Payment Gateway
The service that takes payment details from a checkout, passes them for authorisation, and returns the result.
Industry & DomainA gateway sits between a checkout and the card networks: it captures the details, tokenises them so the merchant never stores a card number, routes the authorisation request, and returns approved or declined. Gateway, acquirer and processor are separate roles that most providers now bundle, which is why the terms get used interchangeably.
For design, the decline path matters far more than the success path. Declines are common and their causes are different — insufficient funds, a bank's fraud rule, an expired card, an SCA step the user abandoned, a network timeout. Gateways return distinct codes for these, and most checkouts collapse them into “payment failed”, which leaves the customer with no idea whether to try another card, call their bank, or simply retry.
Hosted versus embedded is a trade, not a default
A hosted page moves PCI scope to the provider and costs a redirect. Embedded fields keep the flow but require the merchant to handle more compliance surface. Choose deliberately: redirects cost conversion, and unplanned PCI scope costs quarters.
In practice
An ecommerce checkout mapped every gateway response to one message. 3.8% of attempts failed with no useful guidance. Splitting them into the four most common causes — with “try another card”, “contact your bank” and “retry” as distinct actions — recovered roughly a third of those attempts on a second try.
Where teams get it wrong
- One error message for every decline reason.
- No retry that keeps the cart and the entered details.
- Choosing hosted or embedded on integration convenience rather than PCI scope and conversion.
- No handling for timeouts, where the payment may still have succeeded.
- Testing only in a sandbox, which does not reproduce real decline distributions.
Learn more
You may ask
Frequently Asked Questions
What is the difference between a payment gateway and a payment processor?
The gateway captures and transmits payment details from the checkout; the processor moves the transaction through the card networks to the acquiring bank. Most modern providers do both, so the terms are used loosely.
Why do card payments get declined?
Insufficient funds, the issuing bank's fraud rules, expired or incorrect details, a failed authentication step, or a network timeout. Gateways distinguish these in the response code — checkouts usually do not.
Related terms
All terms- 3-D SecureThe card-network authentication step that shifts fraud liability from the merchant to the issuer — at a measurable cost in completed checkouts.
- Strong Customer Authentication (SCA)The EU requirement that electronic payments be authenticated with two independent factors — with a defined set of exemptions.
- ChargebackA forced reversal of a card payment initiated by the cardholder's bank — the customer's escape hatch when the merchant's own one is worse.
- Error StateWhat an interface shows when something failed — which system failed, whether the user's work survived, and what they can do next.
Defined by Mara Last reviewed .
Let's talk about your product.
Happy to look at what you're building and say where design would move the needle.
Contact Us