Taking a retail store's card payments online
A retail store that already takes cards at the counter has solved half the problem. The other half starts the day someone tries to pay from their phone. A counter terminal and an online checkout look like the same job, but they are not, and treating them as identical is where most of the pain comes from.
This is the generic version of a job we have done more than once: a store that sells in person wants to sell online too, without rebuilding the business around the website. No client is named here, because the lessons do not depend on who the store is.
What actually changes
At the counter, the card is present. The customer taps or inserts, the terminal reads the chip, and the sale is tied to a person standing in front of you. Online, the card is not present. You get numbers typed into a form, and the risk shifts. A stolen card number is far easier to use online than a stolen physical card is at a counter, so fraud prevention becomes your job in a way it never was at the register.
Settlement changes too. At the counter, the sale, the receipt, and the customer leaving with the product all happen in the same minute. Online, you take payment, then you still have to pick, pack, ship, or hold for pickup, and the customer can dispute the charge at any point along that chain. The window between payment and a happy customer is longer, and every step in it is a place something can go wrong.
The pieces, in plain terms
An online checkout has four pieces, and it helps to name them before comparing vendors:
- The checkout page. Where the customer enters shipping details and pays. This can be a page on your own site, or a hosted page the payment provider runs for you.
- The gateway. The software that takes the card details, checks them, and talks to the card networks. Often bundled with the processor, sometimes separate.
- The processor and merchant account. The outfit that moves the money from the customer's bank to yours and takes its fee on the way.
- The payout. Money landing in your bank account, usually a day or a few days after the sale, minus fees and minus any held-back reserve.
You do not need to become an expert in any of these. You do need to know which one a vendor is quoting you for, because a quote that covers only the gateway and not the processing fees is not a comparable price.
Start with the simplest checkout that works
The smallest honest version is a hosted checkout page or payment link tied to a small catalog: a handful of products, real prices, real shipping costs, and a clear pickup option if the store offers one. Hosted checkout has a second advantage that matters more than convenience: the card numbers never touch your server. The provider handles the sensitive part, and your PCI compliance scope stays small. Never build a form that posts raw card numbers to your own code. That is a liability you do not need and a breach you cannot afford.
The most common early mistake is guessing at shipping. A store that charges a flat shipping number it invented will either eat the difference on heavy orders or overcharge on light ones, and both erode trust. Get the actual shipping cost before finalizing the order total, the same way the register shows a total before the customer pays. If the checkout cannot do that yet, start with in-store pickup and a small shippable list, and add shipping when the numbers are real.
Fees, stated honestly
Online card processing costs more than counter processing, and any vendor who tells you otherwise is selling something. Card-not-present transactions carry higher interchange and higher fraud risk, so the rate reflects that. Compare vendors on the delivered total for a typical order in your store, not on the headline rate. A low percentage with a per-transaction fee, a monthly gateway fee, and a reserve hold can cost more than a higher percentage with none of those.
Also ask about the refund path before you need it. A refund online should be a button in the same system that took the payment, not a separate phone call, and the fee treatment of refunds varies by provider. Know it now, not during your first angry customer.
Fraud basics that do not block good customers
You need a few checks, and only a few, to start:
- Require the billing ZIP and the card security code, and check that they match.
- Flag orders that look unlike your normal pattern: a first-time customer buying your most expensive item in bulk, shipping to a different address than billing, at 2 a.m.
- Review flagged orders by hand before shipping, and call the customer when in doubt. A two-minute call beats a chargeback.
Do not overbuild this. Aggressive auto-decline rules reject real customers, and a small store loses more to lost sales than to the occasional fraud it catches late. Review by hand until the pattern of your real orders teaches you what to automate.
The rollout order we use
- Hosted checkout, small catalog, pickup plus shipping only where costs are real.
- Reconcile the first payouts against the bank account, line by line, before expanding the catalog.
- Add the refund and exchange flow, and write the policy in plain language on the site.
- Then, and only then, widen the catalog and consider a fully embedded checkout.
Each step is reversible. That is deliberate. A store's online checkout should grow the way the store did: one proven step at a time, with the money reconciled before the next step is taken.
The rule underneath
Taking cards online is not a website feature. It is a second register, one that runs while you sleep, takes payment before the product leaves the building, and answers to a fraud and dispute system you did not design. Treat it with the same seriousness as the first register: real totals before payment, money reconciled after, and nothing added that you cannot explain to the person running the counter.
Get those right and the online store becomes what it should be: the same business, open one more way.