Online store payments, explained.

To accept online store payments, you need three pieces: a merchant account that receives the money, a payment gateway that securely sends card details for approval, and a shopping cart that connects your checkout to the gateway. Online sales are card-not-present transactions, so they generally cost more and carry more fraud risk than in-store sales, which makes your fraud tools and PCI setup important.

This guide covers each piece, the costs, the fraud controls and how to keep chargebacks down. For pricing and setup for a whole retail business, in store and online, see our page on retail card processing.

The three pieces and how they connect

Piece	What it does	Examples
Shopping cart	Your store’s checkout: products, cart, order details	WooCommerce and other cart platforms
Payment gateway	Encrypts card details and sends them for approval	Authorize.net, CyberSource, eProcessing Network
Merchant account	Where approved sales settle before reaching your bank	Set up through your processor

Here is the flow when a customer checks out:

1. The customer enters card details on your checkout page.
2. The gateway encrypts the details and sends them through the processor to the card network and the issuing bank.
3. The issuer approves or declines, and the answer comes back to your site in seconds.
4. You ship the order and capture the payment. Many stores authorize at checkout and capture when the order ships.
5. The sale settles to your merchant account and deposits to your bank.

Some all-in-one platforms bundle all three pieces under one flat rate. That is simple, but you can’t see the parts, and you usually can’t move one piece without moving all of them. Our guide to payment gateway vs. merchant account explains the difference in more detail.

What online payments cost

Interchange, the part the card networks and issuing banks keep, is generally higher for card-not-present sales than for chip or tap in a store. That is because the risk of fraud is higher when no one sees the card. Your total cost has three parts:

• Interchange and card-network fees, which are the same for every processor.
• Your processor’s margin, which varies and is where pricing models differ.
• Gateway fees, often a monthly fee and a small per-transaction fee.

Sending complete data helps. Address verification (AVS) and CVV checks on every order can help transactions qualify for better rates and lower fraud. See card-present vs. card-not-present rates for the full comparison.

Fraud tools for online stores

In a store, the chip proves the card is real. Online, you rely on other checks. Most gateways offer these, often as settings you turn on:

• AVS (address verification). Checks the billing address against the issuer’s records.
• CVV. Asks for the security code on the card, which should never be stored.
• 3-D Secure. Lets the issuing bank verify the customer, sometimes with a code or app prompt. It can shift liability for certain fraud chargebacks away from you, depending on card-brand rules.
• Velocity limits. Caps how many attempts a card, IP address or email can make in a set time, which stops card testing.
• CAPTCHA on checkout to block bots.
• Manual review for orders that look unusual, such as rush shipping to a different address.

Too many controls can block good customers, so start with AVS, CVV and velocity limits, then adjust based on what you see. Our guide to card fraud prevention goes further.

Selling on marketplaces and recurring orders

If you also sell through marketplaces, check how each one handles payments and payouts. Some process the payment themselves under their own rules and fees, while others connect to your own processing. Sales on your own site run through your own gateway and merchant account, so you can see and manage every part of the cost. For subscription boxes or repeat orders, store the card as a token through your gateway and get clear consent for the schedule. Our guide to recurring billing covers the details.

PCI scope and chargebacks

Every merchant that accepts cards must follow PCI DSS, the card industry’s security standard. Online stores can shrink their PCI scope a great deal by never letting card numbers touch their own servers. Use a hosted payment page or hosted payment fields from your gateway, so card details go straight to the gateway. Then your annual self-assessment is shorter and your risk is lower. Never store CVV codes, and never ask customers to send card numbers by email or chat.

Chargebacks are more common online, because the cardholder can claim they didn’t make the purchase or didn’t get the item. To reduce them:

• Use a billing descriptor customers will recognize on their statement.
• Post your return, refund and shipping policies clearly, and show them at checkout.
• Send order confirmations and tracking numbers by email.
• Answer customer emails quickly. Many chargebacks start as unanswered complaints.
• Keep proof of delivery for higher-value orders.

What PayZoom does

PayZoom sets up online payments to fit the cart you already use, including WooCommerce, Amazon and Walmart+, with gateways such as Authorize.net, CyberSource and eProcessing Network. We don’t sell proprietary software, so you keep your store as it is. We recommend Interchange-Plus pricing, and for Interchange-Plus merchants our margin above interchange never increases, in writing. Processing is as low as 0.05% + $0.22 per transaction, depending on your setup.

We help you stay PCI compliant and never charge a non-compliance fee, and there are no early termination fees. Send us a recent statement for a free analysis, or call 866.242.4325 to talk with a real person.