Payment gateways are ecommerce solutions that connect customers, merchants, and payment processors to make the near-instantaneous handling of electronic payments possible. Some payment gateways are built directly into hosted ecommerce platforms, and some are third-party services that integrate with a seller’s merchant account and website. But, regardless of how a merchant employs a payment gateway, every single online transaction flows through one, making them one of the most important tools in the industry, and one many consumers interact with constantly without ever even realizing it. 

 

How a Payment Gateway Works in an Ecommerce Transaction

Whenever a customer makes a purchase online, a multi-step process unfolds. The payment gateway is at the center of that process, acting as the hub through which all information to and from the payment processor flows. It is responsible not only for ensuring data gets from point A to point B and back, but also for keeping it safe from bad actors. The process is complex in nature, but it can be broken down into the following five basic steps:

 

Step 1) Checkout

The first step is the customer’s navigation to checkout. Depending on the ecommerce system, the payment gateway will come into play in a couple of different ways. If the merchant is using a hosted checkout, the purchase details will be sent to a page on the payment gateway provider’s server, the customer will be redirected to that site, and the payment process will commence. If the customer is using a server-to-server payment gateway, the checkout process will be completed entirely on the customer’s site, with a secure connection opened between the two upon submission. 

Step 2) Payment Submission

When the customer pays, they enter their credit card details, billing information, and shipping information, and submit their payment. When the payment is submitted, the gateway is activated, and the customer’s credit card information is transferred to the gateway. 

Step 3) Encryption and Transmission

The gateway takes in the customer’s credit card and billing address, encrypts it, and sends it to the merchant’s payment processor. The payment processor runs a series of automated fraud checks, and the transaction and payment information is then sent to the customer’s issuing bank, where another series of automated fraud checks are conducted, and the transaction is checked against the customer’s available balance. 

Step 4) Approval

After checking for fraud flags and a sufficient available credit balance, the customer’s issuing bank either approves or declines the transaction. If the transaction is approved, that information and the necessary funds are sent back to the customer’s acquiring bank through the payment processor. The funds from the transaction don’t go right to the merchant, but are held by the acquiring bank and paid out anywhere from ten hours to a few business days later.

Step 5) Notification

The transaction result is then passed back through the merchant’s payment gateway. If the transaction was approved, the payment gateway will notify the merchant’s ecommerce and inventory systems that the goods can be released. It will also send a purchase confirmation to the customer.

 

Payment Gateway Features

The primary purpose of a payment gateway is always to encrypt and transmit information between the parties involved in a transaction, but many gateways also offer a variety of value-added features, as well. Those features increase the cost of the system slightly, but offer improvements covering everything from security to merchant liability and more. 

Tokenization

Tokenization is an advanced security protocol that offers better protection from cyberattacks than standard encryption. With encryption, a customer’s sensitive payment data is technically still transmitted across the network, just in a format that requires an encryption key to reverse. That leaves it vulnerable to advanced attackers. With tokenization, the payment data is replaced entirely by a completely unrelated token, which would be useless to a hacker even if they were to intercept it. The heightened security of tokenization has made it an increasingly popular option, especially for larger merchants. 

Advanced Fraud Checks

There are multiple fraud checks performed during a standard online transaction, but sheer volume means some fraud still slips through the cracks, and when that happens, merchants can find themselves on the hook for the costs. Some payment gateways offer additional, highly-advanced fraud detection, often integrated through third-party services that exist purely to screen electronic transactions for suspicious activity. 

Off-Site Data Storage

Customers demand faster checkout options, and one popular solution is one-click checkout, which lets customers make an account and use stored payment data to make purchases in seconds. Storing payment information is also necessary for subscription-based sales that renew automatically. In both cases, storing sensitive payment information on their servers makes merchants more vulnerable to cyber attacks, significantly increasing the risk of a sensitive data breach. Some payment gateways give merchants a way around that risk by allowing them to securely store their customers’ sensitive information on the gateway provider’s site. Doing so shifts the liability for the data’s security from the merchant to the payment gateway provider, which may also reduce the merchant’s PCI compliance requirements. 

 

Every merchant conducting business online needs some kind of payment gateway. Their importance to ecommerce and the variety of value-added services that can be tacked on to them make payment gateway sales a lucrative revenue stream, and, today, more and more ISOs are tapping into it by becoming third-party resellers. IRIS CRM offers ISOs the ability to seamlessly resell gateway services, access reporting, and onboard new merchants to a number of the industry’s top payment gateway providers, including Authorize.Net, USAePay, NMI, PayTrace, and Paya. 

To find out more about how IRIS CRM’s payment gateway integration can help you open up a new stream of monthly residuals, reach out to a member of the team or schedule a guided demonstration of the platform today.