How to accept credit card payments online for small business

The three pieces you need

Every online card payment passes through three things. Understanding them makes every sales pitch easier to evaluate.

• A merchant account: the account that settles card payments into your bank. Providers like International Bancard set these up.
• A payment gateway: the secure service that sends card details to be approved, such as Authorize.Net, CyberSource or Heartland.
• A payment page: where your customer actually types their card. This is the part customers see and judge you by.

Some companies, like Stripe and PayPal, bundle the merchant account and gateway into one account.

Choose where customers pay

There are four common approaches. Many businesses use more than one.

• Payment links on invoices: you email an invoice, the customer clicks and pays.
• A customer payment portal: a branded page, ideally on your own subdomain, where customers pay any invoice or statement.
• Checkout built into your site: registrations, orders or sign-ups that charge the card as part of the form.
• Recurring billing: the customer saves a card once and is charged on a schedule.

Understand PCI

PCI DSS is the security standard for anyone who handles card data. Your processor will ask you to confirm compliance every year.

The simplest way to keep your part manageable is to never touch card numbers yourself: use the gateway’s hosted or embedded secure fields so card data goes straight to the gateway, and you only ever keep a token.

Pick a gateway

If you want a dedicated merchant account and long-term stability, a gateway like Authorize.Net is a strong default. If you want to start quickly with one account, Stripe is a good option. If you already take cards in person, check what your current processor offers online so everything settles in one place.

What it costs

Plan for four kinds of cost:

• Setup: building the checkout or customer payment portal. Our standard portal is $3,750 one time or $450 a month for 12 months.
• Gateway: some gateways charge a monthly fee; all-in-one providers usually don’t.
• Processing: a percentage and/or per-transaction fee on each payment, set by your processor.
• Hosting and security: for a hosted portal, ours is $100 a month plus $99.99 a year.

Taking cards in person too

If customers also pay at your front desk, use countertop, tablet or mobile terminals from the same processor, so in-person and online payments settle to the same account and show up in one report.

Launch checklist

Before you turn payments on:

• Run test transactions for every payment type and amount.
• Confirm receipts and internal notifications go to the right people.
• Train the staff who will answer customer questions.
• Put the payment link on your invoices, statements and website.
• Watch the first few weeks of payments closely.

Frequently asked questions

What do I need to accept credit cards online?

A merchant account, a payment gateway and a payment page. Some providers combine the first two into one account.

What is the difference between a payment gateway and a processor?

The gateway securely sends card details for approval; the processor and merchant account move the money to your bank. Authorize.Net is a gateway; Stripe combines both.

Do I need a website to accept payments online?

Not necessarily. A hosted customer payment portal on a subdomain, or payment links on invoices, work even if your main website can’t take payments.

How do I keep card data secure?

Use your gateway’s secure payment fields so card numbers never touch your systems, keep HTTPS on every page, and complete your processor’s annual PCI validation.