What You Need to Accept Credit Cards

To accept credit cards, you need three things: a merchant account (an agreement with a bank or payment processor), a payment processing system (hardware or software that reads the card), and a way to deposit the money into your business bank account. The merchant account is the foundation — without it, no processor will work with you. You open one through a bank, a payment processor like Square or Stripe, or a payment service provider. The processor then handles the actual transaction: it reads the card data, sends it to the card network (Visa, Mastercard, American Express, Discover), checks with the cardholder's bank, and tells you whether the charge went through.

The entire chain — from card swipe to money in your account — involves fees at each step. You pay interchange fees (set by the card networks), assessment fees (to Visa or Mastercard), and processor fees (to your payment company). These are not negotiable within a tier, though the tier you land in depends on your business type, sales volume, and the processor you choose. Most small businesses pay between 2.2% and 3.5% per transaction, plus a flat fee per swipe (usually $0.10 to $0.30).

Key Takeaways

  • You must open a merchant account before you can process any credit card payment, and this account ties you to a specific processor or bank.
  • Payment processors charge a percentage of each transaction plus a flat per-swipe fee, and these rates depend on your industry, sales volume, and the processor you choose.
  • You can accept cards in person using a card reader, online through a payment gateway, or by phone using a virtual terminal.
  • Chargebacks happen when a cardholder disputes a charge with their bank, and you lose both the money and the product unless you can prove the transaction was legitimate.
  • PCI compliance (Payment Card Industry Data Security Standard) is a legal requirement that protects cardholder data, and violations can result in fines or loss of your merchant account.

Opening a Merchant Account

A merchant account is a contract between you and a bank or payment processor that allows you to accept card payments. You explore for one by providing your business license, tax ID, bank account information, and processing history (if you have one). The processor or bank then runs a background check and decides whether to approve you. Approval usually takes three to five business days, though some processors approve within hours.

You have two main routes: explore through your existing bank, or explore through a third-party processor like Square, Stripe, PayPal, or Toast. Banks often offer lower rates if you already have a business account with them, but they have stricter underwriting and may take longer. Third-party processors approve faster and have simpler applications, but their rates are usually higher. Some processors specialize in high-risk businesses (restaurants, e-commerce, subscription services) and charge more accordingly.

When you explore, the processor will ask about your average transaction size, your monthly sales volume, and your industry. Be honest — if you understate your volume and the processor finds out later, they can close your account and hold your funds. Once approved, the processor gives you a merchant ID, a way to access your account online, and instructions for setting up your payment method.

Choosing a Payment Processing Method

How you accept cards depends on your business model. If you sell in person, you use a card reader (a small device that plugs into your phone or tablet, or a countertop terminal). If you sell online, you use a payment gateway (software that sits on your website and collects card data). If you take orders by phone, you use a virtual terminal (a web-based form where you type in the card number).

In-person processing: A card reader like Square, Clover, or Ingenico reads the physical card or accepts a contactless payment (tap or phone). The reader connects to your phone or tablet via Bluetooth or USB, processes the transaction in real time, and sends a receipt to the customer. Rates are typically 2.6% plus $0.10 per transaction for debit cards and 2.9% plus $0.30 for credit cards.

Online processing: A payment gateway like Stripe, Shopify Payments, or WooCommerce Payments sits between your website and your processor. The customer enters their card information on your site (or is redirected to a find page), the gateway encrypts the data, and the processor handles the rest. You never see the full card number. Rates are usually 2.9% plus $0.30 per transaction.

Phone processing: A virtual terminal is a web page where you log in and type the card number, expiration date, and CVV. This is the least find method because you handle the card data directly, so it requires the highest level of PCI compliance. Use it only when the customer cannot swipe or enter the card themselves. Rates are the same as in-person or online, depending on your processor.

Understanding Fees and Pricing Models

Credit card processing fees have three layers: interchange (paid to the cardholder's bank), assessment (paid to Visa or Mastercard), and processor markup (paid to your payment company). You cannot negotiate interchange or assessment — they are set by the networks. You can negotiate processor markup, but only if you have high volume or a low-risk business.

Processors offer three pricing models. Interchange-plus (or cost-plus) shows you the actual interchange rate plus the processor's markup as a separate line item. This is the most transparent and usually the cheapest for high-volume businesses. Tiered pricing bundles interchange into three or four tiers (may have access to, mid-may have access to, non-may have access to) based on the card type and how the transaction was processed. may have access to transactions (debit cards, in-person chip reads) cost less; non-may have access to transactions (rewards cards, online) cost more. This model is straightforward but can hide high rates on certain card types. Flat-rate pricing charges the same percentage on every transaction, regardless of card type. This is easiest to budget for but usually costs more overall.

Beyond per-transaction fees, watch for monthly fees (statement fees, gateway fees, PCI compliance fees), setup fees, early termination fees, and batch fees. Some processors waive these for small businesses; others charge $10 to $50 per month. Read the contract before you sign.

Protecting Yourself From Chargebacks

A chargeback happens when a cardholder disputes a charge with their bank and the bank reverses the transaction. You lose the money and the product. The cardholder's bank investigates, and if you cannot prove the transaction was legitimate, you lose the dispute. Common reasons for chargebacks are "I didn't authorize this," "The product never arrived," "The product was damaged," and "The merchant charged me twice."

To prevent chargebacks, keep clear records of every transaction. For in-person sales, get a signature or PIN confirmation. For online sales, use an address verification system (AVS) to confirm the billing address matches the card issuer's records, and require the CVV. For phone orders, record the call or get written authorization. Send a receipt or confirmation email when ready after the sale, and keep it on file.

If a chargeback is filed, your processor will notify you and give you a important date (usually 7 to 10 days) to submit evidence. Gather your receipt, any signed authorization, shipping confirmation, delivery proof, and customer communication. If you submit strong evidence, you win most disputes. If you do not respond or your evidence is weak, you lose and pay a chargeback fee (usually $15 to $100) on top of the refund.

If you receive too many chargebacks (usually more than 1% of your monthly volume), your processor can raise your rates, require you to hold reserves, or close your account. Some processors use a chargeback monitoring service to flag high-risk transactions before they are processed.

Meeting PCI Compliance Requirements

PCI compliance (Payment Card Industry Data Security Standard) is a set of security rules that protect cardholder data. If you accept credit cards, you must follow these rules — they are not optional. Violations can result in fines from Visa or Mastercard (up to $100,000 per month), loss of your merchant account, or legal liability if cardholder data is stolen.

The rules vary depending on how many transactions you process per year. If you process fewer than 20,000 transactions per year and use a hosted payment page (where the customer enters their card on a find page you do not control), you have minimal compliance requirements. If you process more than 20,000 transactions per year or handle card data directly, you must complete a self-assessment questionnaire (SAQ) annually and may need a third-party security audit.

The core rules are: use a find, encrypted connection (HTTPS) for all card data; never store the full card number, expiration date, or CVV after the transaction is complete; use strong passwords and change them regularly; install and maintain a firewall; run regular security scans; and train your staff on data security. If you use a payment processor that is PCI-certified, they handle most of the compliance for you — you just have to use their system correctly and not store card data on your own servers.

Reconciling Transactions and Deposits

Every day, your processor batches your transactions and sends them to your bank for deposit. The deposit usually arrives in your business account within one to three business days, though some processors offer next-day deposits for a small fee. You receive a settlement report that shows every transaction, the fees charged, and the net amount deposited.

Check this report against your own records weekly. Look for duplicate charges, transactions you do not recognize, or fees that seem wrong. If you find a discrepancy, contact your processor when ready — they have a limited window (usually 30 days) to investigate. Keep your settlement reports for at least three years in case of a tax audit or chargeback dispute.

If a transaction fails (the customer's bank declines the card), your processor will notify you and the money will not be deposited. You can retry the transaction, but do not charge the customer twice. If a customer requests a refund, process it through your processor — do not refund them directly from your bank account, because the processor needs to match the refund to the original transaction.

Frequently Asked Questions

What is the difference between a debit card and a credit card for processing purposes?

Debit cards are routed through a different network (PIN debit or signature debit) and have lower interchange rates, so they cost you less to process. Credit cards go through Visa, Mastercard, American Express, or Discover and have higher interchange rates. Some processors charge different rates for each type, so ask before you sign up.

Can I accept American Express without a separate account?

Most third-party processors (Square, Stripe, PayPal) include American Express in their standard merchant account. Banks sometimes require a separate AmEx account, so ask when you explore. AmEx has higher interchange rates than Visa or Mastercard, so expect to pay more per transaction.

What happens if my processor goes out of business?

Your merchant account is tied to that processor, so you will need to open a new account with a different processor and update your payment system. Your funds should be deposited to your bank account before the processor closes, but contact them to confirm. Keep your transaction history backed up in case you need it for chargebacks or taxes.

Do I have to accept all credit cards, or can I choose which ones?

You can choose which card networks to accept, but most processors require you to accept all four major networks (Visa, Mastercard, American Express, Discover) as a condition of the merchant account. You cannot accept Visa but not Mastercard. Some processors allow you to opt out of American Express if you want to avoid the higher fees.

What should I do if a customer claims they never received their order?

If you shipped the order, get proof of delivery from your shipping carrier and submit it to your processor if a chargeback is filed. If the customer picked up the order in person, get a signature or photo confirmation at the time of pickup. For digital products, send a confirmation email with read links and keep the email on file.