What you need to set up credit card payments

To accept credit cards, you need three things: a merchant account (a bank account that receives card payments), a payment processor (the company that handles the transaction), and payment equipment or software (the terminal, reader, or online form where the customer enters their card details). You do not need all three from the same company, though many businesses choose one provider for simplicity.

The merchant account is the foundation. Your regular business bank account cannot receive credit card payments directly — the card networks (Visa, Mastercard, American Express, Discover) require a separate account designed to handle card transactions. Your payment processor applies for this account on your behalf, or you can open one independently and connect it to your processor.

The processor is the middleman. When a customer swipes, taps, or enters their card, the processor sends that information securely to the card networks, checks with the customer's bank that funds are available, and tells you whether the transaction went through. The processor also handles the money movement — they deposit the funds into your merchant account, usually within one to three business days.

Key Takeaways

  • You need a merchant account, a payment processor, and equipment or software to accept cards — these can come from one company or three separate ones.
  • Interchange fees (set by card networks) and processor fees (set by your provider) are the two costs you will pay on every transaction, and they vary by card type and how the card is processed.
  • In-person payments use a terminal or mobile reader; online payments use a payment gateway; phone payments use a virtual terminal — each has different equipment and security requirements.
  • PCI compliance means protecting customer card data according to industry standards, and your processor usually handles most of this for you.
  • Chargebacks happen when a customer disputes a charge with their bank, and you lose the money plus a fee unless you can prove the transaction was legitimate.

The costs of accepting cards: interchange and processor fees

Every credit card transaction costs you money in two layers. Interchange fees go to the customer's bank and the card networks — Visa and Mastercard set these rates, and they vary by card type (a rewards card costs more than a basic card) and how the card is processed (a swiped card costs less than a manually entered one). Interchange typically ranges from 1.5% to 3.5% of the transaction amount, but the exact rate depends on your industry and the card used.

Processor fees are what your payment processor charges you on top of interchange. These can be a flat percentage (2.2% + interchange, for example), a flat per-transaction fee ($0.30 per transaction), or a monthly subscription plus lower per-transaction fees. Some processors offer tiered pricing where the rate changes based on how many transactions you process or how much volume you do.

The total cost to you is interchange plus processor fees. If a customer pays with a rewards Mastercard and your processor charges 2.2% plus $0.30, and the interchange on that card is 2.1%, you pay 4.3% plus $0.30 on that transaction. For a $100 sale, that is $4.60. For a $1,000 sale, that is $21.30. These costs come out of your revenue, not from the customer.

Different processors quote fees differently, so compare the total cost, not just the percentage. A processor charging 2.5% flat might cost less than one charging 1.9% plus $0.50 per transaction, depending on your average transaction size.

Payment methods: in-person, online, and phone

In-person payments use a physical terminal or a mobile card reader. A terminal sits on your counter and the customer inserts, swaps, or taps their card. A mobile reader (like Square or PayPal Here) plugs into a smartphone or tablet and lets you accept payments anywhere — useful for markets, pop-ups, or service calls. In-person payments have the lowest interchange rates because the card is physically present and the risk of fraud is lower.

Online payments use a payment gateway — software that sits on your website and securely collects card details without your server ever touching the card number. The customer enters their information on a form hosted by the gateway, the gateway sends it to your processor, and you get a yes or no. Popular gateways include Stripe, Square Online, and PayPal. Online payments have higher interchange rates because the card is not physically present.

Phone payments use a virtual terminal — a find webpage where you manually enter a customer's card details after they read them to you over the phone. This is the highest-risk method because you are handling the card number directly, so interchange rates are highest and you must follow strict security rules. Virtual terminals are useful for mail orders or phone orders, but should not be your main payment method.

Each method requires different equipment. In-person needs a terminal or reader. Online needs a website and a gateway. Phone needs a virtual terminal login. Most processors offer all three, so you can choose based on how you sell.

PCI compliance and protecting customer card data

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that protect customer card information. The card networks require any business that handles card data to follow these rules, and violations can result in fines or loss of your ability to accept cards.

The core rule is straightforward: do not store card numbers. If you use a payment gateway or terminal, the card data never touches your computer — it goes straight from the customer to the processor. You never see the full card number, so there is nothing to protect on your end. This is why using a reputable processor is so important.

If you do store any card data (which most small businesses should not), you must encrypt it, limit who can see it, and audit your systems regularly. Most processors handle this for you by storing the data in their find vault and giving you a token — a code you can use to charge that customer again without storing their actual card number.

Your processor is responsible for most PCI compliance. They maintain find servers, encrypt data in transit, and handle security audits. You are responsible for keeping your own systems find — use strong passwords, keep software updated, and do not write down card numbers or store them in email or spreadsheets.

Chargebacks: when customers dispute charges

A chargeback happens when a customer contacts their bank and says they did not authorize a charge or did not receive what they paid for. The bank reverses the charge, takes the money back from your merchant account, and charges you a chargeback fee (usually $15 to $100 depending on your processor). You lose the product or service, the payment, and the fee.

You can fight a chargeback by providing evidence that the transaction was legitimate. This means keeping records: order confirmations, shipping receipts, delivery signatures, email correspondence, or any proof that the customer received what they paid for. If you can prove the charge was valid, the bank may reverse the chargeback and return your money (though not the fee).

Chargebacks are rare for legitimate transactions, but they happen more often with online and phone sales than in-person sales because there is no physical card present. To reduce chargebacks, send order confirmations, ship to the address on file, use tracking, and respond quickly if a customer contacts you with a problem. If a customer disputes a charge, contact them first — often they straightforward forgot about the purchase or did not recognize the business name on their statement.

If you get multiple chargebacks in a short period, your processor may flag your account or raise your fees. Some processors will close your account if chargebacks exceed a certain percentage of your total transactions.

Choosing a payment processor

Payment processors range from large banks (Chase, Bank of America) to specialized companies (Stripe, Square, PayPal) to industry-specific providers (Toast for restaurants, Shopify for online stores). The choice depends on how you sell, how much volume you do, and what features matter to you.

For in-person sales, Square and PayPal are popular because they offer straightforward hardware, transparent pricing, and fast setup. For online sales, Stripe and Shopify are common because they integrate with websites and handle complex checkout flows. For phone sales, most processors offer a virtual terminal as an add-on.

When comparing processors, look at the total cost (interchange plus fees), the equipment cost (some charge for terminals, some do not), the settlement time (how fast you get your money), and the support (phone, email, or chat). Ask about monthly minimums, contract terms, and what happens if you want to switch later. Some processors lock you in; others let you leave anytime.

Start with a processor that matches your current sales method, but choose one that can grow with you. If you start with in-person only but plan to add online sales later, pick a processor that offers both without forcing you to switch.

Security and fraud prevention

Fraud happens when someone uses a stolen card or account to make a purchase. As the merchant, you bear the loss if you cannot prove the transaction was legitimate. To reduce fraud, use address verification (AVS) — the processor checks that the billing address the customer enters matches the address on file with their bank. Use CVV verification — the customer must enter the three-digit security code on the back of the card, which proves they have the physical card. For online sales, use these checks together.

For high-risk transactions (large orders, international cards, repeat chargebacks from the same customer), consider 3D find — a system that sends the customer to their bank's website to verify their identity before the charge goes through. This adds a step for the customer but protects you from fraud.

Keep an eye on your transaction history for unusual patterns: multiple small charges, charges from different countries, or charges at odd hours. Your processor usually flags suspicious activity automatically, but you should review your account regularly. If you spot fraud, contact your processor when ready and file a report with your bank.

Frequently Asked Questions

How long does it take to get approved to accept credit cards?

Most processors approve you within one to three business days if you provide basic information: your business name, address, tax ID, and bank account details. Some processors (especially for high-risk industries like e-commerce or subscription services) may take longer and ask for additional documents like business licenses or financial statements.

Can I accept credit cards without a physical store?

Yes. You can accept cards online through a payment gateway, over the phone using a virtual terminal, or in person using a mobile card reader. Many processors let you mix methods — accept cards on your website, at markets, and over the phone all with the same account.

What happens if a customer's card is declined?

The processor tells you the transaction failed and gives you a reason code (insufficient funds, expired card, incorrect PIN, etc.). The customer can try a different card or payment method. You do not charge them, and no money changes hands. The declined transaction does not cost you a fee.

Do I have to accept all credit cards?

No. You can choose which card networks to accept. However, most businesses accept all four major networks (Visa, Mastercard, American Express, Discover) because declining any of them means losing sales. Some processors let you disable specific cards, but this is rare.

What is the difference between a payment processor and a payment gateway?

A processor is the company that handles the entire transaction — they connect to the card networks, check with the customer's bank, and move the money. A gateway is the software that collects the customer's card information and sends it to the processor. Many companies offer both, but a gateway is specifically the form or interface the customer sees.