Payment gateways explained

A payment gateway is the piece of infrastructure that takes a customer’s card details, sends them securely to their bank for authorisation, and returns a yes or no to your website for that payment. All of this happens within a few seconds. A payment gateway is not the same thing as a bank account. Understanding the distinction between the payment gateway, the payment fees it charges, and the compliance obligation it carries is what lets you compare payment gateways sensibly, rather than picking whichever one a template defaults to.

What actually happens during a payment gateway transaction

Step	What occurs
1. Customer enters card details	Ideally into fields hosted directly by the gateway, not your own server
2. Gateway encrypts and forwards the request	To the card network and the customer’s issuing bank
3. Bank approves or declines	Based on funds, fraud checks and card validity
4. Gateway returns the result	To your website, which then confirms or declines the order
5. Funds settle	Typically into your nominated bank account within one to a few business days, minus fees

The payment gateway fee structure to expect: transactions, funds and settlement

Most payment gateways charge a percentage of each payment transaction plus a small fixed fee — commonly in the range of roughly 1.5–2.9% plus a flat amount per transaction in Australia. Exact rates vary by payment gateway provider, card type and your transaction volume, and should always be confirmed directly rather than assumed from a marketing page. Some payment gateways add a monthly account fee on top of transaction fees; others do not. International cards frequently attract a higher payment processing rate than domestic ones, which matters if you expect overseas customers making payments.

Why PCI DSS compliance is your obligation, not just the payment gateway’s

The Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council, sets requirements for any business that handles card data, and the obligation applies to you as the merchant, not only to the gateway provider. The practical way most small businesses meet this obligation with minimal burden is by never touching raw card data at all. Use a gateway’s hosted payment fields or a redirect to the gateway’s own page, so the card number never passes through your server. This is both the lowest-compliance-burden option and, for most small businesses, the most sensible technical choice regardless of compliance considerations.

What changes if you build a custom checkout instead

A checkout can be built to look fully custom, with card fields styled to match your site, but still forwarding data directly to the payment gateway without touching your server. That can reach a similar compliance position to a fully hosted checkout, while looking more integrated. A checkout that genuinely captures and processes card data on your own server carries a materially higher PCI compliance burden. That means formal assessment and stricter security requirements. It is rarely the right choice for a small business without a specific reason to take it on.

Choosing between payment gateways: Square, bank settlement and merchant accounts

Square, Stripe, PayPal and eWAY are common payment gateway options in the Australian small-business market. Each payment gateway integrates differently with mainstream ecommerce platforms, and settles payments to your bank account or merchant account on its own schedule. Most mainstream ecommerce platforms integrate with more than one payment gateway. The meaningful differences between payment gateways are usually the fee structure, how quickly payments settle to your account, and the range of payment methods supported — cards, digital wallets, buy-now-pay-later services. Also worth comparing is the quality of dispute and chargeback handling when a customer disputes a payment transaction. Ask a prospective supplier which payment gateways their platform supports natively, because integrating a gateway outside that list can add real setup cost.

What a chargeback actually is, and why it matters for card payments

A chargeback is a reversal the customer’s bank starts, typically following a dispute. It can happen even after you have shipped the product, and it is out of your control. Chargebacks usually carry their own fee from the payment gateway or acquiring bank, separate from the disputed amount itself. A business with a high chargeback rate can face increased fees, or in serious cases, have its ability to process card payments restricted. Clear product descriptions, visible contact details, and a straightforward returns process — covered on returns and refunds for online stores — meaningfully reduce chargeback rates by resolving disputes before they escalate to the bank.

Multi-currency and international payments, if relevant to your payment processor

If you expect customers paying in currencies other than AUD, confirm specifically whether your chosen gateway supports multi-currency processing. Currency conversion is generally handled either by the gateway, at a rate and fee it sets, or by the customer’s own card issuer. The two produce different costs and a different customer experience. It’s worth knowing which applies, before assuming international sales work identically to domestic ones.

Buy-now-pay-later services, and what they change about settlement

Buy-now-pay-later services work differently from a standard card payment. The provider typically pays the merchant close to the full amount upfront, minus its own fee, which is often higher than a standard card processing fee. The customer then repays the provider over instalments. This means the merchant generally receives payment promptly, regardless of the customer’s repayment schedule, but at a materially higher fee than card processing. That is a trade-off worth understanding clearly before offering it. Do not just assume its fee structure mirrors standard card payments.

What settlement timing actually means for cash flow

The gap between a sale occurring and funds actually reaching your bank account — commonly one to a few business days depending on the gateway — matters more to a growing business’s cash flow than it might first appear. This is particularly true if you’re paying suppliers or staff on a schedule that assumes faster access to sales revenue than your gateway actually provides. Confirm your specific gateway’s settlement timeline explicitly rather than assuming same-day availability.

What to do next

Ask any prospective supplier which gateway they recommend for your platform and transaction volume. Also ask what the actual fee structure will be at your expected sales level, and whether the integration keeps card data off your own server. Confirm the fee structure directly with the gateway provider rather than relying on a supplier’s summary of it.

Gateway integration is one of the line items that drives what makes an online store cost more, and it’s worth understanding before comparing quotes on that basis.