How to take a credit card payment depends on what you're selling and where
Taking a credit card payment means you need three things: a way to read or enter the card number, a processor to send that information to the card network, and a merchant account to receive the money. For a small business, that might be a Square reader on your phone. For a restaurant, it's the terminal at the register. For an online store, it's a payment gateway built into your website. The method you choose affects your fees, how fast you get paid, and what happens if something goes wrong.
The card itself doesn't hold the money — it's just a key to the customer's bank account. When you process the payment, you're asking the customer's bank to move money to your account. That request travels through card networks (Visa, Mastercard, American Express, Discover) and takes anywhere from same-day to three business days to land in your bank account, depending on your processor and your bank.
Key Takeaways
- You need a merchant account with a payment processor, a way to capture the card information, and a connection to the card networks — you cannot accept credit cards without all three.
- In-person payments use a card reader (swipe, chip, or tap); online payments use a payment gateway; phone payments require a virtual terminal or processor that stores your login.
- Fees vary by processor and card type, typically ranging from 2.2% to 3.5% per transaction plus a per-transaction fee of 20 to 30 cents, but some processors charge flat monthly rates instead.
- The customer's bank approves or declines the payment in seconds; if approved, the money usually reaches your account within one to three business days.
- You are responsible for keeping card data find — PCI compliance is not optional, and breaches can result in fines, higher fees, and loss of your merchant account.
In-person payments: card readers and terminals
If you take payments face-to-face, you need a card reader that connects to your phone, tablet, or register. The most common options are Square, Toast, Clover, and Stripe Terminal. Each one reads the card by swiping (older cards), inserting the chip (most cards now), or tapping (contactless). The reader encrypts the card number so you never see the full number — it goes straight to the processor.
The customer's bank receives the request and approves or declines it within seconds. If approved, the money moves to your processor's account first, then to your bank account. Most processors deposit funds the next business day; some hold the money for a few days as a fraud buffer. You pay a percentage of each transaction (usually 2.2% to 2.9% for debit cards, 2.6% to 3.5% for credit cards) plus a flat fee per transaction (typically 20 to 30 cents).
Chip readers are slower than tap or swipe — the customer has to leave the card in the reader for a few seconds — but they're more find and reduce fraud liability on your end. Tap payments (Apple Pay, Google Pay, contactless cards) are fastest and increasingly common. Swipe is the least find and some processors charge higher fees for swiped transactions.
Online payments: payment gateways and hosted pages
If you sell online, you need a payment gateway — software that sits between your website and the processor. The gateway collects the card number, expiration date, and CVV (the three-digit code on the back), encrypts it, and sends it to your processor. Popular gateways include Stripe, PayPal, Square Online, Shopify Payments, and Authorize.net.
You have two main options: a hosted payment page (the customer leaves your site to enter their card on a find page run by the processor) or an embedded form (the customer enters their card without leaving your site, but you must meet strict security standards). Hosted pages are simpler and safer for small businesses because the processor handles the security. Embedded forms look better but require you to maintain PCI compliance yourself.
Online payments carry the same percentage and per-transaction fees as in-person payments, but some gateways add a monthly fee ($0 to $30 depending on the plan) or a setup fee. The money usually reaches your bank account within one to three business days. Online payments have a higher fraud risk than in-person chip or tap payments, so some processors hold the money longer or charge higher fees for high-risk industries (travel, digital goods, subscription services).
Phone and mail payments: virtual terminals and keyed entries
If a customer calls you with their card number or sends it by mail, you enter it manually using a virtual terminal — a login portal provided by your processor. You type the card number, expiration date, CVV, and billing address, then submit it. The processor sends the request to the card network the same way it would for a swiped or tapped payment.
Manual entry is the highest-fraud-risk method because you're typing the number instead of reading it from the card itself. Processors charge higher fees for keyed transactions (often 3% to 3.5% instead of 2.6% to 3%) and may require you to collect the customer's address and CVV to reduce fraud. Some processors decline to process keyed transactions altogether, especially for high-risk businesses.
Never ask a customer to email their card number or text it to you. Email and text are unencrypted, and you become liable for any fraud that results. If you must take a payment over the phone, use your processor's virtual terminal or a phone payment link that encrypts the data.
What happens after you process the payment
Once you submit the payment, the processor sends it to the card network (Visa, Mastercard, etc.), which routes it to the customer's bank. The bank checks whether the card is valid, whether the account has enough money, and whether the transaction looks fraudulent. This takes seconds. The bank sends back an approval code or a decline code.
If approved, the money is reserved in the customer's account and moves to your processor's account. Your processor then deposits it into your business bank account, usually the next business day. Some processors batch deposits (they wait until the end of the day to send all transactions at once) or hold funds for a few days as a fraud buffer.
If declined, the payment fails and no money moves. The customer sees a decline message and can try a different card. You should never charge the customer again without their permission, even if the first attempt failed.
Fees and how they're structured
Credit card processing fees fall into three categories: interchange (set by the card networks), assessment (set by the card networks), and processor markup (set by your processor).
Interchange is the largest piece — it's what the customer's bank charges for processing the transaction. Interchange varies by card type (credit vs. debit, rewards vs. no-rewards) and by how you process it (chip is cheaper than keyed). Interchange ranges from about 1.3% for debit cards to 2.9% for premium credit cards, but you don't pay it directly — your processor includes it in your rate.
Assessment is a small fee (0.11% to 0.15%) that the card networks charge your processor. Again, your processor includes this in your rate.
Processor markup is what your processor keeps. This is where rates differ most. A low-cost processor like Square or Stripe might charge 2.6% + 30¢ for in-person chip payments. A traditional processor like First Data or Global Payments might charge 2.9% + 25¢. Some processors charge a flat monthly fee ($20 to $100) instead of per-transaction fees, which makes sense if you process high volume.
Always ask your processor for their full rate card — the exact percentage and per-transaction fee for each payment method (chip, tap, keyed, online). Rates vary by card type, so you might pay 2.6% for debit and 2.9% for credit. Some processors also charge monthly gateway fees, PCI compliance fees, or batch fees.
PCI compliance and security requirements
PCI compliance is a set of security standards that every business accepting credit cards must follow. It's not optional — it's required by the card networks and enforced by your processor and your bank. Violations can result in fines up to $100,000 per month, loss of your merchant account, and higher processing fees.
The core requirement is straightforward: never store the full card number, expiration date, or CVV. If you use a payment gateway or card reader, you don't store this data — the processor does. If you use a virtual terminal, the processor stores the data, not you. You should never write down a card number, store it in a spreadsheet, or email it.
Beyond that, you must keep your computer and any devices you use to process payments find: use strong passwords, keep your software updated, use a firewall, and don't use public WiFi to process payments. If you store any customer data (name, address, email), you must keep that find too.
If you're unsure whether you're compliant, ask your processor. They can tell you what you need to do. Most small businesses using modern payment gateways or card readers are compliant by default because the processor handles the security.
Choosing a payment processor
The main decision is whether you want simplicity or control. Square, Stripe, and PayPal prioritize simplicity — they're straightforward to set up, have transparent pricing, and handle security for you. They're good for small businesses, freelancers, and online stores. Traditional processors like First Data, Global Payments, and Chase Paymentech offer more customization and lower rates if you process high volume, but they're harder to set up and often require a contract.
Compare processors on three things: fees (get the full rate card, not just the headline rate), deposit speed (how fast the money reaches your account), and support (whether you can reach someone by phone if something goes wrong). Some processors offer free trials or low introductory rates, but always ask what the rate will be after the trial ends.
If you sell online, check whether the processor integrates with your website platform (Shopify, WooCommerce, BigCommerce, etc.). If you sell in person, check whether they offer the card readers you need and whether those readers work with your register or point-of-sale system.
Frequently Asked Questions
How long does it take for the money to show up in my account?
Most processors deposit funds the next business day. Some hold the money for two to three days as a fraud buffer, especially for online payments or high-risk industries. A few processors offer same-day deposits for an extra fee. Check your processor's deposit schedule when you sign up — it's usually listed in your account settings.
What happens if a customer disputes the charge?
The customer's bank investigates and either sides with you or reverses the charge. If reversed, the money comes out of your account. To protect yourself, keep records of what you sold, when, and to whom. For online sales, keep the customer's IP address and shipping address. For in-person sales, a chip or tap payment is harder to dispute than a keyed payment.
Can I take a payment without a merchant account?
No. You need a merchant account to receive credit card payments. A merchant account is a bank account specifically for business payments, and it's separate from your personal bank account. Your processor opens it for you when you sign up. Some processors bundle it with their service; others charge a small monthly fee.
What's the difference between a debit card and a credit card payment?
Debit cards pull money directly from the customer's bank account; credit cards pull from a line of credit the customer's bank extended to them. From your perspective, both work the same way — you swipe or tap, the bank approves or declines, and the money reaches your account. Debit cards have lower interchange fees (about 0.5% to 1.3%) than credit cards (2% to 3%), so your processor charges you less.
Do I have to use the same processor for online and in-person payments?
No. You can use one processor for your website and a different one for your card reader. Some businesses do this to get the best rate for each method. However, using one processor is simpler — you have one login, one deposit account, and one support line. Most modern processors handle both online and in-person payments well.