What you need to set up online credit card payments

To take credit card payments online, you need three things: a way to process the payment (a payment processor or merchant account), a place to collect the card details securely (a payment gateway or form), and a business bank account where the money lands. You do not need to be a large company — small businesses, freelancers, and nonprofits all use the same basic tools.

The payment processor is the company that actually handles the transaction. They charge you a fee (usually a percentage of each sale plus a small flat fee) and deposit the money into your business bank account, typically within one to three business days. The payment gateway is the software that encrypts the card information so it never touches your own computer or server — this protects both you and your customer from fraud.

You will also need to decide where customers enter their card details. Some businesses use a hosted payment page (the customer leaves your website to enter their card on a secure page run by the processor). Others use an embedded form (the customer stays on your website but the form is powered by the processor). Both are secure; the difference is the customer experience.

Key Takeaways

  • You need a payment processor (like Stripe, Square, or PayPal), a payment gateway to encrypt card data, and a business bank account to receive deposits.
  • Payment processors charge a fee per transaction, usually 2.2% to 3.5% of the sale plus $0.30 to $0.50, though rates vary by processor and transaction type.
  • Hosted payment pages keep card data off your website entirely; embedded forms let customers stay on your site but require more technical setup.
  • You must comply with PCI DSS (Payment Card Industry Data Security Standard) rules, which means never storing full card numbers and using only certified processors.
  • Most processors offer a free trial or low-cost starter plan so you can test before committing to a full account.

Payment processors and what they cost

A payment processor is a company licensed to move money from a customer's card to your business account. The major ones used by small businesses are Stripe, Square, PayPal, Authorize.net, and 2Checkout. Each charges differently depending on how the customer pays (card present, card not present, recurring billing) and what type of business you run.

For online card payments where the customer is not in front of you, expect to pay between 2.2% and 3.5% of the transaction amount, plus a flat fee of $0.30 to $0.50 per transaction. A $100 sale might cost you $2.50 to $3.50. Some processors offer lower rates if you process a high volume of transactions or if you are a nonprofit. A few charge a monthly flat fee instead of per-transaction fees, but only if your monthly volume is high enough to make that worthwhile.

Most processors also charge for things beyond the basic transaction: refunds, chargebacks (when a customer disputes the charge with their bank), currency conversion if you take international payments, and monthly account fees if you are inactive. Read the fee schedule carefully before you sign up. Many offer a free trial period or a starter tier with lower fees so you can test the system without risk.

Choosing between hosted and embedded payment forms

A hosted payment page is a page run by your processor that you link to from your website. The customer clicks "Pay Now," leaves your site, enters their card details on the processor's secure page, and then returns to your site to see a confirmation. This is the simplest to set up — you do not need a developer — and it keeps all card data completely off your servers. The downside is that customers leave your site, which can feel less polished and sometimes increases cart abandonment.

An embedded payment form (also called an iframe or hosted field) stays on your website. The customer never leaves your page, but the form itself is powered by your processor's secure servers. Card data is encrypted before it reaches your computer. This feels more seamless to customers and usually has lower abandonment rates, but it requires more technical setup — you or a developer need to integrate the processor's code into your website.

A third option is a payment link, which is a unique URL you send to a customer (via email, text, or invoice). The customer clicks the link, sees a payment page, and pays. This is useful for invoicing, donations, or one-off payments. Most processors offer payment links for free or a small fee.

How to set up a merchant account and connect your bank

A merchant account is your account with the payment processor. To open one, you will need your business name, your business address, your tax ID or Social Security number, and your business bank account number. The processor will ask whether you are a sole proprietor, LLC, corporation, or nonprofit — this affects which rules apply to you.

The processor will verify your identity and may check your credit or business history. This usually takes a few minutes to a few hours, though some processors take one to three business days. Once approved, you connect your business bank account so deposits land there automatically. The processor will make two small test deposits to your account (usually under $1 each) and ask you to confirm the amounts — this proves you own the account.

After that, you are ready to start taking payments. The processor gives you a dashboard where you can see all transactions, issue refunds, download reports, and manage your account settings. Most also provide an API (a way for your website to talk directly to the processor) if you want to build a custom payment experience.

PCI compliance and keeping card data secure

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that protect card data. The core rule is simple: never store a full card number on your own servers. If you do, you become responsible for protecting it, which is expensive and risky. Instead, use a certified payment processor or gateway that handles the encryption for you.

If you use a hosted payment page or embedded form from a certified processor, you are already compliant — the processor handles the security. If you build your own payment form or store card data yourself, you must pass a PCI audit, which costs money and requires serious security infrastructure. Most small businesses avoid this by using a processor.

You should also use HTTPS (the "s" in https://) on your website, keep your software and plugins updated, and use strong passwords. If you are ever breached, you must notify affected customers and the processor within a set timeframe. Most processors include breach notification in their terms.

Recurring payments and subscriptions

If you want to charge customers on a schedule — monthly subscriptions, retainers, or installment plans — you need a processor that supports recurring billing. Most major processors do, but they charge slightly more per transaction (sometimes an extra 0.5% to 1%) because recurring payments have higher chargeback rates.

To set up recurring billing, you store the customer's card details (encrypted by the processor) and tell the processor to charge it on a schedule you define. The customer can usually log into a portal to update their card, pause the subscription, or cancel. You should send a reminder email before each charge and make cancellation easy — this reduces chargebacks and customer complaints.

Some processors offer subscription management tools built in; others require you to use a separate subscription platform like Recurly or Zuora. If you are just starting out, look for a processor that includes basic recurring billing at no extra cost.

Handling refunds, disputes, and chargebacks

When you issue a refund, the processor reverses the transaction and returns the money to the customer's card. This usually takes three to five business days. Most processors let you issue refunds from your dashboard, though some require you to contact support. Refunds are free or cost a small fee (usually $0.25 to $1).

A chargeback happens when a customer disputes the charge with their bank instead of asking you for a refund. The bank investigates and either sides with you or the customer. If the customer wins, you lose the money plus a chargeback fee (usually $15 to $100). Too many chargebacks can get your account closed. To reduce chargebacks, send clear receipts, describe what the customer is buying clearly, and respond quickly to customer complaints.

If a customer disputes a charge, the processor will notify you and give you a window (usually 7 to 10 days) to respond with evidence — a receipt, email confirmation, or shipping proof. Respond quickly and thoroughly; most disputes are resolved in your favor if you have documentation.

Frequently Asked Questions

Do I need a separate business bank account to take credit card payments?

Yes. Processors require a business bank account and will not deposit to a personal account. This also protects you legally and makes accounting simpler. If you do not have one yet, most banks let you open a business checking account in a few days with your tax ID or Social Security number and a small deposit.

What happens if a customer's card is declined?

The processor will tell you the transaction failed and why (insufficient funds, expired card, fraud block, etc.). You can ask the customer to try a different card or contact their bank. Most processors let you retry a failed payment once or twice automatically, which helps catch temporary issues.

Can I take payments without a website?

Yes. You can use payment links (a unique URL you send to each customer), invoicing tools, or a mobile app. Processors like Square and PayPal let you send a link via email or text, and the customer pays without you needing a website at all.

What if I want to take payments in person as well as online?

Most processors offer both. You can use a card reader (a small device that plugs into your phone) for in-person payments and a payment form or link for online payments. The same processor handles both, and you see all transactions in one dashboard.

How long does it take to get paid after a customer pays?

Most processors deposit money into your bank account within one to three business days. Some offer next-day deposits for a higher fee. Weekend and holiday deposits usually land on the next business day. Check your processor's deposit schedule before you sign up if timing matters to your business.