What a Payment Gateway Does

A payment gateway is the technology layer that sits between a merchant website or mobile application and the banking system. When a customer enters card details at checkout, the gateway encrypts those details, validates the format, and forwards an authorization request to the acquiring bank. The acquiring bank routes the request through the card network, such as Visa or Mastercard, to the issuing bank that provided the card. The issuing bank checks the balance or credit limit, applies fraud rules, and returns an approval or a decline. The gateway then passes that result back to the merchant in less than two seconds in most cases. Authorization is only the first step, and it does not move money by itself. An authorization places a hold on the customer funds for the transaction amount, for example 2,499 rupees on a Visa debit card issued by HDFC Bank. The merchant can then capture the payment, which confirms that the goods have been shipped or the service has been delivered, and instructs the acquiring bank to collect the funds. Some merchants authorize and capture in one step, which is common for digital goods, while others authorize first and capture later, which is common for hotels, airlines and marketplaces that confirm availability before charging. Settlement is the final step, when money actually moves into the merchant account. After capture, the gateway batches the day transactions and sends them to the acquirer for clearing through the card network. The network calculates the net amount owed to each bank, deducts interchange and scheme fees, and settles the balance. In India, a merchant using Razorpay or PayU typically receives settlement in one to three working days, often recorded as T plus 1 or T plus 2, where T is the transaction date. The gateway reports the settlement amount, the fees deducted, and the reference number for each batch. Merchants need a gateway because connecting directly to every bank and card network is impractical and unsafe. A single gateway gives a merchant one integration that reaches Visa, Mastercard, RuPay, American Express, net banking from banks such as State Bank of India and ICICI Bank, wallets such as PhonePe, and Unified Payments Interface, known as UPI. The gateway also handles the heavy security burden, including PCI DSS compliance for storing card data, encryption of card numbers in transit, and tokenization. Without a gateway, a small merchant would need separate contracts, separate technical integrations, and separate security audits for every payment method. A worked example makes the flow concrete. A customer buys shoes worth 3,499 rupees from an online store that uses a gateway. The gateway receives the card number, expiry date and CVV, encrypts them, and sends an authorization request for 3,499 rupees to the acquirer. The issuing bank approves the payment and returns authorization code 482913. The merchant ships the shoes, captures the payment, and the gateway includes the transaction in the nightly batch. Two days later, the merchant receives 3,429 rupees after the gateway deducts a merchant discount rate of 2 percent, and the settlement report shows the order number, the authorization code and the fee breakdown.