Payment gateway
The service that securely captures card or payment details at checkout and sends them to be authorized, connecting a merchant's website or terminal to the payment networks.
In short
- It is the front door of card processing: it collects the data and routes the transaction.
- Gateways, processors and acquirers are often bundled by one provider, but they do different jobs.
- A hosted gateway keeps card data off the merchant's systems, which reduces PCI scope.
A payment gateway sits between the point where a customer pays and the systems that process the payment. Online, it is the checkout form or payment page; in a store, it is the connection behind the card terminal. It encrypts the payment details, sends them for authorization and returns the approval or decline to the merchant.
Who does what
- Gateway: captures and transmits payment data securely.
- Processor: handles the technical routing of transactions to the card networks.
- Acquirer: the bank that holds the merchant account, receives settled funds and pays the merchant.
- Payment service provider (PSP) or payment facilitator: bundles all of these into one service and onboards merchants under its own acquiring relationship.
Many modern providers combine the gateway, processing and merchant account, which is why the terms are often used loosely.
What to look for
Supported payment methods and currencies, pricing structure, settlement timing, fraud tools, tokenization for stored cards, reporting that makes reconciliation easy, and hosted payment fields that keep card data off the merchant's own systems. The last point matters a great deal for PCI DSS compliance.
Worked example
A checkout, step by step
A customer buys $92 of supplies from an online store. The store's hosted payment fields send the card details to the gateway, which tokenizes them and requests authorization. The issuer approves in about a second, the gateway returns the approval to the store, and the order is confirmed. The store never sees the full card number, only a token and the last four digits.