When you enter your card details on a website and click buy, a payment gateway handles the rest. It encrypts the card data, sends it to the payment processor, and routes the response back to the merchant. If the card is approved, the transaction proceeds. If not, the customer sees an error. The gateway is the digital equivalent of a card terminal in a store.

The gateway does several things. It encrypts sensitive data to protect it in transit. It communicates with the acquiring bank, the issuing bank, and the card network. It checks for fraud using rules and machine learning. It returns an authorization code or a decline reason. It also handles refunds, voids, and chargebacks. Some gateways are standalone. Others are bundled with payment processors like Stripe, Square, or PayPal.

The gateway fees vary. Some charge a monthly fee plus a per-transaction fee. Others charge only a percentage of each sale. Stripe charges 2.9 percent plus 30 cents for online card payments. Square charges 2.6 percent plus 10 cents for in-person payments. The fees add up for high-volume merchants, which is why some negotiate custom rates.

Security standards matter. The Payment Card Industry Data Security Standard, or PCI DSS, sets requirements for handling card data. Merchants that use a compliant gateway reduce their liability. Those that store card data themselves face higher costs and greater risk. The gateway is not just a convenience. It is a compliance tool.