Payment Gateway
Software infrastructure that processes, verifies, and authorizes online and in-person payment transactions between merchants and customers.
A payment gateway is the technology infrastructure that facilitates electronic payment transactions by encrypting and transmitting payment data between the merchant's website or point-of-sale system, the acquiring bank (the merchant's bank), the card networks (Visa, Mastercard), and the issuing bank (the customer's bank), and returning an approval or decline response in real time.
The payment flow for a typical card transaction: (1) Customer enters payment information at checkout; (2) Gateway encrypts and sends the data to the acquirer; (3) Acquirer routes the request through the card network to the issuing bank; (4) Issuing bank approves or declines based on available funds, fraud signals, and card validity; (5) Response travels back through the network; (6) Gateway returns the result to the merchant's checkout — all in 1–3 seconds.
Modern payment gateways are far more than transaction pipes. Comprehensive platforms like Stripe offer a full suite: payment processing in 135+ currencies, fraud prevention (Stripe Radar), subscription billing, identity verification, payouts, issuing (creating virtual/physical cards), and treasury services. This platform approach has redefined competitive dynamics in the payment infrastructure industry.
Gateways generate revenue through transaction fees (typically 2.5–3% + $0.30 per transaction for card-present; slightly higher online) and increasingly through value-added service fees (Stripe's billing, invoicing, and financial products carry separate pricing).
For enterprise merchants, payment optimization — routing transactions to different acquirers based on authorization rates and cost — can meaningfully improve payment economics. Large-volume merchants often work with multiple acquirers and implement intelligent routing to optimize approval rates.
FAQs
What is the difference between a payment gateway and a payment processor?
A payment gateway handles the communication layer — it transmits payment data between parties. A payment processor executes the actual money movement between the merchant's and customer's banks. Many modern providers like Stripe combine both functions. Traditionally, businesses needed separate contracts with a gateway (e.g., Authorize.net) and a processor (e.g., First Data).
What is tokenization and how does it improve payment security?
Tokenization replaces sensitive card data (PAN, expiration date, CVV) with a unique non-sensitive token that has no exploitable value outside the specific merchant context. When stored, tokens cannot be reverse-engineered to reveal card data. Tokenization dramatically reduces PCI DSS compliance scope and virtually eliminates breach liability for stored payment credentials.
What is 3D Secure and when is it required?
3D Secure (3DS) is an authentication protocol that adds an additional verification step during online card transactions — typically a one-time code, biometric, or bank app approval. 3DS is required by law for card-not-present transactions in the EU under PSD2 (Strong Customer Authentication). It reduces fraud liability but can reduce conversion if not implemented well; modern 3DS 2.0 enables frictionless authentication for low-risk transactions.
Related Terms
ACH Transfer
An electronic bank-to-bank transfer processed through the Automated Clearing House network, used for payroll, bill payments, and business transactions.
Interchange Fee
The fee paid by a merchant's bank to a cardholder's bank for processing a card transaction, forming the largest component of merchant payment processing costs.
Chargeback
A forced reversal of a payment transaction initiated by a customer through their bank, placing the financial liability back on the merchant.
Merchant of Record
The legal entity responsible for processing customer payments, managing tax compliance, and handling refunds and chargebacks for digital goods and services sales.
