The basic setup: what you need before your first transaction

To take credit card payments, you need three things: a way to process the card (a payment processor), a place for the money to land (a merchant account), and a method to collect the card details safely. The payment processor is the company that talks to the customer's bank, checks the card is real, and moves money to you. The merchant account is a bank account that holds the money after a transaction clears — it's separate from your regular business checking account.

You don't have to set these up separately anymore. Most small businesses use an all-in-one service like Square, Stripe, PayPal, or Toast that bundles the processor and merchant account together. You sign up once, connect your bank account, and you're ready to take payments. Larger businesses sometimes work with a dedicated payment processor and a separate merchant services provider, but that's more complex and usually only worth it if you're processing thousands of dollars per month.

The catch is cost. Every time a customer swipes, taps, or enters their card, you pay a fee. This fee is usually a percentage of the sale (often 2% to 3%) plus a small flat amount per transaction (usually 30 cents). Fees vary by processor, by card type (Amex costs more than Visa), and by how the card is entered (in-person is cheaper than online). You'll also pay a monthly fee for the service itself, though many small-business processors waive it if you hit a minimum monthly volume.

Key Takeaways

  • A payment processor connects your customer's bank to yours and charges a fee per transaction, usually 2% to 3% plus 30 cents.
  • All-in-one services like Square and Stripe handle both processing and the merchant account, so you only sign up once.
  • In-person payments (card present) cost less in fees than online or phone payments (card not present).
  • You need a way to collect card details safely — never store raw card numbers yourself, and use a processor that handles security for you.
  • Monthly fees, chargeback fees, and setup fees vary widely, so compare processors before you commit.

In-person payments: card readers and point-of-sale systems

If you take payments face-to-face — at a retail counter, a market stall, a service appointment, or an event — you'll use a card reader. This is a small device that plugs into your phone or tablet and reads the card's chip or magnetic stripe. Square Reader, Stripe Terminal, and PayPal Here are the most common. You tap the reader, the customer inserts or taps their card, and the payment goes through in seconds.

For a brick-and-mortar business with multiple staff or high volume, a point-of-sale system (POS) is more practical. This is software (usually on a tablet or computer) that handles the whole transaction: it rings up items, calculates tax, processes the card, and keeps a record. Square for Retail, Toast, Clover, and Shopify POS are popular options. A POS system costs more upfront and monthly, but it also tracks inventory, manages staff, and generates reports — things a simple card reader doesn't do.

In-person payments have the lowest fees because the card is physically present and the risk of fraud is lower. You'll typically pay 2.6% plus 10 cents per transaction with a basic card reader, or a flat rate (like 2.9% plus 30 cents) with a POS system. Some processors offer a lower flat rate if you process a certain amount per month.

Online and phone payments: collecting cards safely

If you take payments over the phone or through a website, you're handling card-not-present transactions. These cost more in fees (usually 3% to 3.5% plus 30 cents) because the card isn't physically there and fraud risk is higher. The key rule: never ask a customer to email you their card number, and never store card numbers yourself in a spreadsheet or email.

For phone payments, use your processor's phone payment tool. Square, Stripe, and PayPal all have a feature where you enter the customer's card details into their secure form while on the phone, the customer hears a confirmation, and the payment processes. The card number never touches your email or your notes. If you're taking many phone orders, a dedicated phone payment system like Authorize.Net or Worldpay might be cheaper than a general processor.

For a website, use a payment form that your processor provides. This is a box on your checkout page where the customer enters their own card details. The form is hosted by the processor, not by you, so you never see the raw card number. Stripe, Square Online, Shopify Payments, and PayPal all offer this. If you use a shopping cart platform like Shopify, WooCommerce, or BigCommerce, the payment form is built in — you just turn it on and connect your processor account.

Never build your own payment form or ask customers to enter card details into a text field you created. This exposes you to PCI compliance requirements — a set of security rules that are expensive and complex to follow. Using your processor's form keeps you out of that liability.

Recurring and subscription payments

If you charge customers on a schedule — a monthly membership, a retainer, a subscription box — you'll set up recurring billing. You collect the card once, store a token (a safe reference to that card, not the number itself), and charge it automatically on the date you choose. Most processors include this feature at no extra cost.

To set up recurring billing, you need the customer's permission in writing. This is usually a checkbox on your signup form that says something like "I authorize you to charge my card on the 1st of each month." Keep that consent on file. If a customer disputes a charge, you'll need to show you had permission.

Recurring payments have higher chargeback rates because customers sometimes forget they signed up or claim they didn't authorize the charge. Processors know this and may charge a higher fee for recurring billing, or they may require you to send a reminder email before each charge. Check your processor's policy before you launch a subscription service.

Fees, chargebacks, and what happens when things go wrong

Beyond the per-transaction fee, you'll encounter other costs. A chargeback happens when a customer disputes a charge with their bank — they claim they didn't make the purchase, or the product never arrived, or it wasn't what they ordered. When this happens, the bank pulls the money back from you and charges you a fee (usually $15 to $100) to investigate. If you lose the dispute, you lose the sale amount too.

To reduce chargebacks, keep clear records: order confirmations, shipping tracking, customer communication, and proof of delivery. If a customer contacts you with a problem, refund them directly rather than waiting for a chargeback. A refund you issue costs you nothing; a chargeback you lose costs you the sale plus the dispute fee.

Some processors charge a monthly fee even if you don't process any payments. Others waive it if you hit a minimum volume. A few charge a setup fee or an early termination fee if you close your account within a certain time. Read the fine print before you sign up. The cheapest per-transaction rate isn't always the cheapest overall if you're paying $30 a month in fees you didn't expect.

If you process a high volume of chargebacks (usually more than 1% of your transactions), your processor may raise your rates, require you to hold a reserve fund, or close your account. This is rare for legitimate businesses, but it's why keeping good records and handling disputes quickly matters.

Choosing a processor: what to compare

The right processor depends on how you take payments. If you're mostly in-person, Square or Stripe Terminal are simple and cheap. If you have a website, Shopify Payments (if you use Shopify) or Stripe are solid choices. If you're a restaurant or retail store with staff, Toast or Clover offer more features. If you're a nonprofit or have very high volume, you might negotiate a custom rate with a dedicated processor like First Data or Global Payments.

When comparing, look at these numbers: the per-transaction percentage, the flat fee per transaction, the monthly fee, the chargeback fee, and any setup or termination fees. Then calculate what you'd pay on a typical month of sales. A processor that charges 2.9% plus 30 cents might be cheaper than one charging 2.6% plus 10 cents if the second one has a $20 monthly fee and you're processing less than $1,000 per month.

Also check the support: can you reach someone by phone if a payment fails? How long does it take to get money into your bank account (this is called the settlement time, usually one to three business days)? Does the processor offer tools you actually need, like inventory tracking or staff management, or are you paying for features you'll never use?

Security and compliance basics

When you take credit card payments, you're responsible for keeping that data safe. You don't have to become a security expert, but you do have to follow a few rules. First, never store a customer's full card number, expiration date, or security code. Use your processor's tools to store a token instead — a code that represents the card but can't be used to charge it without your processor's approval.

Second, use HTTPS (a secure connection) on any page where a customer enters card details. Your processor's payment form handles this automatically. If you're building your own website, your hosting provider can set up an SSL certificate (usually free or very cheap) to enable HTTPS.

Third, if you're in the United States, you're subject to PCI DSS (Payment Card Industry Data Security Standard). This is a set of rules about how to handle card data. The good news: if you use your processor's payment form and never touch the raw card number yourself, you're mostly compliant already. Your processor handles the heavy lifting. If you do store card data (like tokens), you'll need to fill out a self-assessment questionnaire once a year, but this is usually free and takes an hour.

If you're outside the United States, similar rules apply in your country. The European Union has PSD2, Canada has PIPEDA, and Australia has the Privacy Act. Your processor will tell you what you need to do.

Frequently Asked Questions

How long does it take to get paid after a customer swipes their card?

Most processors deposit money into your bank account within one to three business days. This is called the settlement time. Some offer next-day settlement for a higher fee. Weekends and holidays can add a day or two. Check your processor's policy before you sign up if cash flow is tight.

Can I take American Express or Discover, or just Visa and Mastercard?

You can take all four. Amex and Discover charge higher fees than Visa and Mastercard — sometimes 1% more. Most processors bundle all four into one rate, so you don't have to set them up separately. Some customers prefer Amex for rewards, so accepting it is usually worth the extra cost.

What happens if a customer's card is declined?

The processor will tell you why: insufficient funds, expired card, incorrect security code, or the bank flagged it as suspicious. You can ask the customer for a different card or payment method. Don't keep trying the same card over and over — this can trigger fraud alerts and make things worse.

Do I have to use the processor's app, or can I use my own software?

Most processors offer an API (a way for your own software to talk to their system) so you can build a custom experience. This is more work upfront but gives you more control. If you're using a platform like Shopify or WooCommerce, the integration is usually built in — you just flip a switch.

What if I want to refund a customer?

Log into your processor's dashboard, find the transaction, and click "refund." The money goes back to the customer's card within one to three business days. You don't pay a fee for issuing a refund, but you do lose the original transaction fee. Partial refunds are allowed — you can refund $50 of a $100 charge if that's what the customer needs.