The three ways to take card payments depend on your business size and sales volume

You can accept credit cards through a payment processor (a company that handles the transaction), a point-of-sale system (hardware and software that processes cards in person), or a payment gateway (software that connects your website to a processor). Which one you use depends on whether you sell in person, online, or both—and how many transactions you handle each month.

Each method charges you a fee. The processor takes a percentage of each sale (typically 2.2% to 3.5%), plus a flat fee per transaction (usually $0.30 to $0.50). Some systems also charge a monthly subscription. You pay these fees whether the customer's card is present, not present, or flagged as high-risk.

The processor also handles the security requirements. They ensure your business meets PCI DSS (Payment Card Industry Data Security Standard), which is a set of rules that protects customer card information. If you use a processor that is PCI-compliant, you do not have to store card data yourself—the processor does.

Key Takeaways

  • In-person payments use a point-of-sale terminal or mobile card reader; online payments use a payment gateway connected to your website.
  • Payment processors charge a percentage of each sale plus a per-transaction fee, and these costs vary by card type and whether the card is physically present.
  • You must use a PCI-compliant processor so you do not have to store customer card data on your own systems.
  • Popular processors for small businesses include Square, Stripe, PayPal, and Clover; each has different fee structures and features.
  • You need a merchant account (a bank account that receives card payments) before you can process any transactions.

In-person payments: terminals and mobile readers

If you sell in a physical location, you need a point-of-sale terminal or a mobile card reader. A terminal is a device that sits on your counter; a mobile reader is a small square or rectangle that plugs into a phone or tablet. Both read the card's information and send it to your processor.

Square, for example, offers a free mobile reader that works with any smartphone. You swipe or insert the card, and the transaction goes through in seconds. Square charges 2.6% plus $0.10 per transaction for in-person card-present sales. Clover offers a larger terminal with a built-in screen and receipt printer; it charges similar rates but requires a monthly subscription ($49 to $99 depending on the model).

The difference between swiping, inserting, and tapping matters for your fees. If the customer inserts their chip card or taps their phone, the processor assumes the card is genuine and charges you a lower rate. If you swipe the magnetic stripe (the old method), the processor charges you more because the risk of fraud is higher. If the card is not present at all—the customer reads you their number over the phone—you pay the highest rate.

Online payments: payment gateways and hosted forms

If you sell on a website, you need a payment gateway—software that encrypts the customer's card information and sends it to your processor. The gateway sits between your website and the processor; it does not store the card data itself.

Stripe and PayPal are the two most common gateways for small online businesses. Stripe charges 2.9% plus $0.30 per transaction for online card-not-present sales. PayPal charges 3.49% plus $0.49 per transaction. Both provide code that you can paste into your website, or you can use their hosted payment forms (a page that Stripe or PayPal hosts for you, so you do not have to build your own checkout).

If you do not want to build a website at all, you can use a hosted checkout page. Stripe and Square both offer these: you create a link, send it to the customer, and they enter their card information on Stripe's or Square's page. You never see the card number. The processor handles all the security.

Fees vary by card type and transaction method

Your processor charges different rates depending on what kind of card the customer uses and whether the card is physically present. A Visa or Mastercard typically costs less than an American Express or Discover card. A card that is present and inserted costs less than a card that is swiped, which costs less than a card that is not present at all.

Some processors publish their rates openly; others require you to contact them for a quote. Square and Stripe publish their rates on their websites. PayPal publishes its rates but also charges different amounts depending on your sales volume and industry. Clover does not publish rates; you have to call or fill out a form.

Beyond the percentage and per-transaction fee, some processors charge monthly fees ($0 to $99), batch fees (a small charge each time you settle your transactions), or statement fees. Read the pricing page carefully. A processor that charges 2.5% with no monthly fee may be cheaper than one that charges 2.2% but requires a $50 monthly subscription, depending on your sales volume.

You need a merchant account before you can process cards

A merchant account is a bank account that receives card payments. Your processor opens this account for you, usually as part of the sign-up process. The account is separate from your regular business bank account. When a customer pays by card, the processor deposits the money into your merchant account, and you transfer it to your regular account when you are ready.

Most processors open a merchant account for free. Some require a minimum monthly sales volume or charge a setup fee. Square and Stripe do not charge setup fees and do not require a minimum. PayPal does not charge a setup fee either, but it holds your first deposit for 21 days as a security measure.

Your processor will ask for your Social Security number, business license, and bank account information. They run a background check to make sure you are not a high-risk business (like a casino or a payday lender). If you are, they may decline to open an account or charge you higher fees.

PCI compliance means you do not store card data yourself

PCI DSS is a set of security rules created by the major card networks (Visa, Mastercard, American Express, Discover). If you accept card payments, you must follow these rules or use a processor that does it for you. The rules cover how you store data, who can access it, how you encrypt it, and how often you test your security.

The easiest way to stay compliant is to use a PCI-compliant processor and never store card data on your own systems. When you use Square, Stripe, or PayPal, they handle the compliance for you. You do not see the full card number, and you do not store it. The processor encrypts it and stores it in their secure vault.

If you try to store card data yourself—even if you encrypt it—you become responsible for PCI compliance. This means annual security audits, penetration testing, and detailed documentation. Most small businesses cannot afford this, so they use a processor instead.

Popular processors and what they offer

Square is best for in-person sales. The mobile reader is free, and the fees are transparent: 2.6% plus $0.10 for card-present sales. Square also offers online invoicing and a point-of-sale system called Square Register. There is no monthly fee.

Stripe is best for online sales and developers. The fees are 2.9% plus $0.30 for online sales. Stripe offers a hosted checkout page, a payment form you can embed in your website, and APIs (code libraries) if you want to build a custom checkout. There is no monthly fee.

PayPal works for both in-person and online sales. The fees are 3.49% plus $0.49 for online sales and 2.7% plus $0.30 for in-person sales (with their card reader). PayPal also offers invoicing and a point-of-sale system. There is no monthly fee, but PayPal holds your first deposit for 21 days.

Clover is best for retail businesses that want a full point-of-sale system. Clover offers a terminal with a built-in screen, inventory management, employee timeclock, and customer loyalty features. The hardware costs $200 to $1,000, and the monthly subscription is $49 to $99. Clover does not publish its processing fees; you have to contact them.

Frequently Asked Questions

Do I have to use the same processor for in-person and online sales?

No. You can use Square for in-person sales and Stripe for online sales, or any other combination. Each processor will open a separate merchant account. The downside is that you will have two sets of fees and two dashboards to manage. Most small businesses use one processor for both to keep things simple.

What happens if a customer disputes a charge?

The customer contacts their card issuer (their bank) and says the charge was unauthorized or the product did not arrive. The bank contacts your processor, and your processor asks you for proof that the transaction was legitimate (a receipt, a shipping confirmation, or a signed agreement). If you cannot provide proof, you lose the money and pay a chargeback fee (usually $15 to $100). This is why you should keep records of every transaction.

Can I accept cards without a website or a physical store?

Yes. You can send a payment link via email or text message. Square and Stripe both let you create a link that the customer clicks, enters their card information, and pays. You do not need a website or a terminal. The processor charges the same fees as a regular online transaction.

What is the difference between a payment processor and a payment gateway?

A processor is the company that handles the entire transaction—it takes the card information, checks with the bank, deposits the money into your account, and handles disputes. A gateway is just the software that encrypts the card information and sends it to the processor. Most small businesses use a processor that includes a gateway, so you do not have to think about them separately.

Do I have to pay taxes on card processing fees?

No. The processing fees are a business expense, not income. You deduct them from your gross revenue when you calculate your taxable income. However, you do have to report the total amount of card sales as income. Your processor will send you a 1099-K form at the end of the year if your sales exceed a certain threshold (this threshold varies by state and year).