The basic setup: what you need to start taking cards

To take credit card payments, you need three things: a merchant account (a bank account that receives card payments), a payment processor (the company that handles the transaction), and payment equipment or software (the terminal, reader, or online form where the customer enters their card details). You do not need all three from the same company, though many providers bundle them together.

A merchant account is different from your regular business bank account. It is held with an acquiring bank and designed specifically to receive card transactions. The acquiring bank then deposits the funds into your regular business account, usually within one to three business days. Your payment processor sits between you and the acquiring bank, routing the transaction and handling the security checks.

The equipment or software depends on how you take payments. If you have a physical location, you might use a point-of-sale terminal or a card reader that plugs into a tablet. If you take payments online or over the phone, you use a payment gateway — software that encrypts the card details and sends them securely to the processor. Many small businesses use a combination: a reader for in-person sales and a gateway for online orders.

Key Takeaways

  • You need a merchant account with an acquiring bank, a payment processor to route transactions, and equipment or software to collect card details — these can come from one provider or multiple ones.
  • Interchange fees (set by Visa and Mastercard), assessment fees (set by the card networks), and processor markups are the three layers of cost; you cannot negotiate the first two, only the third.
  • Monthly statements show every transaction, fee, and chargeback; review them carefully because errors in how fees are categorized happen regularly.
  • Chargebacks occur when a customer disputes a charge with their bank; you have a window to respond with proof of the transaction, and losing a chargeback costs you the sale amount plus a fee.
  • PCI compliance (Payment Card Industry Data Security Standard) is a legal requirement if you handle card data; the rules depend on how many transactions you process annually.

How payment processors charge you: the three-layer fee structure

Every credit card transaction costs you money in three separate layers. The first layer is the interchange fee, set by Visa, Mastercard, Discover, and American Express. This fee goes to the cardholder's bank and typically ranges from 1.5% to 3.5% of the transaction amount, depending on the card type and how the transaction was processed. You cannot negotiate interchange fees — they are fixed by the card networks.

The second layer is the assessment fee, also set by the card networks. This is usually 0.1% to 0.3% of the transaction amount and goes to Visa, Mastercard, or whichever network the card belongs to. Like interchange, you cannot negotiate this fee.

The third layer is the processor markup, which is what your payment processor charges on top of interchange and assessment. This is where you have room to negotiate. Processors typically add 0.5% to 2% to the transaction, or charge a flat per-transaction fee (often $0.20 to $0.30), or both. Some processors also charge monthly fees, batch fees, or statement fees. When a processor advertises a rate like "2.9% plus $0.30," they are quoting interchange plus their markup, not the total cost.

Your monthly statement breaks down every fee by category. Check it carefully — processors sometimes miscategorize transactions, charging a higher interchange rate than the card actually may have access to for, which inflates your costs. If you spot an error, contact the processor and ask for a credit.

In-person payments: terminals, readers, and point-of-sale systems

If you take payments face-to-face, you have three main options. A traditional point-of-sale terminal is a dedicated machine that sits on your counter, reads cards, and prints receipts. These are common in retail and restaurants. A mobile card reader is a small device that plugs into a smartphone or tablet and lets you take payments anywhere — useful for markets, service calls, or pop-up shops. A countertop payment gateway is software on a tablet or computer that displays a form for the customer to enter their card details themselves.

The equipment choice affects your fees. Swiped or inserted cards (where the customer hands you the card or inserts it themselves) may have access to for lower interchange rates than keyed-in transactions (where you type the card number). Contactless or chip payments are more secure than magnetic stripe and also may have access to for better rates. If a customer's card is not present — you are taking payment over the phone or they are not there — the transaction is classified as "card not present" and charged at a higher interchange rate.

Most payment processors offer equipment for free or a small upfront cost, then recoup it through higher processing fees. Some charge monthly rental fees instead. Compare the total cost over a year, not just the upfront price. If you process fewer than 50 transactions per month, a mobile reader often makes sense because you avoid monthly terminal fees. If you process hundreds per month, a traditional terminal or integrated point-of-sale system usually costs less overall.

Online and phone payments: payment gateways and hosted forms

For online sales, you need a payment gateway — software that encrypts the customer's card details and sends them securely to your processor. The gateway sits between your website and the acquiring bank. Popular gateways include Stripe, Square Online, PayPal, Authorize.net, and 2Checkout. Some gateways are processor-agnostic (you can use them with any processor), while others are tied to a specific processor.

A hosted payment form is a page hosted by the gateway where the customer enters their card details. You never see the card number — it goes directly to the gateway. This is the simplest and most secure option for small businesses because you do not have to handle card data yourself, which reduces your PCI compliance burden. The downside is that the customer leaves your website to enter payment, which can lower conversion rates slightly.

A self-hosted form is a payment form on your own website. This requires you to meet higher PCI compliance standards because card data passes through your server. Most small businesses should avoid this unless they have a developer managing the security. An API integration lets your website communicate directly with the gateway, passing card details securely without displaying a separate form. This is more complex to set up but gives you full control over the customer experience.

For phone payments, you enter the card number into the gateway manually or use an interactive voice response (IVR) system where the customer enters their card details on their phone keypad. Phone payments are classified as "card not present" and charged at higher rates. If you take phone payments regularly, ask your processor about a dedicated phone payment system — some offer lower rates for this.

Chargebacks: what happens when a customer disputes a charge

A chargeback occurs when a customer contacts their bank and disputes a charge on their statement. The bank reverses the transaction and returns the money to the customer's account, then notifies your processor. You lose the sale amount plus a chargeback fee (typically $15 to $100, depending on the processor). The chargeback also counts against your chargeback ratio — if your ratio gets too high, your processor can terminate your account.

When you receive a chargeback notice, you have a window to respond — usually 7 to 10 days, though this varies by card network. You can submit evidence that the transaction was legitimate: a signed receipt, an email confirmation, a tracking number for a shipped item, or a photo of the customer receiving the service. If you provide convincing evidence, the bank may reverse the chargeback. If you do not respond or your evidence is weak, you lose the dispute and keep the chargeback fee.

Common chargeback reasons include "customer did not authorize the transaction," "product not received," "product not as described," and "duplicate charge." To reduce chargebacks, use clear billing descriptors (so the charge is recognizable on the customer's statement), send order confirmations and shipping notifications, keep detailed records of all transactions, and respond quickly to customer complaints before they escalate to chargebacks. If a customer claims they did not receive an item, ask for a tracking number showing delivery before processing a refund.

If your chargeback ratio exceeds a threshold set by the card networks (usually 0.5% to 1% of transactions), your processor may require you to pay a higher fee per transaction or terminate your account entirely. Some processors offer chargeback protection insurance, which covers the chargeback fee if you meet certain conditions — read the fine print to understand what is covered.

PCI compliance: security requirements for handling card data

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security rules that apply to any business handling credit card information. Compliance is not optional — it is a legal requirement imposed by the card networks. The specific rules depend on how many transactions you process annually.

If you process fewer than 20,000 Visa transactions per year (or fewer than 20,000 transactions across all card networks), you are in the lowest compliance tier. You must use a PCI-compliant payment processor, never store full card numbers, and complete a self-assessment questionnaire (SAQ) annually. Most small businesses fall into this category.

If you process more than 20,000 transactions per year, you move into a higher tier with stricter requirements. You may need to undergo a formal security audit by a may have access to security assessor, install a firewall, use encryption, and implement access controls. The cost of compliance increases significantly at this level.

The easiest way to stay compliant is to use a hosted payment form or a PCI-compliant payment processor that handles the security for you. Never store card numbers in a spreadsheet, email, or unencrypted file. If you use a point-of-sale system, make sure it is PCI-certified. If you are unsure whether your setup is compliant, ask your processor — they can tell you what tier you are in and what you need to do.

Comparing payment processors: what to look at beyond the rate

When choosing a processor, the fee rate matters, but it is not the only factor. Compare the total cost over a year, including monthly fees, per-transaction fees, batch fees, and any other charges. A processor with a lower percentage rate but higher monthly fees might cost more than one with a slightly higher percentage but no monthly fee.

Check the contract terms. Some processors lock you in for a year or more; others let you cancel month-to-month. Early termination fees vary widely — some charge nothing, others charge $300 or more. Read the fine print on rate increases. Some processors reserve the right to raise your rate after the first year without notice.

Look at the equipment options and costs. Does the processor provide free equipment or charge rental fees? Can you use your own equipment, or are you locked into theirs? If you need to integrate with accounting software like QuickBooks, does the processor offer that integration, or will you have to manually export data?

Check the support options. Do they offer phone support, or only email and chat? What are the support hours? If you take payments during evenings or weekends, make sure support is available when you need it. Read reviews from other small businesses in your industry — they often mention support quality and reliability.

Monthly statements and reconciliation: reading your processor's bill

Your monthly statement from the processor shows every transaction, every fee, and every chargeback. Learn to read it carefully because errors happen. The statement typically breaks down fees by category: interchange, assessment, processor markup, monthly fees, chargeback fees, and any other charges.

Reconcile the statement against your own records. Count the number of transactions the processor reports and compare it to your point-of-sale system or accounting software. Check that the total sales amount matches. Look for transactions you do not recognize or fees that seem wrong.

Common errors include transactions being categorized at the wrong interchange rate (which inflates the fee), duplicate charges, or fees applied twice. If you spot an error, contact the processor with the transaction details and ask for a credit. Keep records of all disputes and credits — if the same error happens repeatedly, you may have a systemic problem that needs to be escalated.

Set aside time each month to review the statement, even if it takes 30 minutes. Over a year, catching one or two errors can save you hundreds of dollars. Some accounting software can import processor statements automatically and flag unusual activity, which saves time if you process a high volume of transactions.

Frequently Asked Questions

Do I need a separate merchant account, or can my regular business bank account receive card payments?

You need a separate merchant account held with an acquiring bank. Your regular business account cannot receive card payments directly. The merchant account is designed to handle the chargeback process and regulatory requirements. Funds from card transactions are deposited into your regular business account, usually within one to three business days, but the transaction itself must flow through the merchant account first.

What is the difference between a payment processor and a payment gateway?

A payment processor is the company that handles the entire transaction — they route it to the acquiring bank, manage the merchant account, and deposit funds into your account. A payment gateway is software that encrypts and transmits card details. You need a processor; a gateway is optional depending on how you take payments. Some companies provide both services together.

Can I negotiate my interchange fees?

No. Interchange fees are set by Visa, Mastercard, Discover, and American Express and are the same for all businesses. You can only negotiate the processor markup — the fee the processor adds on top of interchange. However, you can reduce your average interchange cost by encouraging customers to use lower-cost payment methods, like debit cards or chip readers instead of magnetic stripe.

What happens if I do not respond to a chargeback?

You lose the dispute automatically. The customer keeps the refund, you lose the sale amount, and you pay a chargeback fee (typically $15 to $100). The chargeback also counts against your chargeback ratio. If your ratio gets too high, your processor can raise your fees or terminate your account. Always respond to chargebacks with evidence, even if you think the customer is wrong.

How do I know if I am PCI compliant?

If you use a hosted payment form or a PCI-compliant processor and never store full card numbers, you are compliant at the lowest tier. Your processor can tell you which tier you fall into based on your transaction volume. Complete the annual self-assessment questionnaire (SAQ) that your processor provides. If you process more than 20,000 transactions per year, you may need a formal security audit.