On September 7, 2023, Square’s payment systems went down for much of a business day. The breakdown began in the afternoon and was largely rectified by the morning of September 8, and Square’s post-mortem blamed DNS and internal network changes. For roughly fourteen hours, restaurants, salons and online shops that ran on Square were unable to accept card payments, and many proprietors did not realize the issue was with their payment gateway.
Understanding Payment Gateways
The gateway is the software that encrypts the credit card number in the customer’s browser and sends the encrypted transaction to the payment processor. This is the reason why a merchant can accept credit cards without having to know the number. When the gateway fails, another gateway may be used only if the merchant’s payment setup supports it, because the card data is encrypted and securely transmitted to the processor through the configured payment stack.
The gateway is one of three components of every card transaction, and these three are frequently confused because the biggest companies sell them as a single product.
| Component | Function | Providers |
|---|---|---|
| Payment gateway | Encrypts card data at checkout, transmits it for authorization, relays the result | Authorize.Net, Braintree; Stripe, Square, and PayPal include one |
| Payment processor | Routes the authorization through Visa, Mastercard, American Express, or Discover to the issuing bank and settles the funds | Fiserv, Worldpay, Chase Paymentech, Global Payments; Stripe and Adyen act as both gateway and processor |
| Merchant account | Holds settled card funds before deposit to the merchant’s bank account | Acquiring banks such as Wells Fargo Merchant Services and Elavon; Stripe, Square, and PayPal provide a shared one |
On the one hand, the big companies like Stripe, Square and PayPal, are “payment-facilitators”, which means they operate through a master merchant account held at the bank and then sub-accounts for every merchant they service. This is why it takes minutes to sign up and not one to two weeks for bank-issued merchant accounts. On the other hand, this is why they can unilaterally suspend a payment because the merchant account is held by Stripe or PayPal, not the merchant. A merchant with a bank-issued merchant account and its own payment-gateway like Authorize.net has two contracts, two support lines and dealing with payment issues requires negotiating with the bank rather than some risk-algorithm.
How Does a Payment Gateway Work?
An anonymous shopper is buying a pair of running shoes for $60 at a WooCommerce shop at 11 p.m. and gives a Visa card number at the checkout. The gateway encrypts the card number with TLS as soon as it leaves the browser, and most modern gateways exchange it for a random token so that the shop’s server never sees it. The encrypted transaction is sent to the payment processor, the processor forwards it through the Visa network to the card issuer, and the card issuer checks that the card is valid, that $60 of credit is available and that it is appropriate to buy at 11 o’clock from this machine. The bank’s response, a code giving authorization or a denial, returns to the gateway along the same path within two to three seconds.
An authorization is a hold and not a charge. The $60 is locked against the credit card’s available funds, but it doesn’t become a charge until the merchant captures the transaction, usually in the evening, and a customer who cancels the order within an hour sees on the statement only the disappearance of a charge which never went on, and no corresponding retraction, because the charge was never made.
Settlement is slower than authorization. Credited transactions are grouped and transferred, usually at the end of the day, to the merchant bank. Stripe transfers to a US bank account in about two business days by default, Square transfers by the end of the business day or the next day depending on timing, and PayPal transfers to your bank account between one and three days. Before the transfer is made, the service fees are deducted, which is why the sum credited to the merchant’s bank account never equals the total revenue reported in the store’s dashboard.
Benefits of Payment Gateways
A payment gateway is what enables a merchant to accept credit card and wallet payments in the first place. But there are three things that depend on the specific gateway a merchant chooses: how much PCI compliance work the merchant has to do, which customers can pay, and which fraudulent orders go through.
PCI compliance scope
Everybody who saves, processes, or transports card-related data is required to comply with the Payment Card Industry Data Security Standard. Its newest version, 4.0, became obligatory on March 31, 2025. The Standard is enforced through self-audit questionnaires, the merchant having to complete one depending on the route the card data takes. For a merchant who uses a hosted payment gateway where the card number never passes through their own server, a self-audit questionnaire, or SAQ, with about thirty questions asked once a year, is sufficient. An SAQ D, which has more than two hundred questions, is necessary for a merchant whose server handles card data. Version 4.0 also requires every script on the payment page to be inventoried and monitored, a response to the Magecart card-skimming attacks on British Airways and Ticketmaster in 2018. But even SAQ A merchants whose payment pages are loaded with the gateway’s iframe are required to ensure script protections on the pages they control, or rely on the gateway/provider to cover those protections.
Payment method coverage
The payment methods a gateway supports decide which customers are able to shop. The options in a store in the United States for consumers are credit and debit cards, Apple Pay, Google Pay, PayPal, and other common payment methods depending on the merchant. If the average order goes over about $100, buy-now, pay-later methods such as Affirm and Klarna become important. Abroad, the scene is completely different. In the Netherlands, the iDEAL payment system accounts for about 70 percent of all purchases, so a U.S. store that enters the Dutch market with only credit and debit cards is invisible to most of the Dutch. The Germans pay much more often with PayPal, invoice, and SEPA direct debit than with credit cards, and the presence of these payment methods in a gateway is a prerequisite rather than an enhancement.
Fraud screening before fulfillment
Every payment gateway filters its transactions against the Address Verification Service and the card verification value. AVS only compares the numeric parts of the billing address and the postal code with the bank’s records, which means that a legitimate customer who moved last month could trigger an error, and the vast majority of merchants now set AVS to raise a red flag, rather than an outright refusal. Stripe’s Radar and Adyen’s RevenueProtect use machine learning and risk signals such as transaction velocity and device data to score fraud risk. The merchant sets the thresholds at which an order is rejected, held for review, or approved. In the European Union, PSD2 has required strong customer authentication for many online card transactions since 2021, often implemented with 3-D Secure. A payment gateway that supports 3-D Secure 2 transfers the risk of a fraudulent chargeback from the merchant to the issuing bank.
Types of Payment Gateways
Payment gateways can be grouped by checkout flow, and the type helps determine which PCI questionnaire the merchant fills out.
| Type | Where the card number is entered | PCI questionnaire | Products |
|---|---|---|---|
| Hosted | On the gateway provider’s page, after a redirect | SAQ A | PayPal Standard, Stripe Checkout, Square Online Checkout |
| Direct post | On the merchant’s page, posted by the browser directly to the gateway | SAQ A-EP | Authorize.Net Accept.js, Stripe Elements, Braintree Hosted Fields |
| Integrated (self-hosted) | On the merchant’s page, passed through the merchant’s server via API | SAQ D | Custom API integrations |
Hosted payment gateways
On a hosted payment system, the customer clicks “Checkout” on the merchant’s site, is directed to the payment page operated by the payment gateway, enters payment information there, and is returned to the merchant’s site after authorization. But that redirection is also the reason why hosted payment gateways convert a little less than in-house payment systems. Leaving a domain the customer has chosen to trust, the customer is sent to a domain they might not recognize at all, and the merchant’s logo and colors on the host page can only partially remedy this.
Integrated payment gateways
An integrated payment gateway (also called self-hosted or API-hosted) puts the purchase flow on the merchant’s site and the merchant’s code collects the credit card number and sends it to the payment gateway via the gateway’s API. This gives the merchant control over the payment experience, but it may require SAQ A-EP or another applicable PCI questionnaire depending on the implementation. Stripe’s own documentation guides developers toward Stripe Elements so card numbers do not pass through the merchant’s server.
Direct post gateways
A Direct Post gateway is a compromise between the other two. It renders the payment form on the merchant’s site, but the browser sends the credit card details directly to the gateway’s server instead of to the merchant’s server, so that the customer never sees a third-party url and the merchant’s server never sees a credit card number. Authorize.Net’s Direct Post method was the first implementation, its successor Accept.js does the same thing with a JS library, Stripe Elements and Braintree Hosted Fields do the same thing with an iFrame. Direct Post requires front-end development and testing for failure conditions, and is best for merchants who have outgrown redirects but do not want to use a fully outsourced hosted checkout.
How to Choose the Right Payment Gateway
Most payment gateways authorize credit card payments reliably. They differ in terms of their fees, platform-compatibility, and the coverage of payment methods, as well as the way they handle a blocked payment or a failed payment.
1. Native platform integration
A payment gateway plugin for an e-commerce platform has its own development history, and a plugin abandoned by its creators will slowly but surely stop working. In June 2021, WooCommerce v. 5.5 hid the built-in PayPal Standard gateway for new installations and replaced it with the separate PayPal Payments plugin. WooCommerce, Shopify, BigCommerce and Magento each maintain a small list of first-party or vendor-maintained gateway integrations, and a gateway on that list is one that will be maintained by its vendor when the platform changes. A shop that also sells in person should definitely choose a gateway that also handles point of sale transactions. Otherwise, it’s two accounts that never seem to reconcile properly.
2. Payment methods your customers actually use
It is a question of the means of payment that are used by the client, and not the means of payment that the gateway supports. A US-based retailer selling to individuals will need cards, Apple Pay, Google Pay, and PayPal. A B2B seller invoicing other companies will need ACH and net-30 terms and may never do a single Apple Pay transaction. A seller in Germany or the Netherlands needs iDEAL and SEPA direct debit, and a gateway that does not have these is excluded from that market, no matter how good it is.
3. The complete fee schedule
| Provider | U.S. online card rate | Monthly fee | Chargeback fee | Payout timing |
|---|---|---|---|---|
| Stripe | 2.9% + 30¢ | None | $15 | 2 business days |
| Square | 2.9% + 30¢ | None | None | Next business day |
| PayPal (standard checkout) | 3.49% + 49¢ | None | $20 | Immediate to PayPal balance; 1 to 3 days to bank |
| Authorize.Net (gateway only) | Set by your merchant account | $25 | Set by your merchant account | Set by your merchant account |
PayPal set its 3.49 percent plus 49 cents rate in August 2021, when it raised the standard checkout rate from 2.9 percent plus 30 cents, and it has been the highest of the four since. Authorize.Net gateway only: percentage set by your merchant account, $25 monthly fee plus 10 cents per transaction, and chargeback fee and payout timing set by your merchant account.
On a $200 order, 2.9 percent plus 30 cents comes to $6.10, which is 3.05 percent of the sale. On an $8 order the same rate comes to 53 cents, which is about 6.7 percent. The shopkeeper who sells $8 phone covers pays more than twice the effective rate of the merchant who sells $200 coats on the same plan, which is why the smaller shops should negotiate on the fixed fee rather than the percentage. Those with an annual turnover above about $250,000 are often able to get interchange-plus pricing, the card network’s published interchange rate plus a markup of 0.2 to 0.5 percent, and the saving against a flat 2.9 percent is usually half a point or more.
4. Security and compliance
Many reputable payment gateways are PCI DSS compliant, so the remaining question is which PCI questionnaire the merchant must complete, which depends on the gateway type and implementation. In addition, a gateway that tokenizes a saved credit card can manage a subscription and a one-click reorder without ever storing a credit card number. A payment gateway that supports 3-D Secure 2 can help shift liability for certain fraudulent chargebacks from the merchant to the issuer.
5. Capacity for the next two years
If subscriptions are to be offered, the payment gateway must have recurring billing, dunning (the automatic retry of failed renewals), and the update of expiring card numbers from the banks to preserve a subscription through the re-issue of a card. If there is to be an international element, the gateway must include multi-currency settlement and local acquiring for increased authorization rates abroad. Later, it is possible to migrate gateways, but at a high cost. The most expensive part is generally the migration work, including moving payment data and integrations, rather than the transfer of saved customer cards.
6. Support and account stability
One of the most crucial issues, when it comes to payments, is what happens when the payments company itself decides to stop processing. In PayPal’s terms of service it allows them to hold funds for up to 180 days after an account is closed, the duration of the chargeback window. Stripe’s terms of service allow them to reserve funds on the same basis. Both will approve a new account in minutes, and they may reserve funds based on transactional activity. Merchants in industries considered high-risk by the card schemes, such as supplements, travel and CBD, are especially vulnerable. And so they’re better off using a dedicated high-risk provider rather than a service whose own acceptable use policy excludes them.
Popular Payment Gateway Providers
PayPal
PayPal functions as a payment gateway and processor under one login, and its strong consumer recognition can help reduce checkout friction. Braintree, which PayPal acquired in 2013, is a gateway service that is developer-oriented and is a good choice for those who want a full credit card payment form with hosted fields. On WooCommerce it is handled by the PayPal Payments Plugin, which adds the PayPal button, Pay Later messaging, and card fields to an existing order form. PayPal’s 3.49 percent plus 49 cents is the highest of the four payment systems discussed here, and the highest dispute charge is also 20 dollars.
Stripe
Stripe is a favorite payment gateway of many programmers, and the quality of its documentation is a main reason. In Woocommerce it’s used by the WooCommerce Stripe Gateway extension, which supports credit cards, mobile payments, Apple Pay, Google Pay and local methods such as iDEAL and SEPA all from one place. Stripe Radar handles fraud detection, Stripe Billing handles subscriptions and dunning, and standard payouts are typically made within two business days.
Square
Square, who came out with the white card reader plugged into the phone headphone jack, still represents the best solution for a merchant who is selling both in person and on the web, and needs a unified system for stock, reporting and payments. Square’s online store and the Square for WooCommerce plugin are easy to use, and the commission is 2.9% plus 30 cents per payment and it’s paid on the next business day. It is less flexible than Stripe for the implementation of custom payment solutions, and the incident of September 2023 described at the beginning of this article is the main black mark on its otherwise reliable record.
Authorize.Net
Authorize.Net was created in 1996, acquired by CyberSource in 2007, and is now owned by Visa after its purchase of CyberSource in 2010. Its Accept.js library and Accept Hosted Page keep credit card information off the merchant’s servers, and its administrative tools have changed gradually over time.
FAQs
What is the difference between a payment gateway and a payment processor?
The payment gateway accepts payment details from the customer, encrypts them, and transmits them. The payment processor communicates with the card networks and banks, gets the authorization, and transfers the money. Since Stripe, Square, and PayPal perform both of these functions under one account, we use the terms interchangeably.
Is PayPal a payment gateway?
Yes. PayPal is the gateway, the processor and, through its payment facilitator structure, the merchant account, all under one login, and because the merchant account belongs to PayPal rather than the merchant, PayPal can hold a merchant’s funds without a court order.
How does a payment gateway secure transaction data?
TLS encryption protects the card number between the customer’s browser and the gateway. Tokenization changes the card number to an arbitrary token before it reaches the merchant, so that the merchant holds no valuable data on its own server. PCI DSS compliance governs security controls for environments that handle cardholder data, and AVS, CVV verification and 3-D Secure help screen transactions before the sale completes.
Can a small business benefit from a payment gateway?
A hosted payment gateway gives a small store with a couple of employees the same tokenized, encrypted, PCI-compliant checkout as a large store, for a plug-in, two API keys, and a few hours of configuration. The thing a small business must keep an eye on is the percentage a fixed fee per transaction takes from its average order. A 30 cents fee is 0.15 percent of a $200 order and 3.75 percent of an $8 order.
What are the downsides of using a payment gateway?
The percentage charged on payment services can be significant, and the merchant account is provided by the provider and may be held or closed under its acceptable use policy. The alternative to a payment gateway is not selling on the Internet, so the downsides are reasons to read the conditions of use and the tariff list before committing. During billing, the hosted payment gateway can also include a redirect to a different site, which is used by some clients.
Are there alternatives to traditional payment gateways?
Direct bank transfers, ACH in the United States, are the preferred option for wholesale trade and cost only a small fraction of a card transaction, but they settle in one to three days and disputes are mediated through the ACH system rather than credit card chargebacks. Payments by crypto-currency via Coinbase Commerce or BitPay avoid all card fees but are restricted to a certain clientele. Payments between individuals, via Venmo and Zelle, are suitable for small transactions, but they are not built for high volumes and their data storage is limited. Most companies use a conventional payment gateway and add a single one of these methods as an option rather than as a replacement.
A note from TheeDigital
TheeDigital builds ecommerce sites based on WordPress and WooCommerce. Our standard recommendation for a new shop is the Stripe payment gateway for WooCommerce, with PayPal Payments added as a second button for the people who prefer it. We recommend Square when the customer already uses it at a physical shop, and Authorize.net when the customer already has a bank-issued merchant account with negotiated rates. If you want to get help choosing or configuring a payment gateway for a new or existing shop, schedule a consultation.
Would you like a cutting-edge eCommerce Website?
Our team of experts at TheeDigital can help you develop a eCommerce site that’s easy to use, update, looks great and generates sales and leads.
Tags: Digital Marketing • Questions & Answers
Garrett Johnson
Garrett Johnson is a Project Manager at TheeDigital. He helps design and develop lead-converting WordPress websites.
