Payment gateway: choosing one without giving away margin or sales

Say there's a small coffee roaster in Palafrugell selling 250-gram bags at 12 euros in its online shop. The average order is around 18 euros and, since the summer, French and German visitors who stopped by the shop have been ordering too. To take payments, the owner switched on the gateway that came with the shop template, and at the end of the first month three things stand out. On an average order, the fee has eaten almost 3%. Some orders are stuck at “awaiting payment” because the customer never finished approving the purchase in their banking app. And several customers have asked whether they can pay with Bizum. None of this has anything to do with coffee. It all comes down to the payment gateway, the one step in the shop where the customer has already decided to buy.

What a payment gateway is

A payment gateway is the service that takes payments in your online shop. It collects the payment details (the card, the Bizum phone number or the PayPal account), asks the customer's bank to authorise the payment and, if the answer is yes, tells the shop to mark the order as paid. The money then reaches your account, with the fee either deducted or billed separately, depending on the contract.

Several parties are involved behind the scenes: the bank that issued the customer's card, the card scheme (Visa, Mastercard), the institution that accepts the payment on your behalf, which may be your bank or a payment provider, and the technical piece that connects all of that to your website. When your bank provides it, it's usually called a virtual POS (TPV virtual in Spain), the online counterpart of the card machine on the counter. Many Spanish banks provide it through Redsys, which says on its website that its virtual POS handles more than 45 million payments a month.

Getting it right matters because paying online is now routine. According to a Banco de España article based on the European Central Bank's study of payment habits, Spanish consumers made almost three times as many online payments in 2024 as in 2019. Cards accounted for 51% of those payments, and digital wallets such as Apple Pay or Google Pay, PayPal or other apps for 26%. Instant payments, the category that includes Bizum, accounted for 6%. It's all in “Trends and developments in payments by Spanish consumers”, from the April 2025 Economic Bulletin.

Your bank's virtual POS or an independent payment gateway

The first decision is who you sign with. With your bank's virtual POS, the contract is with your bank: it accepts the payments, the money goes into the account you hold there and the fee has no public rate card; you negotiate it, much as you would for a card machine. Redsys, for example, lets you add Bizum, PayPal, Google Pay and Apple Pay to the same virtual POS, and offers plug-ins for the most common shop platforms, such as WooCommerce and PrestaShop.

With an independent payment gateway, such as Stripe or PayPal, you sign up online, the prices are published and you can start taking payments without negotiating anything. The money goes first into the account you hold with them and from there to your bank, on whatever payout schedule each provider sets. Neither option always wins. If you sell abroad, take subscriptions or are starting with low volumes, an independent gateway lets you get going on day one. If your orders are small and your customers are local, ask your bank for a quote and check whether its fee includes a fixed charge per transaction: if it doesn't, it can work out cheaper on 15- or 20-euro orders.

Interchange fees and room to negotiate

Every card payment includes an interchange fee, the share kept by the customer's bank. In the European Union it has been capped since late 2015 by Regulation (EU) 2015/751: on consumer cards it can't exceed 0.2% of the amount for debit cards or 0.3% for credit cards. Anything you pay on top goes to the card scheme and to whoever provides the service, which is why two shops with the same bank can pay different fees. Business cards and cards issued outside the EU fall outside that cap, and they tend to cost more.

How much a payment gateway charges

Almost all of them charge per sale, and many combine a percentage with a fixed amount per transaction. As a reference, on 26 October 2026 Stripe listed 1.5% + €0.25 in Spain for payments with standard European Economic Area cards, and PayPal listed 2.90% + €0.35 for domestic payments from a PayPal account. Bank virtual POS services have no public price list. Prices change, so check each provider's page on the day you sign up.

Everyone compares the percentage, but in a shop with small orders the fixed charge weighs more. On an 18-euro order, a 1.5% + €0.25 rate takes €0.52, or 2.9%; on a 120-euro order it takes €2.05, or 1.7%. At 2.90% + €0.35, that would be €0.87 on the small order (4.8%) and €3.83 on the large one (3.2%). Do the maths with your real average order, not with the example on the provider's page.

What the headline rate leaves out

The headline figure is for an ordinary domestic card. On the same Stripe page, premium European Economic Area cards go up to 2.8% + €0.25, UK cards to 2.5% + €0.25 and cards from other countries to 3.15% + €0.25, with another 2% if currency conversion is needed. PayPal adds 1.29% to payments from the UK and 1.99% to those from other markets outside the European Economic Area. Then there are disputes: Stripe charges €20 for each one you receive and another €20 if you contest it, although it refunds the second charge if you win; PayPal's standard dispute fee is €14. If someone from London buys from the roaster with a British card, the fee on an 18-euro order rises from €0.52 to €0.70. And a dispute over a 12-euro bag costs more than the sale itself.

Bizum, PayPal, Apple Pay and Google Pay: which methods to offer

More payment methods aren't better in themselves; what counts is having the one your customer uses. Going by the Banco de España figures, cards come first. Next come wallets such as Apple Pay and Google Pay, which pay with the card stored on the phone without typing any numbers. That matters more than it seems: in the same study, 24% of Spanish consumers said they had run into a technical problem when paying online, and the most common one, reported by 10%, was difficulty entering the payment details.

To offer Bizum in your online shop, you have to go through a bank. Bizum explains on its page for merchants that you always need an agreement with a bank that offers it, and that it's added through a certified bank payment gateway. For the customer it's simple: they choose Bizum, type in their phone number and approve the payment in their banking app. Bizum also supports recurring payments and subscriptions, which the customer approves the first time. If you use an independent gateway, ask beforehand whether it can offer Bizum.

PayPal makes sense if some of your customers ask for it. It's the highest rate of those mentioned here, so it's best offered as one more option, not the only one. And don't crowd the last step with logos: three or four well-chosen methods are easier to take in than ten, and every one you add is another connection to maintain.

Selling to customers from abroad

The roaster's French and German customers pay in euros, so the currency changes nothing. What does change is the language: the payment page should appear in the customer's own. Redsys, for example, can show its payment page in several languages and match its design to the shop's look. If you sell to countries with another currency, find out what currency conversion costs and who pays it, you or the customer.

Strong customer authentication: where payments get lost

Since the EU's second Payment Services Directive, known as PSD2, paying by card online almost always requires strong customer authentication: customers have to confirm it's really them with two elements of different kinds, something they know (a PIN or a password), something they have (their phone) or something they are (a fingerprint). In practice, it's the banking-app notification or the text-message code that arrives at checkout.

It's also where orders are lost. In the Banco de España study, 4% of consumers had trouble with authentication or passwords when paying online, and around 3% with being redirected to verify the payment. That's what was happening to the roaster's orders stuck at “awaiting payment”: the customer reached the bank's screen and never finished.

You can't switch it off, but there are cases where it isn't requested. Delegated Regulation (EU) 2018/389 allows it to be skipped for purchases of up to 30 euros, provided the customer hasn't built up more than 100 euros or five payments since the last authentication; for recurring payments of the same amount to the same merchant, after the first one; and for payments the provider rates as low risk, up to 100, 250 or 500 euros depending on its fraud rate. Those exemptions are applied by the payment providers, the customer's or yours, not by the shop: you don't decide when the code is requested.

And skipping it isn't free. Royal Decree-Law 19/2018, which brought the directive into Spanish law, says that if the merchant or its payment provider doesn't accept strong customer authentication, they have to make good the loss to the customer's bank. Put another way: if a payment that went through without a code turns out to be fraud, the shop usually ends up paying for it.

Subscriptions and saved cards

If you sell subscriptions, like a monthly bag of coffee, the first charge is authenticated and the following ones for the same amount can go through without it. To do that, the gateway stores the card securely, which is called tokenisation: the shop doesn't keep the card number, just a reference the gateway gives it to charge again. Redsys offers this as tokenised payment. If the amount changes from one month to the next, expect the bank to ask for confirmation again.

Where the customer types in their card details

There are three ways to set up the payment, and the difference matters for security. With a redirect, when the customer clicks “pay” they leave for the gateway's page, enter their card there and come back to the shop with the result. It's the simplest option: Redsys's documentation explains that in this case they handle both authorisation and authentication, and the shop just receives a notification with the payment status.

With embedded fields, the form appears inside your page, in your design, but the card fields are served by the gateway, usually in an iframe, and your server never sees the details. Redsys calls this inSite, and the large providers have something similar. The third way is your own form, which collects the card and passes it to the gateway. It works, but then your server is handling card data and the industry's security standard, PCI DSS, asks a great deal more of you.

For a small shop, one of the first two is the sensible choice. Even so, the website has to be kept up to date: the council that runs PCI DSS asks shops using embedded fields to confirm that their page isn't vulnerable to scripts that could tamper with it. Why sites with “nothing worth stealing” get attacked is covered in why small business websites get hacked.

What Spanish law says about taking payments online

Two rules are often broken without anyone meaning to. The first: you can't add a card surcharge, or a surcharge for any other payment method. Article 35 of Royal Decree-Law 19/2018 on payment services (in Spanish) prohibits charging extra for using any payment instrument. What it does allow is the opposite: offering a discount or another benefit to encourage a particular method. “+2% if you pay by card” isn't allowed; “5% off when you pay with Bizum” is.

The second is about refunds. If the customer withdraws from the purchase, Spanish consumer law gives you 14 calendar days to refund them, delivery costs included, and you have to use the same payment method they used, unless they agree to another one at no cost to them. You can wait until you get the product back or proof that it's been sent. That's why it pays to have a gateway that lets you refund a payment from the dashboard in a minute: a manual bank transfer only counts if the customer agrees to it.

The terms of sale, the returns policy and the rest of the pages a shop needs are covered in what legal pages your website needs. We're not lawyers and this isn't legal advice; it's what should be sorted out before you take your first sale.

Disputes and chargebacks: when the customer goes to their bank

A chargeback is what happens when the customer, instead of asking you for a refund, tells their bank they don't recognise the payment or never received the order. The bank can take the money back while the case is resolved, and you get a deadline to submit evidence. On top of that, many gateways charge a dispute fee, like the ones above.

Many can be avoided with simple things. Make sure the name on the customer's statement is recognisable: if the shop goes by one name and the company by another, the customer won't know what the charge is. Make sure the delivery tracking number reaches them. And answer questions by email or WhatsApp quickly. With 12-euro orders, sometimes the cheapest option is to refund the money before the complaint turns into a dispute.

How to choose a payment gateway in five questions

1. What's your average order? If it's small, compare the fixed charge before the percentage, and ask your bank for a written quote to set beside the published rates.

2. How do your customers pay? Look at the orders you already have, or ask. If they ask for Bizum, you need a bank that offers it; if you sell abroad, work out what cards from other countries cost.

3. Where and when does the money arrive? Into which account, how often, and whether each sale is paid in separately or several days' takings arrive together with the fees already deducted. The clearer it is, the easier the bookkeeping.

4. What about refunds and disputes? Whether you can refund from the dashboard, whether you get the fee back when you refund, and what a dispute costs you.

5. Does it connect to what you already use? Your shop platform, your invoicing software and your accounts. An official plug-in for your platform saves a lot of custom work.

Connecting the gateway to your invoicing

Taking the money is only half the job. Every paid order has to end up as an invoice, in the stock count and in the accounts, and that's where the hours go. Many gateways pay out several days' takings in a single transfer with the fees already taken off, so to reconcile the bank account you then have to split out each order and its fee. Done by hand, every order means a bit of copying and checking.

With a connection, the gateway tells the shop about each confirmed payment, the shop passes the order to the invoicing software, which issues the invoice, and the provider's payouts are matched to the orders automatically. Under Verifactu, what's more, a mistake made while copying an order by hand can't be fixed by deleting the invoice: it has to be corrected with a rectifying invoice, as we explain in Verifactu in Spain: what it is, who it affects and when. Building those connections is what our process automation service does, and when the shop needs something no platform offers, our custom software.

What integrating a payment gateway with us costs

Setting up the gateway is part of the shop project, which is priced per project with a fixed written quote before we start, as we explain in how much an online shop costs. The monthly fees on our pricing page, from 100 to 1,500 euros plus VAT, cover websites and online presence; a shop is quoted separately. If you already have a shop and just want to change gateway, add Bizum or connect payments to your invoicing, we also give you a fixed price for whatever needs doing. The contract with the bank or the payment provider is in your name, like everything we set up: if you leave one day, you take it with you.

E-commerce is one of the categories in the Kit Digital catalogue, covering a catalogue, a basket and a payment gateway. If the scheme reopens, you can join the waiting list on our Kit Digital page.

Your payment gateway, with a small team

We're three partners working from the Palau Firal in Sant Antoni de Calonge, with shops and businesses in the provinces of Girona and Barcelona. Ivan sets up the gateway and its connections to the shop, the invoicing and the accounts. Izan checks the website's security and makes sure purchases are measured, so you know where each order comes from. Jordi makes sure the last step is clear: which methods are shown, what each button says and what the customer receives after paying.

If you want to know which gateway suits you, message us on WhatsApp with your average order, how your customers pay today and which platform your shop runs on, and we'll tell you what we'd look at first. You can also write to us through the contact form.