Payment Processing for Online Business: Complete Guide

How Online Payment Processing Works

When a customer enters their credit card number on your website and clicks "Place Order," a chain of events happens in about two seconds. Understanding this chain helps you make better decisions about which processor to choose, why fees are structured the way they are, and what you can do to reduce costs.

The process starts at your payment gateway, which is the software layer that sits between your website and the financial system. The gateway encrypts the customer's card data and sends it to your payment processor (also called the acquiring processor or acquirer). The processor routes the transaction to the card network, either Visa, Mastercard, American Express, or Discover. The card network forwards the transaction to the customer's issuing bank, the bank that issued the credit or debit card.

The issuing bank checks whether the card is valid, whether the customer has available credit or funds, and whether the transaction triggers any fraud rules. It sends an approval or decline back through the same chain: issuing bank to card network to processor to gateway to your website. The customer sees "Payment Accepted" or "Payment Declined" on their screen. This entire round trip takes one to three seconds.

Approval is not the same as settlement. When a transaction is approved, the funds are authorized but not yet transferred. Settlement happens later, typically in batches at the end of each business day. Your processor collects all approved transactions, submits them for settlement through the card networks, and deposits the funds into your bank account, minus processing fees. Most processors settle within one to two business days. Some, like Stripe and Square, offer instant or next-day deposits for an additional fee.

Types of Payment Processors and Gateways

Payment Facilitators (PayFacs)

Payment facilitators like Stripe, PayPal, and Square aggregate many merchants under a single master merchant account. You sign up, verify your identity, and start accepting payments within minutes or hours. There is no underwriting process, no credit check, and no monthly minimum. The tradeoff is that you share the facilitator's merchant account with millions of other businesses, which means the facilitator assumes more risk and charges a flat-rate fee structure to compensate.

PayFacs are the right choice for most small to mid-sized online businesses. They offer simple pricing, fast setup, and no monthly fees. The flat-rate model means you know exactly what each transaction will cost. The downside is that PayFacs can freeze or hold your funds if their automated risk systems flag your account, and you have less leverage to negotiate lower rates because you are not a direct merchant relationship.

Traditional Merchant Accounts

A traditional merchant account is a dedicated bank account set up specifically for your business to accept card payments. You apply through a merchant account provider or acquiring bank, go through an underwriting process that evaluates your business type, processing history, credit score, and chargeback history, and receive a customized pricing structure based on your risk profile.

Traditional merchant accounts offer interchange-plus pricing, where you pay the actual interchange fee set by the card networks plus a fixed markup from your processor. For businesses processing more than $20,000 per month, interchange-plus pricing is almost always cheaper than flat-rate pricing. A business processing $50,000 per month might pay an effective rate of 2.2% to 2.5% with interchange-plus versus 2.9% with a flat-rate processor, saving $200 to $350 per month.

The downsides are longer setup times (typically three to seven business days), monthly minimums, statement fees, PCI compliance fees, and the complexity of reading interchange-plus statements. Providers in this space include Authorize.net (as a gateway paired with a merchant account), Payment Depot, Helcim, and Stax (formerly Fattmerchant).

All-in-One Ecommerce Payment Solutions

Some ecommerce platforms include their own payment processing. Shopify Payments (powered by Stripe) is built into Shopify and eliminates the transaction fee surcharge that Shopify charges when you use external gateways. BigCommerce has partnerships with PayPal and Stripe that offer preferred rates. WooCommerce Payments, also powered by Stripe, integrates directly into the WooCommerce dashboard.

These built-in solutions are convenient because they eliminate integration complexity and consolidate your ecommerce and payment data in one dashboard. The tradeoff is that you are locked into the platform's chosen processor and its pricing. Shopify Payments charges 2.9% + 30 cents on Basic, 2.6% + 30 cents on Shopify, and 2.4% + 30 cents on Advanced. If you use an external gateway instead, Shopify adds a surcharge of 2%, 1%, or 0.6% on top of whatever your gateway charges.

Understanding Payment Processing Fees

Interchange Fees

Interchange fees are set by the card networks (Visa, Mastercard) and paid by the merchant's processor to the cardholder's issuing bank on every transaction. These fees are non-negotiable, no processor can give you a lower interchange rate, because they are set by Visa and Mastercard themselves. Interchange rates vary based on the card type (rewards cards cost more than basic cards), the transaction type (card-present is cheaper than card-not-present), and the merchant category code (grocery stores pay less than jewelry stores).

For online transactions in the United States, interchange rates typically range from 1.65% + 10 cents for a basic Visa debit card to 2.40% + 10 cents for a Visa Signature Preferred rewards card. The average effective interchange rate for ecommerce transactions is approximately 1.8% to 2.1%. Interchange makes up the largest portion of your total processing cost, usually 70% to 80% of the total fee.

Assessment Fees

Assessment fees (also called card brand fees or network fees) are charged by Visa, Mastercard, American Express, and Discover for using their network. These are also non-negotiable and are typically much smaller than interchange fees. Visa charges 0.14% for credit and 0.13% for debit. Mastercard charges 0.1375% for transactions under $1,000 and 0.01% for debit. These fees add roughly 0.13% to 0.15% to your total processing cost.

Processor Markup

The processor markup is the only negotiable component of your processing fees. It is how your payment processor makes money. On a flat-rate model (Stripe, PayPal, Square), the markup is bundled into the single rate. When Stripe charges 2.9% + 30 cents, the interchange and assessment fees are included in that rate. On a good interchange-plus model, the markup might be 0.2% to 0.5% plus 5 to 15 cents per transaction.

For a $100 online transaction on a standard rewards card, the cost breakdown looks roughly like this: interchange of $2.10, assessment of $0.14, and processor markup of $0.25 to $0.50. Total cost: approximately $2.49 to $2.74, or 2.49% to 2.74%. On Stripe's flat rate, that same transaction costs $3.20 (2.9% + $0.30). The difference of $0.46 to $0.71 per transaction adds up quickly at scale.

Other Fees to Watch For

Beyond the per-transaction fees, some processors charge monthly fees ($10 to $30), monthly minimums (you pay a fee if your processing volume falls below a threshold), PCI compliance fees ($50 to $100 annually), statement fees ($5 to $15 monthly), batch fees ($0.10 to $0.30 per daily batch settlement), and chargeback fees ($15 to $25 per dispute). Flat-rate processors like Stripe and Square generally do not charge any of these extra fees, which is one reason their higher per-transaction rates can still be competitive for small businesses.

How to Choose the Right Payment Processor

Your monthly processing volume is the single most important factor. If you process less than $10,000 per month, flat-rate pricing from Stripe, PayPal, or Square will almost always be your best option. The simplicity, zero monthly fees, and fast setup outweigh the slightly higher per-transaction cost. Once you consistently process $20,000 or more per month, the savings from interchange-plus pricing become significant enough to justify the added complexity and monthly fees of a traditional merchant account.

Your business model matters too. Subscription businesses benefit from processors with strong recurring billing infrastructure, like Stripe, which has built-in subscription management, automated retry logic for failed payments, and customer portal features. Marketplaces and platforms that split payments between sellers need a processor that supports connected accounts or split payments, which is Stripe Connect's specialty. High-risk businesses (nutraceuticals, CBD, adult content, firearms, travel) need specialized high-risk merchant accounts because standard processors will decline their applications or shut down their accounts.

Where you sell is another key factor. If you sell exclusively online, any major gateway works. If you also sell in person at retail locations, pop-up shops, or trade shows, you need a processor that offers both online and in-person solutions with unified reporting. Square excels at this. Stripe Terminal is catching up. PayPal Zettle provides mobile card readers. If you sell internationally, you need multi-currency support, local payment methods (iDEAL in the Netherlands, Bancontact in Belgium, PIX in Brazil), and cross-border fee structures that do not eat your margins.

Finally, consider your ecommerce platform's native integrations. Shopify works best with Shopify Payments. WooCommerce works best with WooCommerce Payments or Stripe. BigCommerce has preferred rates with PayPal. Using your platform's recommended processor typically means easier setup, tighter data integration, and no extra surcharges.

The Top Payment Processors in 2026

Stripe

Stripe processes hundreds of billions of dollars annually for businesses ranging from one-person startups to companies like Amazon, Shopify, and Instacart. The standard rate is 2.9% + 30 cents for domestic cards and 3.9% + 30 cents for international cards with an additional 1% for currency conversion. There are no monthly fees, no setup fees, and no minimum processing requirements.

What separates Stripe from other processors is its developer tools and product breadth. Stripe offers subscription billing (Stripe Billing), multi-party payments for marketplaces (Stripe Connect), in-person payments (Stripe Terminal), fraud detection (Stripe Radar), invoicing, tax calculation, business incorporation (Stripe Atlas), and financial reporting. The API documentation is considered best-in-class in the payments industry, and pre-built integrations exist for virtually every ecommerce platform.

Stripe's main limitation for non-technical users is that it was built API-first. While Stripe's dashboard and no-code tools like Payment Links and Checkout have improved significantly, the full power of the platform requires some technical ability. For store owners using a platform like Shopify or WooCommerce, the platform's Stripe integration handles the technical side.

PayPal

PayPal processes payments for over 35 million merchants worldwide and has more than 430 million active accounts. The standard rate for online card payments is 3.49% + 49 cents, which is meaningfully more expensive than Stripe or Square. PayPal Checkout (the button customers click to pay with their PayPal balance, linked bank, or saved card) charges 3.49% + 49 cents. Advanced Credit and Debit Card Payments (where customers enter card details directly on your site, powered by Braintree) charges 2.99% + 49 cents.

PayPal's primary advantage is buyer trust and conversion. In survey after survey, consumers report feeling safer checking out with PayPal than entering card details on an unfamiliar website. For new or small online stores without established brand recognition, offering PayPal as a checkout option can increase conversion rates by 5% to 15%. PayPal also offers buyer protection, which gives consumers confidence to purchase from unknown sellers.

The tradeoff is cost and account stability. PayPal's rates are among the highest of any major processor, and the company is known for sudden holds on merchant funds and account limitations triggered by their automated risk systems. Merchants selling higher-ticket items or in categories PayPal considers risky can find their funds frozen for up to 180 days with limited recourse. Many experienced ecommerce operators offer PayPal as a secondary payment option alongside a primary processor like Stripe.

Square

Square started as a mobile card reader for in-person payments and has expanded into a full commerce platform. Online payment processing is 2.9% + 30 cents per transaction, matching Stripe. In-person payments are 2.6% + 10 cents, and manually keyed transactions are 3.5% + 15 cents. There are no monthly fees for the basic plan. Square Online, their ecommerce website builder, has a free tier with Square branding.

Square's strength is unified online and offline commerce. If you run a retail store and also sell online, or if you do farmers markets, pop-up events, and craft fairs alongside your online store, Square gives you a single dashboard for all your sales, inventory, and customer data. The hardware ecosystem includes the magstripe reader (free), Square Reader for contactless and chip ($49), Square Stand ($149), and Square Terminal ($299).

Square is less suited for online-only businesses with complex needs. Its reporting is adequate but not as deep as Stripe's. Its API and developer tools are improving but still lag behind Stripe. And like PayPal, Square has a reputation for sudden account terminations, particularly for businesses in categories it considers higher risk.

Payment Security and PCI Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements that every business accepting credit card payments must follow. The standard covers twelve requirement areas including network security, data encryption, access control, vulnerability management, and security monitoring. Non-compliance can result in fines of $5,000 to $100,000 per month from the card networks, and if your business suffers a data breach while non-compliant, you are liable for all costs associated with the breach.

For most small online businesses, PCI compliance is straightforward because modern payment processors handle the heavy lifting. When you use Stripe, PayPal, or Square's hosted checkout forms, card data never touches your server. The customer's card number is encrypted and sent directly from their browser to the processor's servers. This means your store qualifies for SAQ A (the simplest PCI self-assessment questionnaire), which has only 22 requirements and is mostly about maintaining good security practices like using strong passwords and keeping your software updated.

Beyond PCI compliance, fraud prevention is a critical part of payment security. Online merchants lose an average of 1.4% of revenue to fraud, and chargebacks cost $2.40 or more for every dollar of fraud. Stripe Radar uses machine learning trained on data from millions of merchants to block fraudulent transactions automatically. Address Verification Service (AVS) checks the billing address against the card issuer's records. CVV verification ensures the customer has the physical card. 3D Secure (3DS) adds a cardholder authentication step for higher-risk transactions, shifting fraud liability from the merchant to the issuing bank.

Payment Processor Comparisons

Best Payment Processor by Business Need

Fees, Security, and How-To Guides