E-Commerce Payment Gateways Explained

Shoppers see Pay. Operators see a stack: method, gateway, processor, and settlement. Mixing those words is how stores blame “the gateway” for an issuer decline or blame “Visa” for a plugin timeout.

This article is conceptual. It is not an endorsement of any brand, and it is not a way to bypass fraud or authentication checks.

Gateway vs processor vs method

Payment method: card, wallet, bank redirect, BNPL, COD, gift card. The customer’s choice.

Payment gateway: the software integration that tokenizes or redirects, shows the form, and returns success/fail to your store. It is an API and often a JS field.

Processor / acquirer: the party that talks to card networks or local schemes and settles funds to your merchant account. Sometimes the same company as the gateway; often not.

Merchant of record: who appears on the bank statement and who is liable for refunds and chargebacks. For most D2C stores, that is you (or a marketplace if they are MoR).

Layer	Job	If it fails
Method	Customer can pay how they prefer	They bounce or pick COD
Gateway	Session, tokenize, 3DS/OTP handoff	Timeout, double click, blank return URL
Processor	Authorize and capture	Issuer decline, velocity rules
Your store	Create order, stock, email	Paid with no order, or order with no pay

Platforms wrap this differently. Shopify vs WooCommerce changes which providers you can enable and how checkout is customized—not the underlying definitions.

Cards, UPI, wallets (conceptual)

Cards. Authorization (is the money reservable?) then capture (take it). Some flows authorize at checkout and capture at dispatch. 3-D Secure / issuer authentication is friction that exists to reduce fraud; turning it off is not a conversion tip we will give.

Account-to-account rails (for example UPI in India, or other local schemes elsewhere). The customer approves in a bank or PSP app. Your job is a correct amount, a correct return URL, and reconciliation of the payment ID to the order. These rails can have high success where they are default—and they are still not “free of failures.”

Wallets. Stored instruments or wallet balances (regional brands vary). They reduce typing; they add another app switch and another decline reason.

Offer the methods your audience and ticket actually use. A wall of logos you did not enable is a trust problem. A missing method that is default in your market is a conversion problem—measure it with the conversion rate calculator.

Tax on the invoice (GST/VAT) is not a gateway feature; it is a catalog and tax-engine problem. The GST calculator is for amounts, not for filing.

Failure handling

Most “checkout is broken” tickets are declines, timeouts, or user-abandoned OTP. Treat them as a funnel:

1. Log gateway response codes (do not show raw codes to customers).
2. Distinguish do not retry (stolen card, hard fraud) from safe retry (network timeout)—see Payment Failures and Checkout Recovery.
3. Offer a second method after a decline, not a loop on the same instrument.
4. Reconcile daily: paid-in-gateway vs orders-in-store.

Do not collect extra ID scans or card photos to “increase success.” That is extra PII, extra abandonment, and not how authorization works.

Fees and settlement

Blended merchant discount rates, per-transaction gateway fees, international premiums, and chargeback fees all sit in contribution. Settlement delay is a cash-flow input like COD remittance.

Refunds are a second transaction. Partial refunds and cancelled authorizations should match what you tell the customer.

What to implement before you scale ads

• Webhooks (or equivalent) so a late success still creates an order.
• Idempotency: one pay click ≠ two captures.
• A support view: last four / wallet id, amount, status—without storing PAN.
• Test mode plus a live $1 test on each method.

Capture timing and inventory

Authorize at checkout, capture at dispatch reduces charging people for orders you cannot ship. It also creates a window where authorization expires. Your OMS must recapture or void cleanly. Capture at checkout is simpler and ties up customer funds earlier.

Neither is “more converting” in the abstract. Mismatched stock plus capture-at-pay is refund work. Mismatched authorization expiry plus capture-at-ship is surprise declines on the warehouse day.

Partial shipments need a payment model (capture remaining, second charge) that the gateway and the customer email both understand.

Chargebacks and evidence

A gateway is not your dispute lawyer. Keep: order timestamp, IP/device if you collect it lawfully, tracking, customer communication. Do not keep card images. Friendly fraud and true fraud look the same in a decline code; your process still should not include phishing the customer for secrets.

3-D Secure shifts some liability under card-network rules when it is used correctly. It is not a reason to skip basic fraud velocity checks on gift-card-heavy SKUs.

Picking a provider without a beauty contest

Compare: methods in your markets, settlement currency, payout speed, sandbox quality, webhook reliability, total cost on your average ticket (use a real margin sheet), and who owns PCI. Shopify-native vs third-party is a platform constraint as much as a fee constraint.

Local methods (for example UPI where you sell in India) belong in the test plan, not as a logo row you never enabled. A missing default rail is a conversion leak you will mis-attribute to the theme.

The conversion optimization guide includes checkout. Payment is not a plugin logo. It is the path from intent to settlement, with a documented failure path.