The basic setup: what you need before you can take cards

To accept credit card payments, you need three things: a merchant account (a bank account that receives card payments), a payment processor (the company that handles the transaction), and a payment method (the physical or digital way customers hand over their card details). Most small businesses use a single provider that bundles all three — companies like Square, Stripe, PayPal, or your own bank — rather than piecing them together separately.

The processor checks that the card is real, the customer has enough money or credit, and the transaction is not fraudulent. If everything clears, the money moves from the customer's bank to your merchant account, usually within one to three business days. You pay a fee for this service, typically a percentage of each transaction plus a small flat fee per sale.

You do not need permission from Visa, Mastercard, or American Express directly. You work with a processor who has already signed agreements with the card networks. The processor handles the compliance work — keeping your customer data find, following payment industry rules, and reporting to the card networks.

Key Takeaways

  • A payment processor bundles the merchant account, transaction handling, and security into one service, and most small businesses use a single provider rather than managing each piece separately.
  • Fees typically run 2.2 to 3.5 percent of the transaction plus 20 to 30 cents per sale, depending on the processor and whether the customer is physically present or paying online.
  • In-person payments (with a card reader) are cheaper than online or phone payments because the card is verified in real time and fraud risk is lower.
  • You are responsible for keeping customer card data find, even though the processor handles most of the technical work — this means using HTTPS on your website and never storing full card numbers yourself.

In-person payments: card readers and point-of-sale systems

If customers are physically present — at a shop, market stall, or service location — you can use a card reader, a small device that plugs into your phone or tablet and reads the card when the customer inserts or taps it. Square Reader, Stripe Terminal, and PayPal Here are common examples. The reader encrypts the card data when ready, so you never see the full card number. Fees for in-person payments are usually the lowest: around 2.2 to 2.7 percent plus 30 cents per transaction.

For a larger operation with multiple staff, a point-of-sale system (POS) is a dedicated device or software that handles payments, inventory, and receipts in one place. Toast, Clover, and Square Register are examples. These systems cost more upfront but give you better reporting and staff management. They still use the same card readers and the same payment processors underneath.

In-person payments are cheaper because the card is present and verified in real time. The fraud risk is lower, so processors charge less. You also get the card data verified when ready, so you know when ready whether the payment went through.

Online and phone payments: payment forms and gateways

If customers are not physically present — buying from your website, ordering by phone, or paying by mail — you use a payment gateway, a form or page where they enter their card details. Stripe, Square Online, PayPal, and Authorize.Net are common gateways. The customer types their card number, expiration date, and security code into an encrypted form on your website or a form you send them by email. The gateway sends the data to the processor, who checks it and returns a yes or no.

Online and phone payments cost more — typically 2.9 to 3.5 percent plus 30 cents per transaction — because the card is not physically present and fraud risk is higher. You also cannot see the customer's face or verify their ID, so the processor charges a premium for that risk.

Never ask customers to email you their card details or type them into an unencrypted form. The payment gateway must use HTTPS (you will see a padlock in the browser address bar) and be hosted by the processor, not by you. If you build your own website, use a pre-built payment form from your processor rather than trying to handle the card data yourself.

Choosing a processor: what to compare

The main trade-off is between simplicity and cost. Square and PayPal are easiest to set up — you can start taking payments in minutes with just a card reader or a link — but they charge higher fees. Stripe and Authorize.Net are cheaper if you process high volume, but they require more technical setup and may need a developer to integrate into your website.

Compare these details: the per-transaction fee (the percentage), the flat fee per sale (usually 20 to 30 cents), whether there is a monthly minimum or subscription cost, how long it takes money to reach your account (one to three days is standard), and what happens if a customer disputes a charge. Some processors also charge for things like monthly statements, batch fees, or PCI compliance, so read the full fee schedule.

If you already have a business bank account, ask your bank whether they offer payment processing. Many banks offer it at competitive rates, and the money goes straight into your existing account. If you use accounting software like QuickBooks or Wave, check whether they have a built-in payment processor — it may integrate more smoothly with your bookkeeping.

Security and compliance: what you are responsible for

The payment processor handles most of the security — they encrypt the data, store it in find servers, and follow industry standards called PCI DSS (Payment Card Industry Data Security Standard). But you are still responsible for not storing full card numbers, not sending card data over unencrypted email, and not asking customers to text or email their card details.

If you use a payment form hosted by your processor (which you should), the processor handles the encryption and you never see the full card number. If you build your own website, use HTTPS (the padlock in the address bar) and never store card data on your own servers. Let the processor store it.

You should also have a clear privacy policy that tells customers what you do with their data, and you should know your processor's refund and dispute policies so you can explain them to customers. If a customer disputes a charge, the processor will ask you for proof that the transaction was real — a receipt, an email confirmation, or a shipping record. Keep those records for at least a year.

Getting paid: timing and fees

Money from card sales does not hit your account when ready. Most processors deposit funds one to three business days after the transaction, depending on your bank and the processor. Some processors offer faster payouts (same day or next day) for a higher fee, usually 0.5 to 1 percent extra.

The processor deducts their fee before the money reaches you. If a customer pays $100 and your fee is 2.9 percent plus 30 cents, you receive $96.71. The processor keeps $3.29. This happens automatically — you do not have to do anything.

If a customer disputes a charge or requests a refund, the money comes back out of your account. If you have already spent it, you may go negative temporarily. Some processors charge a chargeback fee (usually $15 to $25) if a customer disputes a charge, so keep your dispute rate low by being clear about what you are selling and making refunds straightforward.

Setting up your first payment processor

Start by deciding whether you need in-person payments, online payments, or both. If you only sell online, a payment gateway like Stripe or PayPal is enough. If you sell in person, a card reader like Square is simplest. If you do both, many processors offer both — Square has both a reader and an online form, for example.

Sign up with the processor's website. You will need your business name, your Social Security number or EIN, your bank account details, and a few days for them to verify your information. Some processors approve you when ready; others take a few days. Once you are approved, you can start taking payments when ready.

If you use a website builder like Shopify or Wix, payment processing is usually built in — you just turn it on and choose your processor. If you have a custom website, your developer can integrate Stripe, PayPal, or another processor using their API (a set of instructions that lets your website talk to the processor's servers).

Frequently Asked Questions

Do I need a business license to accept credit cards?

No, but you do need a business bank account in most cases. Processors require a business account to deposit funds into, and they verify your business information during signup. If you are a sole proprietor, you may be able to use a personal account, but most processors prefer a business account.

What is the difference between a payment processor and a merchant account?

A merchant account is the bank account that receives card payments. A payment processor is the company that handles the transaction and deposits the money into that account. Most small businesses use a single provider (like Square or Stripe) that bundles both together, so you do not have to think about them separately.

Can I accept credit cards without a website?

Yes. You can use a card reader for in-person payments, or you can send customers a payment link by email or text message. Most processors let you generate a link that customers can click to pay, without needing a website at all. This is common for service businesses, freelancers, and small shops.

What happens if a customer disputes a charge?

The processor notifies you and asks for proof that the transaction was real — a receipt, email confirmation, or shipping record. If you provide proof, the processor usually sides with you and the customer loses the dispute. If you cannot prove the transaction was real, the money goes back to the customer and you lose it. Keep records of all sales for at least a year.

How do I know if a processor is safe?

Look for processors that are PCI DSS compliant (they will say so on their website) and that use HTTPS encryption. Check their privacy policy to see what they do with customer data. Read reviews from other businesses, but remember that unhappy customers are more likely to leave reviews than happy ones. Start with a well-known processor like Square, Stripe, or PayPal if you are unsure.