Ecommerce Merchant Accounts: How to Accept Payments Online

When a customer clicks "Pay" on your site, four parts work together in a few seconds:

1. Your website or shopping cart collects the order and the card details, or hands the customer to a secure payment page.
2. The payment gateway encrypts the card data and sends it to the processor. The Authorize.Net payment gateway and Cybersource are two common choices.
3. Your merchant account sends the request through the card network to the customer's bank, which approves or declines it.
4. Your bank account receives the deposit once the day's sales settle, minus processing fees.

The gateway and the merchant account are separate products, and people often mix them up. The gateway moves the data. The merchant account is the banking relationship that lets you take cards at all. You need both, and they have to be connected.

That's the difference from a payment app. With an app, your sales run under the app's own merchant account alongside thousands of other businesses. With your own merchant account, a bank underwrites your business up front and the account is in your name. Our guide to merchant accounts vs payment facilitators explains what that changes.

Every card sale carries interchange, a fee set by the card network and paid to the customer's card-issuing bank. It's the largest part of what you pay. When the card isn't physically there, the risk of fraud is higher, so interchange is higher too.

Here's how Visa's U.S. interchange compares for consumer credit cards, from its schedule effective April 18, 2026. Visa now calls the card-not-present category "Product 1" and card-present "Product 2."

On a $100 order paid with a Traditional card, that's $1.99 in interchange online versus $1.61 in a store. Card network fees and your provider's markup come on top of interchange. The interchange-plus pricing guide shows how those three parts add up on a statement.

Tokens and authentication can lower it

Visa's April 2026 schedule also lists reductions for card-not-present consumer credit transactions that qualify:

• 0.05 percentage points less when the payment uses a Visa token (a stand-in number that replaces the real card number).
• 0.10 points less when the payment qualifies under the Visa Digital Commerce Authentication Program, which covers transactions where the customer is authenticated at checkout.
• 0.15 points less when both apply.

Visa says these reductions are subject to change, and a transaction has to meet its qualification rules. Whether you get them depends on your gateway, your processor and how your checkout is built, so ask your provider which of your transactions qualify.

How your checkout collects card numbers decides how much of the security standard, PCI DSS, applies to you. As of September 2026, PCI DSS v4.0.1 is the only active version. Most small online stores confirm compliance each year with a Self-Assessment Questionnaire (SAQ).

• Hosted payment page: the card form is served by your gateway, so card data never touches your server. Authorize.Net says its Accept Hosted page keeps you at SAQ A, the shortest questionnaire.
• Your own form with the gateway's script: the card data still goes straight to the gateway, but your site controls the page. Authorize.Net places Accept.js with your own form at SAQ A-EP, which is longer.
• Card data passing through your server: the widest scope and the most work. Most small businesses avoid it.

One recent change: SAQ A was revised in January 2025, effective March 31, 2025. It now asks you to confirm your site "is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s)." A hosted page is still the simplest path, but keep the pages that lead to it secure too.

For the details, see Authorize.Net integration methods and our guide to PCI compliance for merchants.

Most online stores run on a shopping cart or ecommerce platform. The question to ask isn't "which cart takes cards?" but "which cart connects to my gateway?"

Authorize.Net connects to a long list of carts and billing systems through plugins and built-in integrations. Once your merchant account and gateway are set up, you usually enter your gateway credentials in the cart's payment settings and run a test order.

A few things to check before you commit:

• Is the integration current? Some older Authorize.Net connection methods are deprecated. Make sure your plugin uses a supported one.
• Does the platform charge extra when you use your own gateway instead of its built-in payments?
• Where are saved cards stored? If you plan to store cards for repeat buyers or subscriptions, find out whether they live in the gateway or the cart.

The Authorize.Net shopping cart integrations guide covers the major platforms one by one.

Plenty of online businesses also take orders by phone, email or mail. In payments these are called MOTO (mail order/telephone order) transactions. They're card-not-present too, so they're priced and underwritten much like website sales.

You don't need a separate cart for them. A virtual terminal lets you key a card into a secure web page from any browser, and many gateways can email an invoice or a payment link so the customer pays on their own. See the Authorize.Net Virtual Terminal guide for phone, mail and invoice payments.

Tell your provider on the application how much you expect to take by phone or mail. A merchant account approved for web sales only may need an update before you key a large volume of phone orders.

If you sell memberships, subscriptions or payment plans, your gateway needs to charge saved cards on a schedule. Authorize.Net does this with Automated Recurring Billing (ARB), which bills at intervals from 7 to 365 days or 1 to 12 months. Its Customer Information Manager (CIM) stores card details so you don't have to.

Card network rules matter as much as the software. Visa, for example, has rules for free trials and introductory offers that turn into subscriptions, including the customer's express consent and an easy way to cancel. Our summary of Visa's subscription rules lists them. For setup, see Authorize.Net Automated Recurring Billing.

Before a bank approves an ecommerce merchant account, an underwriter reviews your business. For online sellers, your website is part of the application. Underwriters usually look at:

• What you sell and whether the products are clearly described and priced.
• Your website's required information. Visa's rules require customer service contact details, your business's country shown within the checkout pages, an address for cardholder correspondence and your policy on orders shipped in more than one delivery.
• Refund, return and cancellation policies. If you limit refunds, Visa requires you to disclose that during checkout with a "click to accept" button, a checkbox or a similar acknowledgement.
• Shipping and delivery times, privacy policy and terms of service.
• Your processing history, if you have one: recent statements, dispute levels and average order size.
• Your business and owner details: business registration, owner ID and a business bank account.

Missing pages are one of the most common reasons an online application slows down. The website requirements checklist covers each one, and how to get a merchant account walks through the full application.

After approval, keep fraud and disputes low. Online stores see more fraud than shops, so learn the warning signs of card-not-present fraud and the basics of chargeback prevention before your first big sale.

Authorize.Net and Cybersource refer merchants to START for the merchant account behind their gateway. START finds the right acquiring bank for your business, underwrites the account and sends the details back so your gateway is connected.

• START is a registered MSP/ISO of Elavon, Inc., with more than 20 years of working with Authorize.Net and more than 60,000 Authorize.Net accounts set up.
• Most merchants are approved in 1–5 business days, and the Authorize.Net gateway is usually set up within 24 business hours of approval.
• Pricing is interchange-plus, with no termination, annual or AVS fees, and lower Durbin debit fees passed through to you.

Already processing online? Merchants who switch save 20% on average. Send your latest statement for a free rate review and we'll show you what you're paying now. Or see our overview of merchant accounts for the rest of the series.