Who does what in a card payment
- Your application says how much to charge and to whom.
- The gateway captures the card and checks it, often with a confirmation on the customer’s phone.
- The customer’s bank approves or declines the charge.
- The gateway tells your application whether the payment went through, and the money reaches your account.
Why it matters where the card is typed
Anyone who processes, transmits or stores card data has to comply with the PCI DSS security standard. If the customer types the card on the gateway’s page and not on yours, your share of that work is much smaller.
An example
A customer accepts a quote on their phone and taps “Pay deposit.” They go to your bank’s gateway page, confirm the charge in their banking app and come back. Your system gets the confirmation and marks the quote as paid. Nobody on your team has seen the card.
The usual mistake
Taking card details over the phone or by email to charge them later by hand. It is unsafe for the customer, it makes you hold data you should not have and it leaves the payment with no trail.