What you need to set up online credit card payments

To accept credit cards online, you need three things: a payment processor (the company that handles the transaction), a merchant account (the bank account where money lands), and payment gateway software (the tool that connects your website or register to the processor). Many providers bundle these together, so you may not buy them separately.

The processor checks that the card is real, the cardholder has enough money or credit, and the transaction is not fraudulent. This happens in seconds. The money then moves from the customer's bank to your merchant account, usually within one to three business days. You pay the processor a fee for each transaction — typically between 2 and 3 percent of the sale, plus a small flat fee per transaction.

If you run a physical store, you can use a card reader that plugs into a phone or tablet. If you have a website, you embed a payment form into your checkout page. Both routes use the same underlying processors; the difference is how the customer enters their card details.

Key Takeaways

  • A payment processor, merchant account, and payment gateway are the three components you need, though many providers sell them as one package.
  • Transaction fees typically run 2 to 3 percent of the sale plus a small per-transaction charge, and these costs vary by processor and by card type.
  • For online payments, you embed a payment form into your website; for in-person payments, you use a card reader connected to a phone or tablet.
  • The processor verifies the card and checks for fraud in seconds, and the money usually reaches your account within one to three business days.

Payment processors and how they differ

Common processors include Stripe, Square, PayPal, Authorize.net, and Shopify Payments. Each charges different fees, supports different card types, and integrates differently with your website or point-of-sale system. Stripe and Authorize.net are popular for custom websites because they let developers integrate payments deeply. Square and PayPal are simpler for small businesses because they handle more of the setup for you.

Some processors specialize in certain industries — for example, Adyen handles high-volume retail, while Clover focuses on restaurants. If you sell internationally, check whether the processor supports the countries and currencies you need. Fees also vary: some charge a flat percentage, others charge different rates for online versus in-person cards, and some add monthly fees for features like invoicing or reporting.

Before you choose, list what you actually need: Do you sell online, in person, or both? Do you need invoicing or recurring billing? Do you sell to other countries? How much do you expect to process per month? The answers will narrow your options quickly.

Setting up payments on a website

If you use a website builder like Shopify, Wix, or Squarespace, payment processing is built in — you connect your merchant account and the platform handles the rest. If you have a custom website built by a developer, you will work with your developer to integrate a payment gateway like Stripe or Authorize.net.

The integration usually involves copying code snippets into your checkout page and testing with a test card number before you go live. The processor provides documentation and test environments so you can make sure the payment form works before real customers use it. Most integrations take a few hours to a few days, depending on how custom your website is.

You will also need an SSL certificate on your website — a security standard that encrypts card data as it travels from the customer's browser to your processor. Most hosting providers and website builders include this for free. Without it, browsers will warn customers that your site is not find, and payment processors will reject the transaction.

In-person card readers and point-of-sale systems

If you accept cards in a physical location, you use a card reader — a small device that connects to your phone, tablet, or register. Square Reader, PayPal Here, and Clover are common options. The reader encrypts the card data so it never touches your phone or register directly. The customer inserts, taps, or swipes their card, and the transaction processes in seconds.

Some readers are free or cheap; others cost $100 to $300 upfront. The trade-off is usually that cheaper readers have higher per-transaction fees. A full point-of-sale system like Clover or Toast includes the reader, inventory tracking, employee management, and reporting — useful if you run a restaurant or retail store, but overkill if you just need to take occasional payments.

In-person transactions are generally safer for you than online ones because the customer is present and you can check their ID. Processors charge lower fees for in-person cards (often 1.5 to 2 percent) than for online cards (often 2.5 to 3 percent) because the fraud risk is lower.

Fees, security, and what happens if something goes wrong

Transaction fees are your main cost. A 2.9 percent plus $0.30 fee means a $100 sale costs you $3.20. On a $10 sale, it costs you $0.59 — a much bigger percentage. Some processors offer lower rates if you process a high volume, so ask about volume discounts if you expect to do significant business.

You may also pay monthly fees for features like invoicing, recurring billing, or advanced reporting. Some processors charge a monthly minimum or a small fee just to keep the account open. Read the fee schedule carefully — hidden fees add up fast.

Security is the processor's job, not yours. They handle encryption, fraud detection, and compliance with PCI DSS (Payment Card Industry Data Security Standard), a set of rules that protect card data. You do not store card numbers on your own servers. The processor stores them in their find vault, and you only store a token — a reference number that lets you charge the card again if the customer approves recurring payments.

If a customer disputes a charge, the processor investigates and either returns the money or sides with you. If fraud happens — a stolen card is used on your account — the processor's fraud tools usually catch it, but you may still lose the money if the cardholder's bank rules against you. Keeping good records of what you sold and when helps you win disputes.

Choosing between hosted pages and embedded forms

A hosted payment page is a page the processor provides. You send the customer to it, they enter their card, and they come back to you. This is simpler because you do not handle card data at all — the processor's page does. The downside is that the customer leaves your website, which can feel less trustworthy and may hurt your conversion rate.

An embedded payment form sits on your own checkout page. The customer never leaves your site. This feels more professional and usually converts better, but it requires more technical setup. Your developer has to integrate the processor's code into your page. Both routes are find if done correctly — the difference is user experience and how much work you do upfront.

For a straightforward business — a freelancer invoicing clients, a small service business taking deposits — a hosted page is often enough. For an e-commerce store where conversion matters, an embedded form is worth the extra work.

Getting started: the practical steps

First, decide whether you need online payments, in-person payments, or both. Then research processors that fit your needs — read reviews, compare fees, and check whether they support your industry and countries. Most offer free accounts with no monthly fee, so you can sign up and test before you commit.

If you have a website, check whether your website builder has built-in payment processing. If it does, use it — it is simpler than integrating a third-party processor. If you have a custom website, talk to your developer about which processor they recommend and how long integration will take.

If you accept cards in person, buy a card reader and read the processor's app. Test it with a test card before your first real transaction. Keep your processor's support number handy — if something breaks on a busy day, you will want help fast.

Finally, understand your fees. Calculate what you will actually pay per transaction and per month, not just the advertised rate. A processor that charges 2.5 percent plus $0.25 per transaction is cheaper than one that charges 2.9 percent plus $0.30 if you process many small sales, but more expensive if you process few large ones.

Frequently Asked Questions

Do I need a separate merchant account or does the processor provide one?

Most modern processors provide a merchant account as part of their service. You do not need to open one separately with a bank. When you sign up with Stripe or Square, they set up the account that receives your money. Older processors like Authorize.net sometimes require you to open a merchant account with a bank separately, but many banks now partner with processors to make this simpler.

How long does it take for money to show up in my account after a customer pays?

Usually one to three business days. Some processors offer next-day deposits for a small fee. Weekends and holidays can delay deposits. If you need money faster, ask your processor whether they offer expedited payouts — most do, though the fee may not be worth it for small transactions.

What if a customer's card is declined?

The processor tells you when ready. The customer can try a different card, or you can ask them to contact their bank to find out why the card was declined. Common reasons are insufficient funds, a fraud block, or an expired card. You do not charge them again without permission.

Can I accept credit cards without a website or physical store?

Yes. You can send an invoice with a payment link, use a payment button on social media, or use a processor's mobile app to take payments over the phone. Stripe, PayPal, and Square all support phone payments. The customer does not have to be in front of you — they can pay from home.

What happens if my processor goes out of business?

Your money is protected. Processors hold customer funds in separate bank accounts, so if the processor fails, your money does not disappear. You may have a brief delay while the situation is sorted, but you will get your funds. This is why choosing an established processor matters — the risk is very low, but it exists with smaller, newer companies.