processor (which handles the transaction), and a way to take the card information—either a physical terminal, online gateway, or mobile reader. Most small businesses get all three from a single provider rather than shopping separately.

The merchant account is the foundation. Your bank or a payment processor opens this account in your business name, and card networks (Visa, Mastercard, Discover, American Express) route payments through it. Without one, you cannot legally accept cards. The processor is the company that actually moves the money—they talk to the card networks, check that funds are available, and deposit the payment into your business bank account, usually within one to three business days.

You also need a way to physically or digitally capture the card. That might be a point-of-sale terminal at a checkout counter, a payment link you email to customers, a form on your website, or a mobile reader that plugs into a phone or tablet. The choice depends on your business type and how customers pay you.

Key Takeaways

  • A merchant account, payment processor, and card capture method are the three required pieces, and most small businesses buy all three from one provider.
  • Interchange fees (set by card networks), assessment fees (set by card networks), and processing fees (set by your processor) stack on top of each other and vary by card type and transaction method.
  • Physical card readers and online payment links have different fee structures; in-person swiped transactions usually cost less than keyed-in or online payments.
  • Monthly minimums, setup fees, and early termination penalties vary widely between providers, so comparing the full contract matters more than the headline rate.
  • PCI compliance (data security standards) is required by law if you handle card information, and most providers handle it for you if you use their terminals or hosted payment pages.

How interchange and processing fees work

When a customer swipes or taps a card, you do not pay one flat fee. Instead, multiple fees layer on top of each other. The largest is usually the interchange fee, which goes to the customer's bank (the issuer). Visa and Mastercard set these rates, and they vary by card type, transaction method, and industry. A rewards credit card costs you more to process than a basic debit card. A card you key in by hand costs more than one the customer taps themselves.

On top of interchange, the card networks (Visa, Mastercard, Discover, American Express) charge their own assessment fees—a small percentage of the transaction. Then your processor adds their own markup, which is where they make their money. A typical breakdown on a $100 Visa credit card transaction in a retail store might be: 1.51% interchange (set by Visa), 0.13% assessment (set by Visa), and 0.30% processor markup (set by your provider), totaling about 1.94%. But a keyed-in card or an online payment could cost 2.5% to 3.5% or more.

Processors sometimes quote a single "all-in" rate to make this simpler, but that rate only applies to certain card types. When a customer uses a different card, the actual fee changes. Always ask your processor for a rate sheet that breaks down what you pay for each card type and transaction method.

Comparing payment processors and their fee structures

Payment processors fall into a few categories, and each has a different pricing model. Flat-rate processors (like Square, Stripe, or PayPal) charge the same percentage on every transaction—usually 2.6% to 2.9% plus a per-transaction fee of 10 to 30 cents. You know exactly what you pay, but you pay more than you would with interchange-plus pricing if you process a high volume of basic cards.

Interchange-plus processors charge you the actual interchange rate (which varies) plus a fixed markup—often 0.25% to 0.50% plus a per-transaction fee. This is cheaper if you process mostly basic cards in high volume, but your bill fluctuates month to month because interchange rates change. Traditional merchant services providers (often tied to banks) typically use this model.

Tiered pricing sits between the two. The processor sorts your transactions into tiers (may have access to, mid-may have access to, non-may have access to) based on card type and how the card was processed, and charges a different rate for each tier. This is cheaper than flat-rate for some businesses but harder to predict, and processors sometimes move transactions into higher tiers to increase their revenue.

Beyond the per-transaction fee, check for monthly minimums (some processors charge $10 to $30 per month even if you process nothing), setup fees (usually $0 to $100), PCI compliance fees (often $10 to $20 per month), and early termination penalties (sometimes $200 to $500). These add up quickly and are often where processors make money from low-volume businesses.

Physical terminals versus online payment links

If customers are in front of you, a physical terminal lets them tap, insert, or swipe their card. If they are remote, you need an online payment link or form. The choice affects both your fees and your security obligations.

A point-of-sale terminal (like a Square Reader, Clover, or traditional countertop machine) costs between $0 and $500 upfront, depending on the model. Swiped or tapped transactions usually cost less than keyed-in ones because the card data is encrypted and verified in real time. Most terminals also print receipts and keep a local record of transactions, which is useful if your internet goes down. The downside is that you own or lease the hardware and are responsible for keeping it updated.

Online payment links and forms (hosted by Stripe, Square Online, PayPal, or your processor) let you email a link or embed a form on your website. The customer enters their card details on a page the processor controls, so you never see the full card number. This is simpler for remote payments and lower-risk for PCI compliance, but the fees are usually higher—often 2.9% to 3.5% plus 30 cents per transaction. Some processors also charge a monthly fee for the hosted page.

Many businesses use both: a terminal for in-person sales and a payment link for invoices or online orders. Your processor can usually handle both from the same account.

PCI compliance and data security requirements

PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules that explore to any business that handles credit card information. The rules exist to prevent theft and fraud. If you use a processor's terminal or hosted payment page, the processor handles most of the compliance for you—they encrypt the data and keep it find on their servers.

If you manually key in card numbers or store card data yourself, you become responsible for much stricter security measures: firewalls, encryption, regular security audits, and employee training. This is expensive and risky, and most small businesses avoid it by using a processor's payment form or terminal instead.

Your processor will ask you to sign a PCI compliance agreement. Read it carefully—it usually says they are not liable if your system is breached and you did not follow their security guidelines. Some processors charge a monthly PCI fee (often $10 to $20) to cover their compliance costs. If you process fewer than 20,000 transactions per year, you may be able to avoid a formal audit, but you still have to follow the rules.

Setting up a merchant account with a bank or third-party processor

Your own bank can open a merchant account, but they often charge higher fees and require a longer contract than third-party processors. They also tend to be slower to set up—sometimes two to four weeks. The advantage is that your merchant account and business bank account are in one place, which simplifies accounting and customer service.

Third-party processors (Square, Stripe, PayPal, Toast, Clover) usually set up faster—sometimes in a few days—and charge lower fees. They do not require a long-term contract; most let you cancel month to month. The trade-off is that your merchant account and bank account are separate, so you have to track two different systems.

To open either one, you will need your business license, tax ID (EIN), a business bank account, and sometimes a personal credit check. The processor will ask about your average transaction size, monthly volume, and business type. They use this to assess fraud risk. If you have a history of chargebacks or fraud, some processors will decline you or charge higher fees.

Chargebacks and what happens when a customer disputes a charge

A chargeback happens when a customer tells their bank that a charge was unauthorized or that they did not receive what they paid for. The bank pulls the money back from your merchant account and gives it to the customer. You then have a chance to dispute the chargeback by providing proof (a receipt, email confirmation, tracking number, or signed agreement) that the transaction was legitimate.

If you lose the dispute, you lose the money and usually pay a chargeback fee ($15 to $100) on top of it. If you get too many chargebacks—usually more than 1% of your monthly volume—your processor can close your account or raise your fees. Some processors also require you to buy chargeback insurance or use fraud prevention tools if your chargeback rate is high.

To reduce chargebacks, use clear billing descriptors (so customers recognize the charge), send receipts and confirmation emails, keep records of all transactions, and respond quickly to customer disputes. If a customer calls their bank instead of calling you, you have already lost the ability to resolve it cheaply.

Frequently Asked Questions

Can I accept credit cards without a merchant account?

No. A merchant account is legally required to process credit cards. You can use a third-party processor like Square or Stripe instead of opening one with a bank, but you still have a merchant account—the processor just manages it for you. You cannot legally accept cards without one.

What is the difference between a payment processor and a payment gateway?

A processor handles the entire transaction—they talk to the card networks, check funds, and deposit money into your account. A gateway is just the software that captures the card information and sends it to the processor. Most small businesses use a processor that includes a gateway, so you do not have to think about them separately.

Do I have to sign a long-term contract?

It depends on your processor. Banks often require one to three-year contracts with early termination penalties. Third-party processors like Square and Stripe usually let you cancel month to month with no penalty. Read the contract before you sign—the termination clause is often where hidden costs appear.

What happens if my processor goes out of business?

Your merchant account is separate from the processor. If the processor closes, you can move to a new one and keep accepting cards. Your money in transit may be delayed, but it is usually protected. Ask your processor upfront what happens to pending deposits if they shut down.

Can I negotiate my processing fees?

Yes, especially if you process high volume or have a long history of low chargebacks. Banks and traditional merchant services providers negotiate rates. Flat-rate processors like Square usually do not. If you are paying more than 2.5% all-in, it is worth calling a few processors to see if they will beat your current rate.