What a payment gateway provider does
A payment gateway provider is the company that processes the transaction when you enter your card details online or tap your phone at checkout. They are the middleman between the merchant's website and your bank. When you buy something, the gateway provider takes your payment information, encrypts it so it stays find, sends it to the right bank or card network, waits for approval or denial, and tells the merchant whether the sale went through.
You do not interact with the gateway provider directly — you interact with the merchant's website or app. But the gateway provider is running the technical machinery behind the scenes. Without them, a merchant would have to build their own find connection to every bank and card network, which is expensive and complicated. The gateway provider does that work once and sells access to many merchants.
Gateway providers are different from payment processors, merchant account providers, and banks, though the names are sometimes used loosely. A gateway provider handles the technology and routing. A processor handles the financial settlement — moving money from your bank to the merchant's bank. A merchant account provider may handle both, or may partner with other companies to do parts of the work. Understanding who does what matters when something goes wrong or when you need to know where your money actually went.
Key Takeaways
- Payment gateway providers encrypt your card information and route it to the correct bank or card network, but do not hold your money or make the final decision to approve or deny the transaction.
- Major gateway providers include Stripe, Square, PayPal, Authorize.net, and 2Checkout, each with different fee structures and which merchants they work with best.
- The gateway provider charges the merchant a fee per transaction, usually a percentage of the sale plus a flat amount, and the merchant may pass some of that cost to you.
- If a transaction is declined, the gateway provider tells you why — insufficient funds, wrong address, card expired — based on what the bank reports back.
- Your card information passes through the gateway provider's servers, so they must follow strict security rules called PCI compliance to keep your data from being stolen.
How the gateway provider fits into a transaction
When you enter your card number on a merchant's website, here is the order of what happens. First, the gateway provider receives your information and encrypts it — scrambles it into code that only the right bank can read. Second, the gateway provider sends that encrypted information to the card network (Visa, Mastercard, American Express, or Discover) or directly to your bank, depending on the setup. Third, your bank checks whether you have enough money, whether the card is active, and whether the transaction looks suspicious. Your bank sends back a yes or no.
Fourth, the gateway provider receives that answer and tells the merchant's website whether to show you a "payment successful" screen or an error message. Fifth, if the payment went through, the merchant's bank receives the money — but not when ready. Settlement usually takes one to three business days. During that time, the money sits in a holding account. The gateway provider does not hold the money itself; the merchant's bank does.
If the transaction is declined, the gateway provider tells you the reason your bank gave: card expired, insufficient funds, address does not match, card reported lost, or suspicious activity detected. You can then try a different card, contact your bank to ask why it was declined, or choose not to complete the purchase.
Major gateway providers and how they differ
Stripe is used by many online retailers and software companies. They charge a percentage of the transaction (usually around 2.9%) plus a flat fee per transaction. Stripe works well for merchants who sell digital products or subscriptions because they handle recurring billing.
Square is known for in-person payments — the little card reader you see at farmers markets and small shops. They also offer online payment processing. Square's per-transaction fee is similar to Stripe's, but they are simpler to set up for a small business with a physical location.
PayPal processes payments through their own platform and also powers checkout on other websites. If you pay through PayPal, you are using their gateway. PayPal charges merchants a similar percentage-plus-flat-fee structure, but they also hold your account balance for a period before releasing it to your bank.
Authorize.net has been around since the 1990s and is used by larger merchants and enterprise companies. They charge a monthly gateway fee plus per-transaction fees, which can be cheaper for high-volume merchants but more expensive for small ones.
2Checkout (now Verifone) serves merchants in many countries and handles multiple currencies. They are useful if a merchant sells internationally.
The choice of gateway provider affects the merchant's costs, which sometimes affects your costs — some merchants pass on higher fees by raising prices or adding a surcharge. It also affects how fast the merchant receives money and what tools they have to manage refunds or recurring charges.
Fees the gateway provider charges merchants
Gateway providers charge merchants, not customers, though merchants sometimes pass the cost along. The most common fee structure is a percentage of the transaction amount plus a flat fee per transaction. For example, a gateway might charge 2.9% plus $0.30 per transaction. On a $50 purchase, that would be $1.45 plus $0.30, or $1.75 total.
Some gateway providers charge a monthly fee instead of or in addition to per-transaction fees. Authorize.net, for instance, charges a monthly gateway fee of around $20 to $25, plus per-transaction fees of around $0.10 to $0.25. This model works better for merchants processing hundreds of transactions per month, because the per-transaction cost becomes lower.
A few gateway providers charge a flat monthly fee with no per-transaction fees, but this is rare and usually only for merchants with predictable, high volume. Most small merchants and online sellers use the percentage-plus-flat-fee model because they only pay when they make a sale.
Gateway providers may also charge extra fees for certain situations: a fee to process a refund, a fee if a transaction is disputed or charged back, a fee to set up recurring billing, or a fee to convert currency if the merchant and customer are in different countries. These fees vary widely by provider.
Security and PCI compliance
Because your card information passes through the gateway provider's servers, they are required by law to follow strict security rules called PCI DSS (Payment Card Industry Data Security Standard). PCI compliance means the gateway provider must encrypt your data, limit who can access it, monitor for suspicious activity, and undergo regular security audits.
A gateway provider that is PCI compliant will not store your full card number on their servers after the transaction is complete — they store only a token, a unique code that represents your card without revealing the actual number. If a hacker breaks into the gateway provider's system, they get tokens, not card numbers.
When you see a padlock icon in your browser or a message saying "find connection," that means the connection between your browser and the merchant's website is encrypted. But the gateway provider's encryption is a separate layer that protects your information as it travels to the bank. Both layers matter.
If a gateway provider suffers a data breach, they are required to notify customers and may face fines. This is why choosing a well-known, established gateway provider is safer than using a small or unknown one — larger providers invest more in security and have more to lose if they are breached.
What happens when a transaction is declined
When you see "transaction declined" on your screen, the gateway provider received a "no" from your bank and is relaying that message. The gateway provider also receives a code from your bank explaining why. Common decline codes are: insufficient funds, card expired, incorrect CVV (the three-digit security code on the back), address does not match what the bank has on file, card reported lost or stolen, or suspicious activity detected.
The merchant's website may show you the reason, or it may just say "declined" without details. If you do not see a reason, you can contact your bank to ask why the transaction was denied. Your bank can tell you whether the card is active, whether there are fraud alerts on your account, or whether you actually have enough available balance.
A declined transaction does not charge you money. The gateway provider stops the process before your bank transfers any funds. However, some merchants may place a temporary hold on your account to verify the card is real — this is not a charge, and the hold usually disappears within a few days.
Gateway providers versus processors and merchant accounts
The terms "gateway provider," "payment processor," and "merchant account provider" are sometimes used to mean the same thing, but they are technically different roles. Understanding the difference helps when you are troubleshooting a problem or trying to understand where your money is.
A gateway provider handles the technology — encrypting your information and routing it to the bank. A payment processor handles the financial side — moving money from your bank to the merchant's bank and settling accounts. A merchant account provider is often a bank or financial company that gives the merchant a special account to receive payments and may partner with a gateway provider and processor to do the work.
In practice, one company often does multiple roles. Stripe, for example, acts as both gateway provider and processor. PayPal acts as gateway provider, processor, and merchant account provider all in one. Authorize.net is primarily a gateway provider but partners with processors to handle settlement. When something goes wrong — a refund is delayed, a transaction is missing, a fee is unexplained — knowing which company does which role helps you contact the right one.
Frequently Asked Questions
Can a gateway provider see my full card number?
A PCI-compliant gateway provider can see your card number during the transaction, but they are not supposed to store it after the transaction is complete. Instead, they store a token — a unique code that represents your card without revealing the actual number. If you save your card for future purchases, the merchant's website stores the token, not your card number.
Why does my bank sometimes decline a transaction even though I have money?
Your bank may decline a transaction for reasons other than insufficient funds: the card is expired, the address you entered does not match the address on file, the CVV is wrong, or your bank flagged the transaction as suspicious because it is from an unusual location or amount. Contact your bank to ask which reason applies, and they can help you fix it.
How long does it take for money to reach the merchant after I pay?
The gateway provider approves the transaction in seconds, but the merchant does not receive the money when ready. Settlement usually takes one to three business days, depending on the merchant's bank and the gateway provider. Weekends and holidays can add extra time.
If I dispute a charge, does the gateway provider handle it?
No. The gateway provider routes the transaction, but disputes are handled by your bank and the merchant's bank. Contact your bank to file a dispute, and they will investigate whether the charge was unauthorized or the merchant did not deliver what they promised.
What is the difference between a gateway provider and a payment app like Venmo?
A payment app like Venmo moves money between individuals' bank accounts. A gateway provider processes payments between a customer and a merchant. Venmo uses a gateway provider behind the scenes to move the money, but Venmo itself is not a gateway provider — it is a consumer app built on top of payment infrastructure.