The traditional way to process online payments is to have an internet merchant account, and talk to that account via a payments gateway. Nowadays, many internet merchant accounts come bundled with a gateway as part of the cost (notably, Authorize.net), but they are separate and you can always choose to use the gateway of your choice (as long as they work with a processor platform that's supported by the merchant account).
"Wait, what?" you say. "You said you were going to shed some light, but you're just confusing me with all this talk about accounts, gateways, and processors." Well, I told you that online payments were a bitch.
OK, let's start at the top. An internet merchant account is what you need to accept credit cards on your site. Despite its name as an "account", it's really not an account at all. An internet merchant account merely gives you permission to accept credit cards. At the end of every day, the internet merchant account will deposit all of your funds into your real checking account that you maintain with your bank. So think of an internet merchant account as a holding pen of sorts.
The vast majority of business banks (Bank of America, Silicon Valley Bank, etc.) can provide you with an internet merchant account, but you will rarely want to go that route. While the costs are often higher, the real reason you don't want to go that route is that you're more likely than not to be denied a merchant account as these banks (SVB, Square 1, etc excepted) are more used to traditional brick-and-mortar merchants and you can often spend weeks or months applying for an internet merchant account just to be turned down for being "too risky". If you just Google "internet merchant accounts", you'll see a bunch of companies who are dying to give you their business.
Personally, I highly recommend TransFS to find an internet merchant account. All of the merchant accounts on TransFS are "interchange plus" accounts. Interchange is the fee that Visa and MasterCard charge to process their cards; these fees vary depending on the type of card - consumer versus business, plain vanilla versus rewards, and so on. (The complexity and fees are actually a big enough deal that there are advocates to reform interchange in Congress.) Interchange-plus passes along these charges plus an incremental amount; in almost all cases, interchange plus is both cheaper and more transparent than "qualified/non-qualified" bundled rates. While the bundled rates may be simpler, they're often mischaracterized in a way to benefit the merchant account provider at the expense of the merchant. (If you want to learn more, read this post on TransFS' very comprehensive blog.) These merchant accounts will generally charge you a "statement fee", aka "the fee you pay us monthly for the privilege of being a customer" plus a small percentage (usually between 0.15% and 0.30%) and a flat per-transaction fee (usually 10-15 cents). I have worked with a merchant account provider called CoCard that I found via TransFS and have generally been very happy with their customer service and fees.
It will take you about three to four weeks to jump through all the hoops to acquire the internet merchant account, so you need to plan ahead to have a merchant account ready to go before any launch.
Once you have an internet merchant account (or while you're going through the process), you need to find a gateway. Again, you write your code to talk to the gateway; the gateway takes the credit card information that users input on your site and talk to the processors (First Data, Paymentech, Global Payments, etc.) to get the funds released to the merchant account (which then sweeps into your regular bank account). Most internet merchant accounts will resell or bundle a gateway - most often, it's Authorize.net. Auth.net (for short) is a perfectly serviceable gateway for most use cases, but if you need a more elegant gateway API, you may want to pay extra for Braintree's payment gateway. Braintree has focused on e-commerce since their founding and they (while not perfect, especially with their documentation) are generally considered the easiest gateway to work with. However, if you decide that you want to use Braintree's gateway with your internet merchant account, you need to make sure that your merchant account supports the First Data Nashville processor. (There's actually a First Data Omaha processing network which does not work with Braintree. Why? I have no idea.) Braintree's gateway will add significant costs to every transaction, but you're paying for a more elegant API and premium customer support. If you're doing large dollar ticket sizes, these additional fees may be worth it; if you're doing lots of small dollar amounts, they may not be. (And forget about it for microtransactions. Use PayPal or Amazon Payments' specialized solutions for microtransactions. I'd recommend PayPal as it's easier to grow into their other offerings as necessary.)
Well, that's a lot of work. Why not just use PayPal?Actually, that's a very good question. While many people may have poor experiences with PayPal, they are invariably easier to get set up and understand than the combination of hoops and charges for an internet merchant account and gateway. In addition, PayPal can often be cheaper. Here's a pretty little chart that PayPal has on their site:
Let's be clear; this isn't to scale, but it does accurately display the differences in complexity. (One note - if you use interchange-plus pricing, you're not subject to the downgrade fees that kick in for qualified versus non-qualified transactions.) What's confusing about PayPal is that they have three products that you can use: Website Payments Standard, Website Payments Pro, and PayFlow Pro. PayFlow Pro is a standard gateway that works with any internet merchant account (PayPal actually acquired this line of business from VeriSign back in late 2005). Website Payments Standard and Pro are combined merchant accounts and gateways. The main difference between the two is that with Standard, the transaction happens on PayPal's servers. With Pro, it happens on your servers. In addition, with Standard, you have to accept PayPal as a payment mechanism; with Pro, you can accept credit cards only. (Why you would want to comes to how PayPal funds their accounts; e-checks don't clear for three to five days and introduce risk to merchants that credit cards, with their instant money transfers, do not.)
In some cases, PayPal can be cheaper than the combination of merchant account and gateway. In particular, if you have very high tickets (average order sizes) and a mix that is skewed towards business cards (which have higher interchange fees), PayPal can often be more economical. PayPal's simplified rate structure is a marketing tactic that, on balance, does make PayPal more expensive than the more complex option. EDIT: You can compare PayPal versus a standard merchant account with the PayPal Upgrade Calculator built by TransFS. (Disclosure: I worked with TransFS to build this calculator, a relationship that happened after this article blew up.)
However, there is one additional downside to PayPal: they will oftentimes hold back up to 25% of your proceeds for three months as a fraud prevention/risk management effort. This means if you charge a customer $100, you will only get $75 immediately and will have to wait three months to see the $25 balance. If cash is tight, or you are running inventory, this can kill your business.
There is one additional issue to consider when deciding on your merchant account, gateway, PayPal, and your options: vendor lock-in. In most cases, you are locked into a particular vendor. This is because they store the credit card information on your behalf (unless you use a standard merchant account and decide to try to be PCI compliant - which is a whole 'nother ball of wax that requires audits and precludes using cloud hosting for your e-commerce). In particular, if you have a subscription recurring billing model, this vendor lock in can be killer because you can't switch providers without forcing your customers to return and re-enter their credit card information in a very limited timeframe between your switch and the next billing cycle. To avoid this, there are a small number of vendors who provide "vaults" that store credit card information in a portable manner.
The two most well-known vaults are Authorize.net's CIM and Braintree's vault. A newer company focused on their elegant subscription payment API, Recurly, also provides a vault (but they are not a gateway provider themselves). These companies offer credit card portability if you ever choose to store credit card data yourself. (You may be able to move from one vault to another, but I'm not sure if this is actually possible.) These vaults are the only way I know of to offload PCI compliance while still maintaining some flexibility in changing merchant account or gateway vendors.
OK, so here's the million dollar question: so what should you do?
As far as I'm concerned, there are three real options:
- PayPal Website Payments Pro
- Braintree Gateway + Account
- Authorize.net + Merchant Account (add Auth.net's CIM, Braintree's vault, or Recurly if you need vendor flexibility)
PayPal will be the easiest to get set up, by far, but the 25% holdback can be a killer. Braintree's single-source solution will take longer to set up, and will be the most expensive option for most cases, but they provide the most flexibility and best customer support. Getting your own merchant account and using the bundled gateway will presumably be the cheapest option, but will invariably cause you the most headaches. You can avoid some headaches by writing to Braintree or Recurly, but then you will lose much of your cost savings, but you'll retain the flexibility to host the card numbers yourself or possibly switch vault providers.
Of course, if you don't mind having the checkout transaction happen on someone else's servers, PayPal, Amazon Payments, and Google Checkout are all (non-exclusive) options. Here's a good rundown of all three.
I recognize this is both a very long and completely uncomprehensive review of online payment processing. As I've repeatedly said, online payments are a bitch. I intend on revisiting and editing this post as comments and additional information becomes available.