Payment Processing for Online Businesses
The middleman that moves money from a customer's card to a business bank account, and why the choice matters more than founders think.
A payment processor is the middleman that moves money from a customer’s card to a business bank account. When a yoga studio takes a class booking, a freelance designer invoices a client, a Shopify store sells a candle, or a coach charges a monthly retainer, the same machinery runs in the background. Card data is encrypted, sent to the card network, approved by the issuing bank, and the funds land in a payout a day or two later.
Every online business needs one. The structure of the business does not change that. A product brand on Shopify, a SaaS founder running a subscription, a course creator on Teachable, a copywriter sending Stripe invoices, a personal trainer charging through Calendly, and a marketplace operator splitting payouts between hundreds of sellers all rely on a processor to actually receive money.
The honest framing is that the choice matters more than founders think. The wrong processor can freeze the entire business in a week. A holds-prone account on PayPal, a Stripe reserve that locks 30% of revenue, an Amazon Pay disqualification, or a chargeback rate that triggers an automatic termination can stop payouts for 30 to 180 days. A business that cannot accept payments has roughly the lifespan of its cash runway, and most online businesses run on a week or two of float.
The Short Answer
If the business runs on Shopify, use Shopify Payments. If the business invoices clients or sells services, use Stripe. If the business sells courses or digital products, use Stripe or the platform’s built-in processor (Teachable, Kajabi, Thinkific). Add PayPal as a backup option only if the audience expects it. Always have at least one backup processor set up before it is needed, because account freezes happen at the worst possible moment.
At a Glance
| Term | What It Is |
|---|---|
| Payment processor | The company that moves funds from a customer’s card to the business bank account |
| Payment gateway | The technology that securely transmits card data from the checkout to the processor |
| Merchant account | A bank account designated to receive card payments, often bundled into modern processors |
| Interchange fee | The slice of every transaction paid to the customer’s issuing bank, set by Visa and Mastercard |
| Chargeback | A customer dispute that pulls the money back from the seller until the seller fights it |
| Reserve | A portion of revenue held by the processor to cover potential disputes |
| Rolling reserve | A reserve that holds a fixed percentage for a set period (often 5-20% for 6 months) |
| High-risk merchant | A business in a category processors flag for higher dispute or fraud risk |
| ACH | Direct bank-to-bank payments, slower and cheaper than card transactions |
| BNPL | Buy now, pay later. The customer splits the purchase into installments |
| PCI compliance | The security standard for any system that touches credit card data |
The Major Processors and Who They’re For
Shopify Payments. Built into Shopify, lowest fees on the platform, easiest setup. Required to avoid the 2%, 1%, or 0.5% Shopify third-party processor fee tacked on at every Shopify plan tier. A skincare brand, a candle shop, or a fashion store on Shopify is almost always better off here than on Stripe.
Stripe. Best for SaaS, online courses, services, custom checkouts, subscriptions, and marketplaces. A freelance designer sending invoices, a coach selling six-month packages, a developer running a SaaS, or a course creator with a custom landing page all sit naturally on Stripe. It is the industry standard for tech-forward businesses and has the deepest API of any processor.
PayPal. Ubiquity and customer trust, but slower payouts, hold-prone, and higher chargeback risk. A digital download seller whose audience skews older or international often sees a real conversion lift from offering PayPal, but it works best as a backup option, not a primary.
Square. Best for businesses with a physical retail or in-person component (pop-ups, markets, brick-and-mortar) plus online sales. A jewelry maker selling at weekend craft fairs and online, or a baker taking farmers market orders and shipping nationally, gets the cleanest experience from Square because the card reader and the online checkout share one dashboard.
Authorize.net plus a merchant account. Traditional setup for businesses that need an independent merchant account, often for high-risk categories or for established businesses with a legacy bank relationship.
Braintree. Owned by PayPal. Similar to Stripe but with built-in PayPal support, which is useful for marketplaces and subscription businesses that want both rails inside one integration.
Helcim, Stax. Lower-fee alternatives for businesses doing high volume that want interchange-plus pricing. A business doing $5M a year in a low-risk category can save real money here. Below that, the savings are not worth the complexity.
Fees and What You’ll Actually Pay
The standard online card rate across the major processors is 2.9% + $0.30 per transaction. A $50 sale nets $48.25 after the fee, whether that sale is a Shopify candle order, a Stripe invoice for a copywriting project, a Teachable course enrollment, or a coaching session paid through Calendly.
In-person rates are lower, typically 2.6% + $0.10, because card-present transactions carry less fraud risk. International cards add 1.5%. Currency conversion adds another 1%. Chargeback fees run $15 to $25 per dispute whether the merchant wins or loses, and refunds usually let the processor keep the original transaction fee.
Stripe and Shopify Payments do not charge monthly fees. Traditional merchant accounts often do, in the range of $10 to $30 a month, plus a per-transaction authorization fee.
The honest take on rate shopping. The difference between a 2.9% and a 2.7% effective rate at $100,000 in annual revenue is roughly $200. For a freelance designer, a small course creator, or a Shopify candle brand at that revenue, it is not worth the hassle of switching. The math gets meaningful past $1M, where a 0.2% rate cut equals $2,000 a year, and past $5M it equals real headcount. Below that, focus on reliability and category fit instead of rates.
Why You Need a Backup Processor
Account freezes and terminations happen, and they happen most often to the businesses that can least afford them. The high-risk categories are well known: subscription businesses, info products, high-ticket coaching, supplements, CBD, adult, and any business with a sudden spike in chargebacks. A course creator who runs a launch and triples revenue in 72 hours can trigger a Stripe review even though nothing about the business has changed.
When a freeze happens, payouts stop for 30 to 180 days. Existing balances sit in the processor’s account while the business pays rent, ad spend, and contractors out of pocket. For most online businesses, that is the difference between a healthy quarter and a layoff.
Best practice is to have a second processor connected and tested before it is needed. Common backup pairings: Shopify Payments plus Stripe for a product brand, Stripe plus PayPal for a course creator, Stripe plus Braintree for a SaaS, Square plus Stripe for a hybrid retail-online operation.
A real backup plan documents who to call at the primary processor, what records to send to dispute the freeze, and how to switch checkout over to the backup within hours. A freelance copywriter whose Stripe account gets paused mid-launch should be able to send a new invoice through PayPal the same afternoon, not three days later.
The High-Risk Category Reality
“High risk” is the processor’s term, not a moral judgment. Categories include supplements, CBD, nutraceuticals, adult content, dating, gambling, weight loss, debt relief, info products with refund-heavy reputations, and subscription businesses with cancellation friction.
Mainstream processors will accept these reluctantly or not at all. A supplement brand applying for Stripe is usually approved with a higher reserve. A CBD brand is usually declined outright. An info product seller with a $2,000 course and a 30-day refund window can get on Stripe but lives one big launch away from a review.
Specialty providers fill the gap. NMI, Authorize.net paired with a high-risk merchant account, PaymentCloud, Soar Payments, and Easy Pay Direct write policies for the categories mainstream processors reject. The trade-off is price.
High-risk rates run 3.5% to 5.5% + $0.30 to $0.50 per transaction, plus monthly fees of $25 to $100, plus rolling reserves of 5% to 20% held for 6 months. A CBD founder paying 4.5% and watching 10% of revenue sit in a reserve account is paying the cost of staying in business in a category mainstream processors will not serve.
Subscriptions and Recurring Billing
Subscription billing is its own software problem. The main options are Stripe Billing, Recharge (Shopify), Chargebee, ProfitWell, and Bold Subscriptions. A meal planning app, a beauty box, a SaaS founder, and a coach running a monthly membership all face the same hard problems.
Failed payments are the biggest one. Without a dunning sequence, subscription businesses lose 15-20% of revenue every month to involuntary churn (expired cards, insufficient funds, card declines). With a proper retry schedule (3-4 retries over 10-14 days), most of that revenue is recoverable.
The required pieces: a dunning email sequence, a card updater service that automatically pulls new card numbers when banks reissue them, and a clear cancellation flow. Subscription businesses also see higher chargeback rates than one-time sellers, which means more processor scrutiny and lower tolerance for missed dunning.
Buy Now, Pay Later (BNPL)
Afterpay, Klarna, Affirm, Shop Pay Installments, and PayPal Pay in 4 split a purchase into four installments and pay the merchant upfront, minus a higher fee.
BNPL makes sense when average order value sits above $75 to $100. Fashion brands, beauty kits, home goods, and high-ticket coaching offers see conversion lifts of 10-30% on the larger orders. A Shopify candle brand selling $30 candles, a freelance writer invoicing for $200 projects, or a course creator selling a $50 mini-course rarely needs it.
BNPL fees run 4% to 6%, roughly double card processing. The trade is that the provider takes the credit risk. The merchant gets paid in full even if the customer defaults on the installments.
International Payments
Most processors charge an international transaction fee of +1.5% and a currency conversion fee of +1% on top of the base rate. A US-based Shopify store accepting a card issued in Germany pays around 5.4% on that sale instead of 2.9%.
Shopify Markets handles multi-currency pricing without rebuilding the store. Stripe Connect handles multi-currency for marketplaces and global SaaS. Wise (formerly TransferWise) is the cheapest way to receive payouts in multiple currencies once revenue is real.
The honest take. International payments are easier to enable than international shipping, tax, and compliance. A product brand can flip on multi-currency checkout in an hour, but the back end (duties, returns, EU VAT, UK customs) takes months to get right. A digital product seller, a course creator, or a SaaS founder has it easier because there is nothing to ship.
Chargebacks and How to Survive Them
A chargeback is a customer dispute filed with the issuing bank. The bank pulls the money back from the merchant, holds it during the investigation, and forces the merchant to prove the transaction was legitimate.
The thresholds matter. A chargeback rate above 1% triggers processor scrutiny. Above 2%, accounts get terminated. Mastercard and Visa both run dispute monitoring programs that flag merchants automatically.
Common causes vary by business type. A coach gets disputed when a client claims the work was not delivered as promised. A SaaS founder gets disputed by a customer who forgot a subscription was charging. A Shopify brand gets disputed over shipping (didn’t arrive, arrived broken). A course creator gets disputed by a buyer who watched 80% of the content and asked for a refund the day after the refund window closed.
Defending a chargeback means responding within 7-14 days with order details, customer communications, proof of delivery or completion, and signed agreements where relevant. Prevention is cheaper than defense: a clear billing descriptor that matches the brand name, easy-to-find customer support, a stated refund policy linked at checkout, signed agreements for services, and a low-friction cancellation flow.
PCI Compliance
PCI DSS is the security standard for any system that touches credit card data. Hosted processors like Shopify Payments, Stripe Checkout, and PayPal handle compliance on the merchant’s behalf, because card data never lands on the merchant’s servers. A Shopify candle brand or a freelancer invoicing through Stripe Checkout has nothing to do here.
The compliance burden shifts when the business builds a custom checkout that touches raw card data. That setup requires an annual PCI Self-Assessment Questionnaire, quarterly network scans, and potentially a third-party audit at scale.
For most founders, the best practice is to use a hosted checkout and never touch raw card data. The cost of doing it the other way starts at low five figures a year in audit and security work, and only makes sense for businesses with specific custom checkout requirements at real scale.
Common Mistakes
Relying on a single processor with no backup. A subscription business or a course creator with one Stripe account and no PayPal fallback is one freeze away from losing a launch.
Choosing the lowest-rate processor without checking reserve policy or category restrictions. A high-risk founder who lands on a mainstream processor for the lower rate often gets terminated within months and loses access to funds in the meantime.
Building a custom checkout when a hosted one would do. A freelance developer who builds a bespoke Stripe Elements page to “look cleaner” takes on PCI compliance for marginal design value.
Ignoring chargeback rate until the processor freezes the account. By the time the email arrives, the account is already under review and reserves are already higher than usual.
Not having a written refund and cancellation policy linked at checkout. A coach without a refund policy loses every chargeback dispute by default.
Forgetting to enable card updater for subscription businesses. A meal kit brand without a card updater loses 5-10% of monthly revenue to expired cards alone.
Letting PayPal hold funds for 21 days because the seller dispute system was triggered. New PayPal accounts trigger holds easily, and a digital product seller can lose access to a full launch’s revenue for three weeks during the most fragile period of growth.
Frequently Asked Questions
Do I need a merchant account?
No, for most modern processors. Stripe, Shopify Payments, Square, and PayPal bundle the merchant account into the platform. A founder only needs a standalone merchant account when working with Authorize.net or in a high-risk category that requires an independent setup.
When should I switch processors?
Rarely, unless the category gets the account flagged or the business is paying for features it does not need. Most switches are forced by a freeze or a category restriction, not chosen for a slightly lower rate.
Why does Stripe hold my money for 7 days?
That is standard for new accounts. The first 7 to 14 days of payouts are held while Stripe builds a baseline for the business. Payouts speed up after 90 days of clean activity, usually to a 2-day rolling schedule.
Can I accept payments without a business entity?
Yes, as a sole proprietor. Stripe, PayPal, and Square will all open accounts under a Social Security number. Most founders form an LLC once revenue is real, partly so the processor account name matches the bank account name on the EIN.
What’s the difference between a payment processor and a payment gateway?
A gateway moves data, a processor moves money. Modern processors like Stripe and Shopify Payments handle both in one platform, so the distinction matters most when working with legacy systems like Authorize.net paired with a separate merchant account.
This is general information, not legal or financial advice. The right processor depends on the category, the platform, the volume, and the risk profile. A CPA, a payments consultant, or the processor’s own underwriting team can review the specific setup.
Sources
- Stripe, “Pricing,” stripe.com. Current online and in-person card rates, international card and currency conversion fees, and dispute pricing.
- Shopify, “Shopify Payments,” shopify.com. Built-in processor rates by plan tier and the third-party processor fee for stores using an outside processor.
- PayPal, “Merchant Fees,” paypal.com. Standard PayPal Checkout pricing, dispute fees, and hold practices.
- Square, “Pricing,” squareup.com. In-person, online, and invoicing rates for Square’s payments product.
- PCI Security Standards Council, “PCI DSS Overview,” pcisecuritystandards.org. The current PCI DSS framework, self-assessment requirements, and audit thresholds.
- Federal Reserve, “Consumer Credit Outstanding,” federalreserve.gov. Federal data on consumer credit and card usage that underpins issuer interchange behavior.
- Mastercard, “Chargeback Guide,” mastercard.us. Mastercard’s chargeback rules, dispute reason codes, and monitoring program thresholds.
- Visa, “Dispute Resolution Rules,” visa.com. Visa’s dispute resolution framework and merchant chargeback thresholds.