Ecommerce payments are the systems that let a customer pay online and move that money into the seller’s bank account. Behind a single “Pay” button sit a payment gateway, a payment processor, a card network and two banks, which approve the payment in seconds and settle the money a day or more later.
This guide explains each step, the difference between a gateway, a processor, a merchant account and an all-in-one provider, the common payment methods, subscriptions, fees and security. It ends with a checklist for choosing a provider for a small store.
How an online payment actually moves
Take the most common case, a card payment. Seven parties are involved, even if you only ever see one company’s name.
- The customer enters card details at checkout or taps a wallet such as Apple Pay.
- The merchant — you — runs the site or shop platform where the checkout lives.
- The payment gateway captures the details securely and passes them on, like the card terminal on a shop counter.
- The payment processor routes the transaction between the parties and handles approval and settlement.
- The acquiring bank is the bank on your side, which accepts card payments for you and is responsible for paying you.
- The card network — Visa, Mastercard, American Express and others — carries the request to the right bank and sets the rules.
- The issuing bank is the customer’s bank. It checks the card, the funds and its fraud signals, then approves or declines.
The answer travels back to your checkout in a couple of seconds. That is authorisation: the money is reserved on the card but has not moved. Capture confirms you want it, either straight away or when the order ships. Settlement then moves the funds to your acquirer, and a payout sends them to your business bank account, minus fees, typically one to several business days later.
Payment gateway vs payment processor, and who else is involved
These terms are used loosely, and many companies do several jobs at once. Knowing the roles tells you who controls your money.
- Payment gateway: the technology between your checkout and the payment system. It collects payment details, encrypts them and sends them on, but does not hold your money. Authorize.net is a long-standing standalone example.
- Payment processor: the behind-the-scenes work of moving the transaction between your acquirer, the networks and the issuer. In short, the gateway is the front door and the processor is the plumbing.
- Merchant account: an account with an acquiring bank, in your business’s own name, where card money lands before it is paid out. It involves an application and underwriting review.
- All-in-one provider: Stripe, PayPal and Square are common examples that bundle all of the above into one sign-up, with one dashboard and one fee schedule.
Many all-in-one providers work as payment facilitators: you accept payments under their arrangement with the acquirer rather than holding your own merchant account. Starting is quick, often the same day. The trade-off is that they review your business as it trades, so a sudden change in sales, or selling something their terms restrict, can lead to held payouts or a closed account at short notice. Read their restricted business lists before you build around one.
Ecommerce payment methods compared
Common e-commerce payments examples include paying by card, tapping a phone wallet, paying from a bank account and splitting the cost into instalments.
| Method | How it works | Good for | Watch out for |
|---|---|---|---|
| Credit and debit cards | The issuer approves through the card network | Almost every store | Chargebacks, fraud, cross-border fees on foreign cards |
| Digital wallets (Apple Pay, Google Pay, PayPal) | A saved card or balance is used through a phone, browser or wallet account, often with a fingerprint or face check | Mobile shoppers and faster checkout | Depends on device and browser; PayPal is a separate account with its own terms |
| Bank transfers and pay-by-bank (such as ACH in the US) | Money moves directly from the customer’s bank account | Larger orders, business buyers, invoices | Slower confirmation; some bank debits can be returned days later |
| Buy now, pay later (such as Klarna, Afterpay, Affirm) | The provider pays you up front; the customer repays them in instalments | Higher-priced items | Merchant fees often higher than cards; eligibility varies by market |
| Local methods (such as Interac in Canada, KNET in Kuwait) | Country-specific debit networks, wallets or bank schemes | Markets where cards are not the first choice | Only some providers support each one |
| Cryptocurrency | Paid from a crypto wallet; some processors convert it to ordinary currency at once | Customers who already hold crypto | Price swings, irreversible payments, rules that vary by country |
For most small stores, cards plus the main digital wallets is a sensible start. Add other ecommerce payment methods when your customers ask for them, since each one is more reporting to reconcile and more terms to follow. Local habits matter: cash on delivery is still common in parts of the Gulf, many Kuwaiti shoppers expect KNET, and Canadians often look for Interac.
Recurring and subscription billing
For memberships, refills or monthly services you need recurring billing. The customer authorises the first payment and agrees to future charges, and the provider stores a token so you can charge the card again on schedule.
- Failed payments: cards expire and get replaced. Good systems retry on a sensible schedule, email the customer and use card updater services to refresh stored details.
- Consent and cancellation: say what will be charged, how often and how to stop. Many places have rules on renewal notices and cancellation, and unclear billing is a common source of disputes.
- Plan changes: upgrades, pauses and proration should be handled by the billing system, not by editing charges by hand.
How payment fees work
Rates change and vary by country, so rather than quote any provider’s prices, here is what a fee schedule is actually charging for.
- Per-transaction fee: usually a percentage of the sale plus a small fixed amount, covering interchange (paid to the issuing bank), network fees and the provider’s margin.
- Flat-rate or interchange-plus: flat-rate blends everything into one simple rate; interchange-plus passes the underlying costs through and adds a stated markup.
- Cross-border fees: usually extra when the card was issued in a different country from your account.
- Currency conversion: a fee or margin when the customer pays in one currency and you are paid in another.
- Chargeback fees: when a customer disputes a charge with their bank, the money is pulled back and you usually pay a dispute fee, win or lose.
- Everything else: monthly or gateway fees, payout fees, refunds where the original fee is not returned, and add-ons such as fraud screening.
The fixed part matters on small orders. Purely as an illustration, with a made-up rate of 2.5% plus $0.25 that is not any real provider’s price: a $10 order costs $0.25 + $0.25 = $0.50 in fees, which is 5% of the sale, while a $200 order costs $5.00 + $0.25 = $5.25, about 2.6%. If your orders are small, compare the fixed fee as closely as the percentage.
Chargebacks deserve attention of their own. You can respond with evidence such as tracking and order records, but a high chargeback rate can put you into a card network monitoring programme or get the account closed. Clear descriptions, a recognisable billing name and prompt refunds help.
Security, PCI DSS and checking it is really the customer
PCI DSS in plain terms
PCI DSS, the Payment Card Industry Data Security Standard, is the set of security rules for any business that accepts, stores, processes or transmits card data. It is maintained by the PCI Security Standards Council. Most small merchants complete a yearly self-assessment questionnaire, whose length depends on how close card numbers get to your systems.
That is why hosted payment pages and hosted payment fields help. With a redirect, the customer pays on the provider’s page. With hosted fields, the card boxes on your page are served by the provider, so the number goes straight to them and never touches your server. Either way your compliance burden is far smaller. You are still responsible for the page that loads those fields, so keep your site and plugins updated.
Tokenisation
Tokenisation replaces the card number with a random reference that only means something inside your provider’s system. You can keep a card on file for repeat orders without holding the real number, and stolen tokens are of little use to anyone else. Because tokens live with that provider, ask at the start whether they will export saved cards securely to another provider if you switch.
3-D Secure and strong customer authentication
3-D Secure is the extra check the customer’s bank can run at checkout, such as approving the payment in a banking app. Networks market it as Visa Secure, Mastercard Identity Check and similar, and newer versions let many payments through without the customer noticing. In the European Economic Area and the UK, strong customer authentication rules require it for most online card payments where both the customer’s bank and your acquirer are in the region. Elsewhere it is generally optional but useful, because an authenticated payment often shifts liability for fraud chargebacks to the issuing bank.
Choosing a provider for a small store: a checklist
- Where is your business registered? Providers only onboard businesses in countries they support.
- Where are your customers? Check the provider accepts the cards and local methods they use.
- Which currencies? Decide what customers see, what you are paid in, and what conversion costs.
- How fast are payouts? Ask about the schedule, holding periods for new accounts and any reserve against disputes.
- Does it fit your platform? Look for a maintained official integration, or a clean API for a custom site.
- Do you need subscriptions, deposits or invoices? Confirm they are built in.
- What are all the fees? Get the full schedule in writing, including chargebacks, refunds and conversion.
- Who holds the account? It should be in your business’s legal name, paying into your bank account, with your own owner-level login. A developer can be added as a user but should never be the account holder.
- Can you leave? Check you can export transaction history, customer records and stored card tokens.
The account-holder point is the one people most regret skipping: whoever owns the account holds your revenue and customer payment data.
If you would rather not wire this up yourself, Tecnomation’s e-commerce and payments service sets up checkout and payment gateways on an account you own. It is quoted in writing before work starts and never changes the monthly website price on our pricing page. Connecting payments to stock, accounting or customer records falls under integrations and CRM work.
Questions people ask
What is the difference between a payment gateway and a payment processor?
A payment gateway captures payment details at checkout, encrypts them and sends them on. A payment processor moves the transaction between the banks and card networks and handles settlement. All-in-one providers such as Stripe, PayPal and Square do both.
Do I need a merchant account to accept payments online?
Not necessarily. All-in-one providers let you accept cards under their own arrangement with an acquiring bank. A dedicated merchant account can make sense as you grow, because it is specific to your business and may offer different pricing or terms.
Am I responsible for PCI compliance if I use Stripe or PayPal?
Yes, but far less work is involved. If card details are entered on the provider’s hosted page or fields, you usually complete a short self-assessment questionnaire. You must still keep your own website secure, because a compromised checkout page can be tampered with.
How long does it take to receive money from an online sale?
Approval takes seconds, but the money usually reaches your bank account one to several business days later, depending on the provider, your country and your payout schedule. New accounts sometimes have a longer initial holding period.
Next, list where your customers are and how they like to pay, then shortlist two or three providers that cover those methods and read their full fee schedules and terms. If you want help choosing and setting one up, or want to see how it fits into the costs in our small business website cost guide, get in touch and we will talk it through.
