Online payment processing is becoming increasingly important for small businesses. According to the U.S. Census Bureau, e-commerce sales in the U.S. hit $340.2 billion in the second quarter of 2026. E-commerce sales comprised 17.1% of all retail sales, up from 16.3% a year earlier. E-commerce sales grew at a faster rate than overall retail sales, which rose by 6.7% from the same period the year prior.
Selling online is different from in-person sales. Each sale comes with different costs and different levels of risk. When a payment is made online, the card network will classify the purchase as a “card-not-present” transaction. This classification dictates the interchange rate, determines who is responsible for chargeback and fraud losses, and sets the security standard for the merchant. This article will discuss how to accept payments online and will cover online payment gateways, payment fees, and how a small business can process payments online within a week.
Online credit card payments go through the same series of participants. The customer’s bank is the issuer. The merchant’s bank or processor is the acquirer. The card network (e.g., Visa, Mastercard) is in the middle. The payment gateway is the software that captures the payment information at checkout and sends it to the above chain.
Each payment is made up of two parts. The first part is authorization. The gateway sends the card information and the amount to the acquirer, and the card network routes the information to the issuer for approval or denial. The second part is settlement. If the transaction is approved, the funds are batched and cleared, and the issuing bank sends the funds to the acquirer, and the acquirer gives the merchant the funds, less its fees.
The majority of small businesses do not set up a separate merchant account and gateway. They sign up with a payment service provider that bundles the gateway, processing, and merchant account into a single contract, usually with no monthly or setup fee on its standard plan.
Interchange rates are set by the card networks (e.g., Visa) and determine the fees the banks charge each other for a card transaction. Effective April 2026, Visa’s U.S. interchange schedule splits its tables into “card-present” and “card-not-present” transactions. Transactions where the customer types a card number into a website or application will fall in the “card-not-present” table. The same document from Visa states that merchants do not pay interchange fees directly. The fee the financial institution charges the merchant for accepting a card payment bundles the interchange and other fees.
The setups for ecommerce payment processing follow a few models. Each has trade-offs with respect to how much of the checkout process the business controls, and how much security-related paperwork it has to do. This paperwork is the PCI DSS (Data Security Standard) self-assessment questionnaire (SAQ) published by the PCI Security Standards Council.
The least-burden level is the use of payment links. The business creates a link to a payment page and sends it to the customer. The page that receives the payment is hosted by the payment provider. Most providers include payment links on their standard plan, which makes them a way to take payments without hardware or a website.
One level up from payment links is hosted checkout. The business sends its customers to a payment page that is completely controlled by the payment provider. Alternatively, the business can embed the provider’s payment page in an inline frame. Some providers charge a small monthly fee to run the hosted page on the merchant’s own domain.
The final, and most burdensome, option is direct integration. The payment processor gives the merchant a JavaScript library or an API, and the burden is on the merchant to integrate card payment fields in its checkout. Because the merchant controls the design of the checkout, this option is sometimes called Complete Integration. This option, however, also carries a heavier PCI assessment burden.
The PCI Security Standards Council has clarified one rule for these scenarios in their FAQ 1588. According to PCI DSS v4.0.1, for merchant sites to qualify for SAQ A, they must protect their pages from script attacks. Merchants may either protect their pages from script attacks and provide the documentation to that effect or obtain a letter from their PCI DSS-compliant provider confirming protection from script attacks.
Merchants that neither embed payment forms nor protect their pages from script attacks, i.e., those that redirect customers to a provider or that send payment links via email, are outside the scope of the script attack criterion. The acquirer or provider determines which SAQ applies to a given merchant, and a qualified security assessor (QSA) may review edge cases.
| Setup | How the customer pays | PCI self-assessment usually involved |
| Payment link | Clicks a link sent by email, text or social post and pays on the provider’s page | SAQ A; the iframe script criterion does not apply |
| Hosted checkout (redirect) | Leaves the merchant’s site and pays on the provider’s page | SAQ A; the iframe script criterion does not apply |
| Hosted checkout (embedded iframe) | Stays on the merchant’s page; the card fields are served by the provider | SAQ A, with script-attack protection confirmed by the merchant or the provider |
| Merchant-controlled payment form (for example, direct post) | Enters card details into a form the merchant’s site creates; card data goes straight to the provider | SAQ A-EP |
| Card data received or stored on merchant systems | Card details pass through the merchant’s own servers | SAQ D |
Card payments comprise three costs: Interchange, assessments, and processor markups. Issuing banks keep interchange. The card networks keep assessments. The processor, and subsequently the merchant service provider (MSP), keep the markups. Some providers bundle the three costs and charge a single percentage and per-transaction flat fee.
The interchange fees account for most of the difference in prices between in-person and online transactions. According to Visa’s April 18, 2026 schedule, interchange for a standard consumer credit card is 1.51% and $0.10 for a card-present transaction. For a transaction to occur online, the interchange for that card is 1.89% and $0.10. So for a card-present transaction of $100, the fee for Visa would be $1.61.
For the same Visa card to be used for an online transaction, the fee would be $1.99. Debit cards for exempt issuers have interchange for card-present transactions of 0.80% and $0.15, and 1.65% and $0.15 for card-not-present transactions. For debit cards that are issued by banks covered by Regulation II of the Federal Reserve, interchange is capped at 0.05% and $0.21 for both card-present and card-not-present transactions.
Visa also has a tiered program that has lower credit card rates for smaller merchants that process $280,000 or less in Visa consumer credit card sales each year. The rate for card present transactions is 1.29% plus $0.10; card not present transactions is 1.58% plus $0.10. Visa provides further card not present rate reductions of 0.05%-0.15% for transactions done with EMV tokens and Visa’s Digital Commerce Authentication Program. Merchants on flat-rate pricing do not see these reductions; merchants on interchange-plus pricing do.
Payment service providers on flat-rate pricing publish a single percentage plus a fixed amount per online transaction. Across the major providers in October 2026, standard online rates ran from about 2.9% plus 30 cents to about 3.5% plus 49 cents, with surcharges of 0.5% to 1.5% for manually keyed cards and international cards, and a dispute fee of $15 to $20 per chargeback. Providers differ on whether the dispute fee is returned when the merchant wins.
It’s the fixed fee that matters for lower order amounts. A $10 sale with the fee at 2.9% and 30 cents would cost $0.59 or 5.9% of the sale. The fee on a $100 sale would be $3.20 or 3.2% of the sale. Businesses with low average order values should be just as concerned with the fixed fee as they are with the percentage.
Federal Reserve data has shown higher fraud rates for remote card payments for years. The Fed’s 2018 payments fraud report stated that in 2015, card-not-present (CNP) payments had a fraud rate of 14.23 basis points (bps) by value, and that card-present payments and ATM withdrawals had a combined rate of 9.32 bps. The Fed’s 2017 Annual Supplement Report states that, in 2016, remote fraud comprised 58.5% of general-purpose card fraud. The Fed attributed this shift in part to a decrease in counterfeit card fraud as a result of the industry’s shift to chip cards.
Merchants absorb the cost of fraud chargebacks on card-not-present transactions. This is changing with the adoption of 3D Secure, an authentication standard first released in 2001 and revised several times since. Under the card network rules, liability for a fraud chargeback shifts from the merchant to the card issuer on transactions where 3D Secure authentication succeeded, although the shift is not guaranteed for every payment or dispute. Most providers include 3D Secure in standard pricing; some charge a few cents per lookup.
Two basic card checks run at authorization. The first is address verification, which checks the billing ZIP code against the issuer’s records. The second is a card security code check, to confirm the buyer has the card’s three- or four-digit code. Both are included in most providers’ standard pricing; advanced fraud screening is often an add-on priced per transaction.
Visa also keeps an eye on merchants. Its Visa Acquirer Monitoring Program (VAMP) merges fraud report and dispute ratios with settled transactions. Visa’s 2025 VAMP fact sheet says the excessive merchant threshold is 150 basis points (1.5%) in the U.S., Canada, E.U., and Asia-Pacific regions. Processor documentation gives April 1, 2026 as the effective date and lists a charge of $8 per disputed transaction for merchants above the threshold. The ratio is applied once a merchant has hit 1,500 combined fraud reports and disputes in a month. Chargeback Gurus says acquirers can set more stringent limits and, as such, small merchants below Visa’s threshold can still be in violation and subject to action by their bank.
The gap between when payment is captured and when funds are made available is called settlement timing. Separate from this is the payout schedule, which is the frequency with which funds are sent to a bank. The two are set independently, and for new accounts, the first payout is often set to be longer.
Settlement timing for U.S. card payments at the major providers runs from the next business day to two business days, with ACH debits taking longer. For a new account, the first payout commonly takes 7 to 14 days depending on industry and risk review. Merchants can usually set payouts to daily, weekly or monthly, or trigger them manually.
Instant payouts to a linked bank account or debit card are available from most providers for a fee of about 1% to 1.95% of the transfer, with a minimum fee and, for new accounts, a daily cap. Funds typically arrive within 30 minutes.
There are differences in how refunds are processed and whether the processing fee is returned on a refund. Most providers do not refund the processing fee. A payout is gross sales less fees and adjustments, so reconciliation should be done against the payout report, not against order totals.
The plan assumes a payment link or a hosted checkout, and builds setup over seven days. An API build needs additional development time.
Go live, take the first payment and record the expected first payout date. The first payout depends on the provider and is commonly 7 to 14 days after the first live payment. Cash flow planning during this time should not rely on card payments.
How a small business handles payment processing depends on how it makes sales. Businesses without a website can process payment the same day via payment links. Businesses with a store site can use hosted checkout and still be on the lower end of PCI SAQ A. A direct checkout integration is best for a team that wants to be in complete control of the checkout and can dedicate development resources to build and support it.
Rates charged for in-person payments are usually lower than online rates. On a $100 domestic card sale in October 2026, published flat rates at the major providers ran from about $3.20 to $3.60 online. The Visa interchange schedule for April 2026 set a 38-cent gap between an in-person card sale and an online card sale using a standard consumer credit card. Payout speed is the other variable: standard settlement runs one to two business days, and instant transfers carry a percentage fee.
Small businesses sign up with a payment service provider and take payments through a payment link or a hosted checkout. The provider runs the payment processing and payout infrastructure.
Interchange is higher for online transactions. Visa’s rates are 1.89% + $0.10 (effective April 2026) for a standard consumer credit card used card-not-present, versus 1.51% + $0.10 for card-present.
Yes. Payment links are provided by payment service providers to allow businesses to sell online via social posts and text messages.
