Ecommerce and online payments: how they work and what they cost

Key takeaways

Online payment cost formulas

Worked example (illustrative numbers)

An online store with $60,000 in monthly sales across 800 orders (average $75). All numbers are illustrative.

• Processing at 2.9% + $0.30: ($60,000 × 2.9%) + (800 × $0.30) = $1,740 + $240 = $1,980
• Gateway: $25 monthly + (800 × $0.05) = $25 + $40 = $65
• Chargebacks: 4 × ($75 + $20) = $380
• All-in cost = $1,980 + $65 + $380 = $2,425
• All-in rate = $2,425 ÷ $60,000 ≈ 4.04%, compared with a 3.30% processing-only rate ($1,980 ÷ $60,000)
• Cutting chargebacks from 4 to 2 would save 2 × $95 = $190 per month in this example

Illustrative numbers only. Your costs depend on your provider, card mix and how you accept payments.

How online payments work

When a customer clicks pay, your checkout collects card or bank details. A payment gateway encrypts that data and sends it to the processor, which routes the authorization request through the card network to the customer's bank. The approval comes back in seconds. Later, sales are settled and funds are deposited, minus fees.

Many providers bundle the gateway and processor. Others let you pick a gateway separately. Our guide to the payment gateway vs payment processor covers that choice in more detail.

Checkout options: hosted, embedded and API

How you build checkout affects both your security work and the customer experience:

• Hosted checkout: the customer is sent to a provider-hosted payment page. Simpler PCI scope, less design control.
• Embedded fields: payment fields appear on your page but are served by the provider, keeping card data off your servers.
• Direct API: full control, but more security responsibility. Usually for larger teams with developers.
• Ecommerce platform plug-ins: prebuilt connections for common shopping-cart software.

Source: PCI Security Standards Council: Standards

Virtual terminals and payment links

A virtual terminal is a secure web page where your staff key in card details for phone or mail orders. Keyed transactions usually cost more than in-person ones and carry more fraud risk, so use address and security-code checks every time.

A payment link is a URL you send by email or text that opens a secure payment page for a set amount. Links are useful for invoices, deposits, custom orders and social-media sales without a full website. They are also card-not-present, so pricing and fraud considerations are similar to a website checkout.

Card-not-present fees and fraud

Card networks set different interchange categories for card-present and card-not-present sales. Online transactions often fall into higher-cost categories, and flat-rate providers usually charge a higher online rate. Fraud risk is higher too, because there's no physical card to verify.

Common fraud tools include address verification, card security-code checks, 3-D Secure authentication, velocity limits and risk scoring. Each tool can also decline good customers, so tune them and watch your approval rate as well as your fraud rate.

What to look for

• Separate quotes for online, keyed and in-person rates
• Gateway fees: monthly, per-transaction and any setup fees
• Included fraud tools and what costs extra
• Chargeback fees and dispute tools
• Tokenization for saved cards and recurring payments
• Platform compatibility and how payouts reconcile to orders
• Funding speed and any reserves on new online accounts

Payouts, refunds and reconciliation

Online payouts rarely equal your order total. Fees, refunds, chargebacks and reserves are often netted out before the deposit, and payouts may combine several days of orders. Match each payout to the orders, refunds and fees it includes, ideally with a report that maps payout IDs to order numbers.

Refunds usually return the sale amount to the customer, but some providers keep the original processing fee. Ask how refunds are priced, because a business with a high return rate can pay noticeably more than its quoted rate suggests.

If you sell on more than one channel, such as your own website, a marketplace and payment links, track the all-in rate for each. Channels with similar sales can have very different costs once fees, refunds and disputes are included.

Security responsibilities online

Every business that accepts cards must protect card data under the PCI Data Security Standard. Using hosted or embedded payment fields and tokenization can reduce how much of that work falls on you, but it doesn't remove it. Keep software updated, use strong access controls and complete any required self-assessment. Check current PCI requirements and talk to your provider about which apply.

Source: PCI Security Standards Council: Standards

Common mistakes

• Comparing only the processing rate and ignoring gateway and chargeback costs
• Storing card numbers on your own systems instead of using tokens
• Turning fraud filters so tight that good customers are declined
• Using a virtual terminal without address or security-code checks
• Not matching payouts to orders, which hides fees and refunds

Official sources to check

Rules change. Check current rules at the source and talk to your advisor before you act.

• PCI Security Standards Council: Standards
• Visa Core Rules and Visa Product and Service Rules (public PDF)
• Mastercard: Rules and standards

Common questions