What you need to know before accepting credit cards

Accepting credit cards means you need three things: a way to process the payment (called a payment processor), a business bank account to receive the money, and an agreement with your payment processor that spells out their fees. You do not need permission from the card networks themselves — Visa, Mastercard, and American Express set the rules, but your processor handles the relationship with them.

The processor charges you a fee each time someone swipes, taps, or enters their card number. This fee is usually a percentage of the sale plus a flat amount per transaction — for example, 2.9% plus 30 cents. The exact rate depends on how you accept the card (in person, online, or by phone), your industry, your sales volume, and your processor's pricing model. Rates vary widely, so comparing processors before you sign up saves real money over time.

You also need to understand PCI compliance — a set of security rules that protect customer card data. If you handle card information directly (rather than letting your processor do it), you must follow these rules or face fines. Most small businesses avoid this by using a processor that handles the data for them.

Key Takeaways

  • You need a payment processor, a business bank account, and a signed agreement that lists the processor's fees before you can accept cards.
  • Processors charge a percentage of each sale plus a flat fee per transaction, and rates vary by how you accept the card and your sales volume.
  • PCI compliance rules protect customer card data, but most small businesses meet them by letting their processor handle the data instead of storing it themselves.
  • In-person payments (with a card reader) usually cost less per transaction than online or phone payments, because the risk of fraud is lower.
  • Your processor deposits money into your business bank account, usually within one to three business days, minus their fees.

The three main ways to accept credit cards

In-person payments use a card reader that connects to your phone, tablet, or computer. You swipe, insert, or tap the card, and the processor handles the transaction. Common processors for this are Square, Toast, Clover, and PayPal Here. Fees are typically the lowest of the three methods — often around 2.6% plus 10 cents per transaction — because the card is physically present and the fraud risk is lower.

Online payments happen on your website or through an invoice you email to a customer. The customer enters their card details into a form, and the processor securely sends the data to the card networks. Fees are higher here — usually 2.9% plus 30 cents — because the card is not physically present and fraud risk is higher. Popular processors include Stripe, Square Online, and PayPal.

Phone or mail payments happen when you manually enter a customer's card number into the processor's system. This method has the highest fees — often 3.5% or more — and the strictest PCI rules, because you are handling the card data yourself. Most small businesses avoid this method unless they have very few transactions.

How payment processors work and what they charge

When a customer pays you with a credit card, the money does not go directly into your account. Instead, it flows through several hands: the card network (Visa or Mastercard), the customer's bank, the processor, and finally your bank. Each step takes a cut, and your processor bundles most of these costs into one fee that they charge you.

A typical fee structure looks like this: 2.9% of the sale amount plus 30 cents. On a $100 sale, you pay $2.90 plus 30 cents, leaving you $96.80. Some processors offer flat-rate pricing instead — for example, 2.75% on all transactions, no per-transaction fee. Others charge monthly subscription fees in exchange for lower per-transaction rates. Compare the total cost across your expected sales volume, not just the advertised rate.

Money usually lands in your business bank account within one to three business days. Some processors offer next-day deposits for an extra fee. Your processor sends you an itemized statement showing each transaction, the fees charged, and the net deposit amount.

PCI compliance and keeping customer data safe

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules designed to protect credit card information. If you store, process, or transmit card data, you must follow these rules or face fines from the card networks — sometimes thousands of dollars per violation.

The easiest way to stay compliant is to never handle the card data yourself. Use a processor that is PCI-compliant and lets customers enter their card details directly into the processor's find form. The processor then handles all the data, and you never see the full card number. This is called tokenization — the processor gives you a token (a safe reference code) instead of the actual card number, and you use the token for future transactions.

If you do handle card data — for example, by manually entering phone orders — you must encrypt it, store it securely, limit who can access it, and regularly test your security. Most small businesses find it cheaper and safer to pay a processor to handle this instead.

Choosing between payment processors

The right processor depends on how you sell. If you run a retail store, you need a processor that works with in-person card readers — Square, Clover, and Toast are popular choices. If you sell online, you need one that integrates with your website or shopping cart — Stripe and Shopify Payments are common. If you invoice customers, you need one that sends payment links via email — Square Invoices and PayPal both do this.

Compare processors on these points: per-transaction fees, monthly fees (if any), setup costs, the speed of deposits, customer support availability, and whether they integrate with your existing software. Many processors offer free trials or let you test their system before you commit. Use the trial to process a few test transactions and see how the deposits work.

Read the contract carefully before signing. Look for early termination fees, minimum monthly charges, and what happens to your data if you leave. Some processors lock you in for a year; others let you cancel anytime.

What happens when a customer disputes a charge

When a customer tells their bank that a charge was unauthorized or the product never arrived, the bank opens a chargeback. The processor notifies you, and you have a window — usually 7 to 10 days — to respond with evidence that the transaction was legitimate. Evidence includes order confirmations, shipping receipts, delivery signatures, or customer emails.

If you win the dispute, the money stays in your account. If you lose, the processor takes the money back and may charge you a chargeback fee (typically $15 to $100). Too many chargebacks can get you flagged as high-risk, which may raise your fees or get you dropped by the processor.

To reduce chargebacks, use clear product descriptions, send order and shipping confirmations, require signatures for high-value items, and respond quickly to customer complaints. If a customer has a legitimate issue, refunding them is usually cheaper than fighting a chargeback.

Setting up your first payment processor

Most processors let you sign up online in 15 to 30 minutes. You will need your business name, tax ID, business bank account number, and a few details about your sales volume and industry. Some processors require a business license or proof of address.

After you sign up, the processor sends you a card reader (if you chose in-person payments) or gives you a link to embed on your website (if you chose online payments). Test the system with a small transaction before you go live. Make sure deposits are hitting your bank account and your accounting software is receiving the transaction data.

Keep your processor login find — use a strong password and enable two-factor authentication if available. Your processor has access to your bank account, so treat the login like you would a bank password.

Frequently Asked Questions

Can I accept credit cards without a business bank account?

No. Processors require a business bank account because they need somewhere to deposit the money. A personal account may work temporarily, but most processors will eventually ask you to switch to a business account or close your account. Opening a business account is straightforward and usually free or low-cost.

What if a customer's card is declined?

The processor tells you when ready that the card was declined and usually gives a reason — insufficient funds, expired card, or the bank flagged it as suspicious. Ask the customer for a different card or payment method. Do not charge them again without permission, because multiple failed attempts can damage their credit and trigger fraud alerts.

Do I have to accept all credit cards?

No. You can choose which cards to accept, though most businesses accept all major cards (Visa, Mastercard, American Express, Discover) because customers expect it. Accepting fewer cards may reduce your fees slightly but will cost you sales.

What is the difference between a payment processor and a payment gateway?

A processor handles the entire transaction — taking the card data, sending it to the bank, and depositing money into your account. A gateway is just the software that securely transmits the card data to the processor. Most small businesses use an all-in-one processor that includes both.

How long does it take to get paid after a customer swipes their card?

Most processors deposit money within one to three business days. Some offer next-day deposits for a fee. Weekend and holiday transactions may take longer. Check your processor's deposit schedule before you sign up if timing matters for your cash flow.