How Payment Gateways Work

A payment gateway lets businesses accept payments through their website or app. When a customer enters their card details at checkout, the gateway securely sends the payment information for approval and returns the result, usually within seconds.

It’s similar to a card machine in a shop, except the customer pays online rather than at a physical till.

Payment gateways are used by online retailers, subscription services, restaurants taking online orders and other businesses that accept digital payments. They handle the connection between checkout and the payment systems behind it, but they’re only one part of the process.

Here’s how they work, what they cost and how to choose one for a business.

What Is a Payment Gateway?

A payment gateway is a service that securely transfers payment information between a business’s checkout and the systems responsible for processing the transaction.

When someone pays online, the gateway captures their payment details, protects the information during transmission and sends the request for authorisation. Once the payment has been approved or declined, it sends the result back to the website.

The customer sees a confirmation or an error message, while the business receives the transaction status.

Atoa is an example of payment gateway provider. Depending on the service, businesses can accept several digital payment methods, including debit cards, credit cards and digital wallets.

How Does a Payment Gateway Work?

Most online card payments involve several parties: the customer, the business, the payment gateway, the processor, the card network and the banks involved.

The entire authorisation process usually takes only a few seconds.

Step 1: The Customer Enters Their Payment Details

The customer chooses a product or service and proceeds to checkout.

They enter their card information or select a saved card or digital wallet. The payment details are collected through the checkout’s secure payment form.

Step 2: The Gateway Sends the Payment Request

The gateway securely transmits the payment information to the processor.

Encryption and other security measures protect sensitive details as they’re passed between the systems involved.

Step 3: The Processor Contacts the Card Network

The payment processor routes the transaction through the appropriate card network, such as Visa or Mastercard.

The request then reaches the customer’s bank, known as the issuing bank.

Step 4: The Customer’s Bank Checks the Payment

The issuing bank checks whether the transaction can be approved.

This may involve checking available funds, card status and possible fraud.

For many UK online card payments, Strong Customer Authentication also applies. The customer might need to confirm the purchase in their banking app or complete another verification step.

Step 5: The Payment Is Approved or Declined

The issuing bank sends its decision back through the payment network and processor.

The gateway passes the result to the checkout, where the customer sees whether the payment was successful.

Step 6: The Business Receives the Funds

An approved card payment doesn’t mean the money has already reached the business’s bank account.

The funds are transferred through the settlement process, with the payout timing depending on the acquiring bank or payment provider.

This is where the distinction between acquiring banks and issuing banks matters. The issuing bank handles the customer’s side of the transaction, while the acquirer handles card payment acceptance and settlement for the business.

Payment Gateway vs Merchant Account

A payment gateway and a merchant account have different jobs.

The gateway securely sends payment information for processing and returns the transaction result.

A merchant account is an account used in card acquiring arrangements to receive funds from card transactions before they’re paid out to the business.

Traditionally, businesses arranged these services separately. They signed up with a gateway provider to accept payments online and an acquiring bank to handle the funds.

Today, many payment providers combine these services.

This means a business can often accept card payments without opening a separate merchant account. The provider manages the underlying acquiring arrangement.

Payment Gateway vs Payment Processor

The terms payment gateway and payment processor are often used interchangeably because many providers offer both.

Technically, they perform different functions.

The payment gateway handles the secure exchange of payment information between the checkout and the processing system.

The payment processor routes the transaction between the relevant payment networks and financial institutions.

For example, when a customer pays £50 for an online order, the gateway passes the payment request to the processor. The processor communicates with the card network and the issuing bank to obtain authorisation.

The gateway then returns the result to the website.

Businesses don’t always need to buy these services separately. Many providers include both under one agreement.

The differences are explained further in our article on payment gateways and payment processors.

Payment Gateway vs Payment Terminal

A payment gateway handles payments made through websites, apps and online payment pages.

A payment terminal is the device used to accept card payments in person.

For example, a customer paying on an ecommerce website uses an online checkout connected to a payment gateway. Someone paying at a restaurant counter might tap their card or phone on a payment terminal.

Both involve payment authorisation, but the way the payment information is captured differs.

Businesses selling online and in person may use both systems. Some providers also combine online and in-store transaction reporting, making it easier to keep track of sales across channels.

Hosted vs Self-Hosted Payment Gateways

Payment gateways can be integrated into a website in different ways.

Two common approaches are hosted and self-hosted checkouts. The main differences are where customers enter their payment details, how much control the business has over the checkout and what security responsibilities it takes on.

What Is a Hosted Payment Gateway?

A hosted payment gateway lets customers enter their payment details through a payment page or form provided by the gateway.

The customer might be redirected to the provider’s website or complete payment through a secure form embedded in the merchant’s checkout.

In either case, the provider handles the payment form and the sensitive card information it collects.

Hosted gateways are often easier for smaller businesses to set up because they don’t require the merchant to build its own card payment system.

Advantages of hosted payment gateways

• Simpler setup: Many providers offer plugins or ready-made checkout pages.
• Less development work: The business doesn’t need to build and maintain its own payment form.
• Reduced PCI DSS scope: Keeping card details within the provider’s payment form can reduce the merchant’s security assessment requirements, depending on the integration.
• Provider-managed maintenance: Updates to the hosted payment page are generally handled by the provider.

The main limitation is checkout customisation. Businesses may have less control over the appearance and behaviour of a provider-hosted payment form.

Hosted payment options can also work alongside existing POS systems and mobile POS systems, depending on the provider’s integrations.

What Is a Self-Hosted Payment Gateway?

With a self-hosted checkout, the business has greater control over how the payment form appears and functions on its website.

The website communicates with the payment provider through an API to process transactions.

This approach is often used by businesses with developers who need more control over checkout design or want to connect payments to custom software.

However, the technical and security responsibilities depend on how the payment details are collected.

If card information passes through the merchant’s own systems, the business may face more extensive PCI DSS requirements.

Advantages and considerations

• More checkout control: Businesses can tailor the payment experience to their website.
• Custom integrations: Developers can connect payments to internal systems and specialised checkout processes.
• Additional development work: Building and maintaining the integration requires technical resources.
• Greater security responsibility: The merchant’s PCI DSS obligations may increase depending on how card data is handled.

Self-hosting doesn’t automatically reduce transaction fees. Development, maintenance and compliance costs also need to be considered.

How to Add a Payment Gateway to Your Website

The setup process varies by provider and ecommerce platform, but most integrations follow a similar pattern.

1. Choose a provider by checking the payment methods, pricing and integration options before signing up.
2. Create a business account. The provider may ask for company details, identification and bank account information.
3. Connect the gateway. Use an available ecommerce plugin, a hosted checkout or an API integration.
4. Configure payment settings. Set up supported payment methods, checkout behaviour and any required authentication.
5. Test the checkout for successful and failed payments, refunds and how transactions appear in your records.
6. Start accepting payments. Once the integration is ready, switch to live processing and review transactions regularly.

Shopify, WooCommerce and Magento support payment integrations, although the setup differs between platforms.

Key takeaways

Ultimately, payment gateways play a pivotal role in how smoothly your customers complete transactions on your website, and the right choice can be instrumental to your success. Your choice between hosted and self-hosted payment gateways should align with your business size, your team’s tech capabilities, and any customisation needs.

Frequently asked questions

Why do I need a payment gateway?

Payment gateways act as a cash register for your online store. You need one to accept payments online, making it easy and convenient for your customers to pay for goods and services.

How do I choose the right payment gateway?

Consider factors like transaction fees, security, and the gateway’s compatibility with your e-commerce platform. You’ll want one that integrates smoothly with your website for a seamless user experience.

Do I need a merchant account, too?

Not always. Some payment gateways offer an all-in-one solution where you don’t need a separate merchant account.

Are payment gateways secure?

Payment gateways use encryption and tight security measures to protect sensitive data, ensuring you and your customers are safe from fraud or data breaches.

What is PCI DSS compliance?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of industry-wide requirements that protect your business and customers when taking payments.

What fees can I expect to pay?

Fees can vary between gateways but typically include a transaction fee, a percentage of the sale, and sometimes a monthly fee. Read the fine print to understand all costs, and always choose a gateway that fits your budget.

Can I switch to a different payment gateway?

You can switch if you’re unsatisfied with your current gateway but planning is essential to avoid any disruption to your business.

The bottom line

Payment gateways are essential in e-commerce. They provide a secure, convenient, and affordable way to process payments and offer several other benefits to help businesses grow and succeed.

If you’ve already got a payment gateway and want to add instant payments at checkout, then we can help. Our e-commerce plugin delivers instant low-fee payments directly from the customer’s bank account to yours, reducing the need for complex merchant accounts and payment gateways. It can also be integrated with point-of-sale for seamless checkouts. Find out more WooCommerce integration docs.