Internet Payment Processing

Most of the information here is focused on US-based businesses.

How it Works

I'm not going to try to go over it here. You'll have to read elsewhere to understand these terms: "acquiring bank", "issuing bank", ISO, MSP, "discount rate", "interchange rate", "authorization", "capture".
For example:
   "Credit card"
   "Bankcard 101"
   "Payment Services Glossary"
   "What are Interchange Fees"
   "How it Works"|/business/accepting_visa/new_acceptance/index%2Ehtml|How%20It%20Works

["Level II" and "Level III" processing: ]

This is ridiculously complex. Some of this is for legal/regulatory reasons. For example, anti-trust laws in the U.S. prevent a processor from also provinding gateway services. In practice, this means that often a processor owns a separate company that provides gateway services (for example, First Data, a processor, owns CardService International, which provides gateway services). Also there has historically been strong sentiment, if not actual law, against banks participating in various kinds of commerce (the Glass-Steagall act was aimed specifically at investment banking, and in any event it was repealled in 1999 with the Gramm-Leach-Bliley Act).

Choosing Vendors

You might think "I really like Frank down the street at my business bank, and he says they offer ecommerce services." Your typical bank, and all their staff, know zippo about ecommerce. Their support will be awful, and the services will be over-priced. Practically no banks actually offer online payment services themselves; they partner with some other company for it. Plus, keep in mind that you won't be able to simply use your existing bank account anyway. You have to open a whole new bank account with new terms that acknowledge you are going to be carrying out electronic transactions with it, and of what kind.

Start with figuring out what software you are going to use to run your web site and your accounting. Don't start with what your bank is.

With regard to comparing the sizes of gateways and processing networks, you need to be clear whether they are counting merchants, the number of transactions, the total monetary value of the transactions, and whether they count both internet and non-internet transactions.

Helpful Experts

Alphabetical order:
Corey Bryant (and Russell Gottlich)

John Conde ("stymiee")
   co-founder of
   several articles including:
Curtis Stevens

Chris West
   CEO of
You also want to google in and often has informative articles; for example has some interesting history. also follows the industry.

Provider Comparison/Reverse Bidding

I don't know of any good ones. Here are some poor ones:
   big comparison table
   run by Jim Conley who works for ECHO.
   UPDATE 2007: now owned and run by
   cheesy looking	
   a "maculator" automatic comparison
   domain owned by Ray Cruz 
   same content at:
   another Corey and Russell site.
   links to (owned by
      $20/month for recurring:
   see also also owned by them
   bidding site where MSPs bid for your business
   "CardBridge has four partners for each of our risk categories."
   "We keep our partners identities confidential to insure your privacy and maintained." huh? 

Payment Processors

aka "Clearing House"

[There is a distinction between "front-end" processors, which provide authorization and settlement to merchant banks, and "back-end" processors which actually move the money from the issuing bank, and also interface with the Fed.]

[each bank participates in only one? why is compatibility dictated by the acquiring bank, not the issuing bank?]

These are the ones that facilitate the transactions between issuing banks and acquiring banks: the "Inter Bank Exchange" (Interchange).

Some pages listing processing networks:

Non-Gateway Software

Why bother with a gateway at all, if you can just use the swiper, or PC software, or their web site? Well, some of them require Windows. Some of them restrict you to "card in hand", at least legally if not technically. All of them still require a merchant account.

These hook up directly to the processing networks, bypassing any gateway. They basically do the same thing a dedicated swiper (Verifone, Hypercom) would do. You might think that this would be fertile territory for open source, but it so far hasn't been. The payment processors want any software or device that talks to their network to be certified, which is not unreasonable. Any terminal (such as made by Verifone, etc.) also has to be certified for every network it talks to. Allegedly in some cases payment processors and won't give you specs to their protocols except under NDA; I don't know if that is true.

The protocols have names like FDR-7 (for "First Data").

"PC Charge Pro" (Verifone/GO Software)
"IC Verify" (CyberCash/Verisign).
    Interesting docs:
    Owned by First Data. (CyberCash split when Verisign bought it?)
    still alive? First Data also owns Linkpoint
    also: WebAuthorize (MacAuthorize and PCAuthorize are cancelled in 2001, along with unix variants of ICVerify)
       WebAuthorize is windows-only
    software for embedding in POS systems.
Monetra (previously MCVE) from
  they claim (probably correctly) to currently be the only such solution for unix
  note that they require cryptographically signed modules:
  PowerPay ( is an ISO/MSP that offers merchant accounts specifically for Monetra
  closed source, HKS (Hell's Kitchen Systems) acquired by RedHat in 2000, who have basically killed it. no work since 2000.
  "Red Hat has decided to discontinue its support of the CCVS credit card payment processing software"
  seems as dead as CCVS
  no work since 2002?
  software or service?
  says windows or unix
  LGPL open source for one payment processor in Denmark (PBS)


Most gateways support both a GUI-less backend API that uses http or ssl, and a hosted web page solution.

 CISP - validation for merchants and service providers (anyone manipulating credit cards).
    assessed by independent companies such as Ambiron 
    (Cardholder Information Security Program)
 PCI - guidelines
 PABP - Visa voluntary validation for software vendors
    (Payment Application Best Practices)
C = CISP certification (Visa)
Z = zen-cart support
R = free recurring support
r = pay recurring support
to add: setup/cancellation/monthly/txn charges; fraud features

 ZR   iTransact
CZr   Verisign
CZR   eProcessingNetwork (docs for recurring support is hard to come by). emulation.
CZ?   Plug n' Pay (QuickBooks integration. limited recurring support.)
C ?   Shift4
 Z?   Paradata
C ?   Cybersource
        list of CISP-certified providers

        support by OS shopping carts (zc, osc, interchange, Business::OnlinePayment, EPI) and by commercial ones (H-Sphere
        Verified by Visa
        recurring billing
        payment from foreign cc's
        CISP certification
        size of company
	quality of API
	extra per-transaction charges
lists of gateways: 
     (both 3PP and gateways)



          $295 registration
          $25/month, with no charges for the first 500 transactions (then $0.10/txn)
          does recurring (no extra charge) and one-time
          does EFT
          requires a merchant account; works with several networks:
   not CISP-certified as of 10/7/04


    CISP certified
    has an emulation  (though not the recurring part)
    recurring billing (free?)

        free setup
        $15/month. 250 free, thereafter $.10/txn
        free recurring. offset starts
        recurring does not emulate
        fraud scrubbing
        Bank Card resellers
like ant others it accessess your own merchant account, which they can help provide through OnlineDataCorp.
They have their own per-txn fees over and beyond the gateway (though typically first 250/month are free).
They charge extra ($20/month) for ARB Automated Recurring Billing.
lot of anti-fraud tools, everything costs extra.

has been vulnerable to denial of service attacks.


Now owned by eBay. 
Verisign acquired signio and CyberCash.

Payflow Pro supports recurring; Payflow Link does not
lots of extra ala carte fraud prevention services



has its TCLink API
what processing networks do they support?
no public pricing
used by lwn

CardService International/LinkPoint

only supports FirstData as a processing network (no NOVA support, for example)

check support via VirtualCheck
only sold through resellers.
	110,000 merchants
        owned by First Data.
        "LinkPoint" = is really made by
        some sort of partnership with Wells
        $20/month (gateway only)
        $2.39%, $0.25
        Paymentech is 3rd largest payment processor (by merchants? by number of txns?), and also issues CCs.
        NPC is 2nd largest gateway processor (airlines, petroleum, etc.)
	First Data is largest?
        ClearCommerce customers include Chase, EDS, Orbit Commerce, and Cardservice International

some consumer complaints
  CSI settlement:
   complaints about csi cardservice international :

Plug 'n Pay
limited recurring support.
has a QuickBooks integration, among other features (membership management), mostly extra.

   a spin out from
   allegedly better at fraud prevention than others
   largest volume of any due to Fortune 500
   no NOVA support (except maybe through Vital first). no Global Payments support.
     Set-up: $99.95
     Monthly: $29.95
     Discount Rate (Visa, MasterCard): 2.39%
     Transaction Fee: $0.35


Will help provide a merchant account through "WorldDirect"

         holds funds for a long time?
        initial/small customers can't use the api?
        ePDQ charges 3.65?, cheaper than WP above $2k

3rd Party Payers

Note that it is against Visa/MC rules for a merchant to ever process credit card transactions for another merchant, this is called "factoring". As long as credit card data is not shared (and the actual company with the merchant account is clearly identified) then things are ok. This is how 3rd party payers work: you never see your customers' credit card data. In fact, technically, they aren't your customers :) -- they are the customers of the 3PP. Note that with a 3PP you also can't directly enter credit card numbers on behalf of your customers.

Certain kinds of "high risk" businesses (dating, gambling, adult, etc.) are subject to significant up front charges. 3rd party payers that shoulder the responsibility for certain high-risk customers are considered "Internet Payment Service Providers" (IPSPs) by Visa. Visa has imposed new rules regulating their business; their customers are termed "Sponsored Merchants".

These generally have no or low monthly fees, and no termination fees, but may have higher per-txn fees.

lists at:
The paypal rate is 2.9% + $0.30/txn, with no application or
monthly fee. This is actually pretty competitive.
Not exactly like the other 3PPs because they act like a bank.

EPOCH / Paycom
        foreign alternative to paypal. visa only among CCs

ISOs/MSPs/CSPs (Merchant Accounts w/Gateway)

You generally want a direct relationship with an ISO/MSP (who has paid $10k or so annually to have a relationship with a bank). Not just a reseller/agent for some other ISO/MSP. If you do go through agent, you are still actually getting the account with the ISO/MSP behind the scenes. You have another party in the picture, and another layer where someone is getting a cut of the transaction fees.

Any Merchant Account Provider (MAP) is supposed to state either: that they are an ISO (and what the sponsoring acquiring bank is), or if they are an agent/reseller, what their ISO is.

   monthly fees
   minimum term
   cancellation fees
   txn percent/fixed
   funds holding
   offers check processing

Curtis Stevens
registered ISO
        good general info, by Curtis Stevens
        sells Authorize.Net, Intellipay, Verisign among others:
	%2.19 + $.25
	$9.95 gateway + $10 service
	has $99 cancellation fee:
	has minimum of $20/month of txn fees

        presence on webhostingtalk
        Chris West,
        ISO/MSP for Provident Bank
        mostly through resellers, who set their own prices
            qualified %2.25 , unqualified %1.60 $.25 per item AVS $.05. Amex/Discover $.35, $10/month statement.
            CDGGateway or Authorize setup $49, month $15. CDGGateway 0-500 free, $.10 thereafter. is $.10/txn.
            Annual Service Fee:$0.00 * Termination Fee:$0.00
            Batch Header Fee:$0.25 * Chargeback Fee:$25.00 * Retrieval Fee:$25.00
                %2.25 + $.30, $10/month statement, $15/month gateway, $49 gateway setup
                %2.30 + $.35, $10, $15/month gateway
                %2.30 + $.35, $10/month statement, $15/month gateway, no gateway setup
                refers high risk customers to corey
                suggests that they are using iTransact (for gateway software), and that it had a DOS problem
                gateway choices:
                        sells, iTransact (CDGGateway), Verisign, Plugnpay, Shift4, eProcessingNetwork, paradata, CyberSource

Merchant Accounts 4 Less
  various promos such as:

  $99.50 setup $10 statement $15 gateway 2.39%+$.25  $.05 avs $25 minimum
  Reseller for CardService International
        Corey Bryant
        reseller for Cardservice - not a ISO/MSP themselves
        list prices:
                 bank says: $2.39% + $0.25 + $10/month, with $25/month minimum.
        plus $15/month gateway fee: Linkpoint,, or Verisign Payflow Pro
                offers nova gateway only?
                affiliate program
                %2.30 internet, 1.55% brick
                no setup or application
                %2.25 + $.25 internet
                        2.25% + $0.25 GEEK promo code
                        gateway $10, service $10, %2.25 + $0.25

Vantage Card Services

found through googling. no online rates.
Registered ISO/MSP of HSBC Bank USA
no cancellation fee.
sells Plug n Pay,, Verisign, BluePay, EC-Linx
good info about actual rates.

"Merchant Services"

  Merchant Services Inc 
  Merchant Services Inc. (MSI)
  890 Mountain Ave
  New Providence NJ - 07974
  40,000 businesses.
Another (different?) "Merchant Services":
  corporate accounts in new jersey: 08 Commerce Center, 1001 Lower Landing Road, Blackwood, NJ 08012
  distribution center in texas 
  10,000 accounts

  on ebay "": $10/month statement $15/month gateway 1.99% + $.19 /txn
  banks:  Regions Bank, Montgomery, AL, US Bank, NA, Minneapolis, MN, Key Bank, NA, Cleveland, OH, and National City Bank of Kentucky.
  platforms: First Data (FDMS,Omaha and Nashville), Vital (VisaNet), Global, NDC, MAPP, Concord, Buypass and Nova

  no minimum term, no cancellation
  AVS is free
Yet another eBay seller
seller merchantgm
        another one.
        MerchantUSA part of Acies ->
        works w/Chase and First Data
        %1.98 + ? + $6.99/month, no minimum, no annual fees, cancellation?
        $50 rebate

Payment Logistics

Sigh, no published rates, and no indication of whether they are an ISO.
but seem straightforward folks

ISO/MSP with National Processing Co. (NPC)
recommendation from a Joel on Software comment
seems focused on supporting agents, not customers


no monthly minimum
monthly $10 ($0 if no txns) offer at
2.69% + $0.30 (though they no longer publish rates)
    says 2.25% + $.30/txn + $19.95/month for a nonprofit
charge backs: 5 free/month, then $5
check services are free: XpressCheX
supports recurring payments:
bank: Merchant America
network: ECHO

they do the whole thing. 
application process a bit more onerous than others. maybe because they lost a consent decree in 1993 for aiding telemarketing fraud?
does U-Haul. 
transfer between their bank and yours requires check writing, apparently.

        $99 setup
        1.99 to 2.49% discount rate (fixed number in this area)
        30 Cents Trans.
        $10 Support/Statement fee.
        no gateway fee, no monthly minimum
        ECHO has 60,000 customers, 15,000 is U-haul Rep
        Curtis Stevens likes ECHO too
        but see:
            $20/month Merchant America fee
        Jim Conley II works for them. Notes that resold accounts do not have reporting access:
            jconley2 =


Apparently has a long contract?
Uses First Data and
resells Authorize.Net, Verisign and Cybersource:
                "Internet Merchant Account"
                they provide a merchant account for your separate processing gateway such as
                        $99setup, $29/month, %2.35 + $.30
                        $149setup, $35/month, %2.4 + $.30
        "SecureSource Suite"
                      takes checks, includes own payment gateway
      has an application/setup fee ($149).
      uses Wells gateway

Thompson Merchant

agent of 1st National Merchant Services (owned by iPayment Inc), a Registered ISO/MSP of JP/Morgan Chase Bank

UPDATE 2007: now directly registered MAP with JP Morgan Chase Paymentech

        linked from
        offers the "PCCharge Payment Server" on Windows
        active forum:
        offers, Plug'n Pay, ParaData, QuickCommerce (uses
                $39 setup
                $10/month gateway, $7/month statement
                2.27% + $.28
                no monthly minimum


You might think there is a mode where you say "reject this request if the AVS or CVV looks funny". But not all gateways provide that (I believe LinkPoint does not, but does). Instead you have a choice:
  1. Make a separate request (which you have to pay for) to first do the AVS/CVV check, or
  2. Have the transaction go through, then look at the AVS/CVV score that comes back, and perhaps void it on your own.

Oh, and remember that typically you pay an extra $.05/txn for an AVS check. But if you don't do the AVS check, then you get stuck with the non-qualified rate, which adds even more to the txn.


You probably don't want to use the gateway service. In most cases they charge for it (Linkpoint does not) and it vastly increases your switch cost to another gateway. CISP-compliant software will never expose unmasked credit card data, so it might be impossible, not just hard, to switch.

Gateway APIs generally suck for recurring management.

The alternative is your own local program to manage recurring payments.


"QuickBooks Online Merchant Account".
 $59.95 setup
    %2.44 + $.23/txn +    $17.95/monthly
   No terminal leasing fees, no minimum fees, no cancellation fee
For Windows QuickBooks
Same rate as above, but may have a monthly minimum?

supports recurring billing

states explicitly it isn't intended for web site sales 

Done by Innovative Merchant Solutions, owned by Intuit

Limite to only use within QB?

Monetra Payment Connector plugs in to QB.


You can see current Interchange rates at: For generic online payments, you are looking for Visa "CPS/e-Commerce Basic" which in April 2005 is 1.85%+$.10 for rewards cards (a majority, these days) and 1.90%+$.10 otherwise. There are variations for debit vs. credit cards, small differences between Visa and MasterCard; consequences for delayed settlement or a settlement differing significantly from the authorized amount; penalties for not passing in certain fields, etc. You also get another .05% better for doing "Verified by Visa".


Verified by Visa

See for example