Every online purchase ends with a button. You click Pay, a spinner turns for two seconds, and a confirmation page appears. In that gap, a card payment passes through at least five separate organizations, and the one most people have heard of, the payment gateway, is only the first.

The confusion is understandable. Vendors use “gateway,” “processor,” and “merchant account” loosely, sometimes as synonyms, sometimes for a bundle. The loose language hides a very precise sequence.

The volume behind it is enormous. The Federal Reserve’s latest payments study counted 236.6 billion noncash payments in the United States in 2024, and cards made up almost four in five of them by number. Each of those card payments followed the same route described below.

Think of the gateway as the security checkpoint at an airport. It does not fly the plane or sell the ticket. It checks that the traveler is who they say they are, screens out anything dangerous, and hands them to the next stage. Everything after the checkpoint happens out of the traveler’s sight.

Where Payment Processing for Nonprofits Fits in the Same Chain

One group of merchants illustrates the chain especially well. A charity collecting a $50 donation, or an association collecting annual dues, sends that payment through exactly the same hops as an online store selling a pair of shoes.

That matters for compliance. The PCI Security Standards Council’s tokenization guidelines make the point plainly: if your environment can retrieve a full card number, that environment is in scope for PCI DSS, whether you are a retailer or a volunteer-run nonprofit.

Guides written for buyers of nonprofit financial software, including this detailed look at payment processing for nonprofits, spend most of their length on these same layers: what a gateway does, what a processor does, why a merchant account is separate, and how fees stack up on each hop. The vocabulary is identical. Only the use case changes.

So the chain below applies to a donation form as much as to a checkout cart. Keep both in mind as you read.

The Seven Hops of a Card Payment

Here is the full route, in order.

Hop one, checkout. The customer enters card details on your page or in a form hosted by the gateway. A hosted form means the data never touches your server, which is the single biggest decision you will make for PCI scope.

Hop two, the gateway. The gateway encrypts the card data, runs basic fraud checks such as address verification and CVV matching, and formats the request into the message standard the networks expect. It then forwards it to the processor.

Hop three, the processor. Also called the acquirer, it works on behalf of your merchant account and routes the request to the right card network based on the first digits of the card number.

Hop four, the card network. Visa, Mastercard and the others do not hold money. They are switching systems that pass the request to the bank that issued the card and set the rules everyone follows.

Hop five, the issuing bank. The customer’s bank checks the account, the available balance or credit, and its own fraud models. It answers with an approval code or a decline reason.

Hop six, the return trip. The answer flows back through the network, the processor and the gateway to your checkout page. This is the two-second spinner.

Hop seven, settlement. Later, usually in a nightly batch, the approved transactions are submitted for settlement, and funds move from the issuing bank through the network to your merchant account, minus fees.

Authorization Is Not Money

The most common misunderstanding is that the approval code means you have been paid. It does not. An authorization is a promise from the issuing bank that the funds exist and are reserved. The money itself arrives at settlement, usually a day or more later depending on your processor and your batch timing.

Fees are taken here. Interchange goes to the issuing bank, an assessment to the network, and a markup to the processor and gateway. Together they come to a percentage of the sale plus a fixed amount per transaction, which is why the net deposit is always smaller than the sale.

Tokenization and Why Your Server Should Never See a Card Number

Tokenization replaces the real card number with a random stand-in, the token, that is useless outside the gateway that issued it. Your system stores the token for refunds and recurring charges. The gateway keeps the mapping in a hardened vault.

This is different from encryption. Encrypted data can be decrypted by anyone holding the key. A token has no mathematical relationship to the card number at all. For recurring donations, memberships and subscriptions, tokens make a stored payment method possible without storing what attackers want.

ACH Takes a Different Road

Not every online payment is a card. ACH moves money directly between bank accounts through a clearing house rather than a card network. There is no real-time authorization, no interchange and no issuing bank approval while the customer waits. The payment is submitted, batched, and settled, often by the next business day.

The scale is larger than most people assume. Nacha reported 35.2 billion payments on the ACH Network in 2025, worth $93 trillion. For a gateway, supporting ACH means a second protocol, handling returns for insufficient funds, and accepting that the money is not confirmed for a day or two.

Chargebacks, the Flow in Reverse

A chargeback runs the whole chain backward. The cardholder contacts the issuing bank, the bank pulls the funds from the merchant account through the network, and the merchant is asked for evidence. Under US billing error rules a cardholder has 60 days from the statement to dispute a charge, and the issuer must acknowledge within 30.

Gateways help by storing the authorization data, the AVS and CVV results and the IP address at payment time, which is often the difference between winning and losing the dispute.

Key Takeaways

A payment gateway is the secure front door, not the whole house. It encrypts and screens card data and passes it to a processor, which routes it through a card network to the issuing bank. An authorization reserves funds; settlement moves them, net of fees. Tokenization keeps card numbers out of your systems. ACH skips the card networks. A chargeback is the same route in reverse.

Frequently Asked Questions

Is a payment gateway the same as a payment processor?

No. The gateway captures and secures the card data at checkout. The processor routes the transaction to the networks and settles funds into the merchant account. Many vendors sell both as one product, but they are distinct functions.

Do I need my own merchant account to accept cards?

Not necessarily. Aggregators provide a shared account that is faster to set up and carries higher per-transaction fees.

Does tokenization remove PCI DSS requirements?

No. It reduces scope by keeping card numbers out of your systems, but the remaining systems still have to meet the standard.

Conclusion

The two-second spinner hides a well-defined relay: checkout to gateway, gateway to processor, processor to network, network to issuer, and back, followed later by settlement. Once you can name each hop, the fees make sense, the compliance scope makes sense, and so do the design choices, such as hosted forms and tokens, that keep card data away from your servers. Whether the payment is a shoe order or a donation, the road is the same.