E-Commerce Payment Processing Companies

The number that decides the winner is not on the rate card

Most e-commerce processor selections are run as a price comparison, and most are decided on the wrong variable. The difference between two competent providers' pricing is measured in basis points. The difference between their authorization rates is frequently measured in whole percentage points of revenue, and it lands on the top line rather than the cost line.

Work the arithmetic on illustrative numbers. Take a hypothetical store attempting $50 million a year in card volume. One point of authorization rate is roughly $500,000 of orders that would otherwise have failed at checkout, at close to full margin, because the marketing spend that produced them is already sunk. Ten basis points off the processing rate on the same volume is worth around $50,000 — roughly a tenth as much, from the variable everyone negotiates hardest.

Two cautions before treating a vendor's figures as comparable. Everyone measures differently — some count retries as separate attempts, some exclude soft declines, some exclude transactions abandoned during authentication — so fix one definition and apply it to both sides. And the rate is not a single number: it varies by issuing country, card product, method and ticket size, so a blended figure conceals exactly the segment where money is leaking.

The six numbers that make up the real cost of acceptance

A usable comparison model has six components, not one. The table is structural — who controls each and how to measure it, not what any of them costs, because processing prices and network fees move constantly.

The mistake this table prevents is comparing a flat blended rate against an interchange-plus quote as if they were the same kind of number. A flat rate bundles interchange, scheme fees and markup into one figure and is genuinely simpler. Interchange-plus exposes the components and lets a merchant benefit when its mix shifts toward cheaper interchange categories — Adyen passes interchange and scheme fees through at cost with its own fee stated separately, and Helcim publishes its margin over interchange openly. Legibility is not cheapness: at low volume and small ticket sizes a flat rate frequently wins.

Alternative payment methods are an acceptance problem, not a checkout feature

Outside the United States, the assumption that a shopper is holding a card is often simply wrong. A checkout offering cards alone in the Netherlands, Brazil, India or Poland is not offering a worse experience; it is offering no experience to a large share of the market. Local methods — bank-transfer schemes, instant payment systems, cash vouchers, domestic card networks — are the difference between having a market and not having one, and the strongest argument for a cross-border-capable acquirer over a domestic one.

Wallets behave differently again, and earn their place even in card-dominant markets:

• They arrive tokenized. A device wallet presents a network token with device-level authentication attached, which tends to authorize better than a keyed card and does not expire when the plastic does.
• They remove the form. The largest single source of mobile checkout abandonment is typing a card number on a phone.
• They carry their own economics. Alternative methods are usually priced per method rather than blended, which is why Adyen charges a payment-method fee alongside its processing fee. Adding methods changes the cost mix, not only the conversion rate.

PayPal is the special case, because it is a two-sided network rather than a method: it brings its own logged-in consumer base and converts shoppers who would not otherwise complete. It also brings a dispute process in which PayPal is both scheme and adjudicator, and a currency conversion margin applied on top of a base rate — both reasons to price PayPal volume separately.

3-D Secure and what the liability shift actually shifts

3-D Secure lets the card issuer authenticate the cardholder during an online purchase — either silently from device and behavioural signals, a frictionless flow, or by challenging the shopper with a one-time code or in-app approval. In Europe and the UK, strong customer authentication is a regulatory requirement with defined exemptions. In the United States it is optional, and the decision is commercial: on a successfully authenticated transaction, liability for a fraud chargeback moves from the merchant to the issuer, which is worth real money in high-fraud categories. Three limits get overlooked.

• It only shifts fraud. Disputes for item not received, item not as described, cancelled subscriptions and duplicate charges are unaffected — and for many merchants those are the majority of disputes.
• Challenges cost conversion. Every challenge creates an abandonment opportunity, and the abandonment is silent: it appears as a missing order, not as a decline. A blanket rule often loses more revenue than it saves in fraud.
• Authentication is not authorization. A transaction can authenticate successfully and still be declined by the issuer, so a merchant measuring only authentication success has measured half the funnel.

The workable pattern is selective: authenticate where the risk score, ticket size or issuing geography justifies it, use exemptions where the rules allow, and treat 3-D Secure as a branch in a routing decision rather than a switch. That is what platforms and fraud vendors sell as authorization optimization — Forter packages 3-D Secure routing and exemption handling alongside its fraud decisioning — and it is why a merchant with European volume should treat authentication strategy as part of processor selection.

Buy now, pay later is a conversion lever with a merchant-side price

BNPL works because it removes the reason a shopper abandons an expensive basket. It is also, structurally, a lending business presenting itself as a payment method, and the merchant pays for the credit whether or not the consumer does.

The merchant cost follows the product shape. Affirm's own FY2025 disclosures put roughly 72 percent of volume in interest-bearing monthly instalment loans, about 13 percent in 0 percent APR monthly instalments, and about 14 percent in short interest-free "pay in four" plans. The distinction is commercial: on a 0 percent APR promotion the consumer pays no interest because the merchant has bought it down, so promotional financing costs the merchant materially more than plans where the consumer pays. Klarna, which funds most of its lending from its own retail deposits under a Swedish banking licence, has a different cost of funds and the same two-sided model. Neither publishes merchant pricing, so the trade-off cannot be evaluated without a sales process.

Two things to hold onto. Measure incrementality, not attributed revenue: if BNPL is credited with every order that used it, it will always look excellent, and the number that matters is orders that would not have converted otherwise — a holdout test, not an attribution report. And treat the rulebook as unsettled. The CFPB issued an interpretive rule in May 2024 treating BNPL accounts as credit cards under Regulation Z, then confirmed its retraction in June 2025, while UK BNPL is being brought inside the FCA perimeter. The federal position reversed within about a year.

Fraud tooling: buy a decision, or buy a guarantee

There are three ways to buy online fraud prevention, and they differ in what is actually being purchased.

1. Rules the merchant writes itself, usually against the processor's built-in screening. Cheapest, fully explainable, and reliably too blunt at scale — static rules decline good customers in patterns nobody notices, because a false decline does not generate a complaint, it generates a lost sale.
2. The processor's own machine-learning screening, included or metered as an add-on. A good default, and it sees only that processor's traffic.
3. A specialist decisioning network such as Forter, which returns an approve-or-decline in the authorization path off a model trained across many merchants — the company describes a network spanning more than two billion identities across over 250,000 storefronts — and markets a chargeback guarantee assuming fraud liability on transactions it approves.

The guarantee is the interesting part, because it converts a variable, seasonal, tail-risk loss into a contracted vendor cost. Read its scope: it typically covers fraud-reason chargebacks and not item-not-received or not-as-described disputes, which for many merchants are the larger category. And be clear about the trade — automated decisioning off a proprietary cross-merchant model buys accuracy and gives up the ability to explain why a particular legitimate customer was turned away. For small and mid-market merchants the question is moot: Forter publishes no pricing, no tiers and no self-serve entry.

Lock-in is a cost, and one platform charges it explicitly

Switching cost never appears in a comparison spreadsheet and frequently exceeds every line that does. It has three sources: the stored card credentials, the platform contract, and the risk relationship.

The clearest documented case is Shopify. Shopify Payments is not a separate processor — Shopify's own US Shopify Payments Terms of Service name Stripe, Inc. (or its affiliate Bridge) and PayPal, Inc. as the payment processors — and Shopify sets the merchant-facing price. The structural point is what happens if a merchant wants a different gateway: Shopify's help documentation states that third-party transaction fees apply on all third-party and alternate payment gateways even when Shopify Payments is activated, with PayPal and manual payments excluded when Shopify Payments is on, and a possible waiver at the Plus tier depending on location. That fee sits on top of whatever the alternative gateway charges, so a merchant who negotiates a better deal elsewhere pays the better deal plus Shopify's fee — which can make the cheaper processor the more expensive option. Merchants in countries where Shopify Payments is unavailable carry the fee across their entire volume with no way to avoid it.

Credential portability is the second source. If stored cards live only in one processor's vault and cannot be exported, switching means asking every customer to re-enter a card, which for a subscription business is an extinction-level request. Braintree is unusual in publicly documenting that a merchant can export its tokenized card data to another PCI-compliant provider. Spreedly sells the same independence as a product: credentials are vaulted with Spreedly and presented to whichever provider the merchant chooses, and because it never touches the money, the merchant keeps its own acquiring relationships and chargeback liability. Orchestration earns its cost when a merchant genuinely intends to run more than one acquirer; for a single-gateway store, it solves a problem that has not arrived.

The third source is risk. Aggregator-model providers underwrite after onboarding, which is what makes instant signup possible and abrupt reserves, payout holds and account closures possible too. Stripe, Square, PayPal and Shopify Payments all reserve broad discretion in their published terms to hold funds or terminate — an acceptable trade at small scale, and a single point of failure for a business whose payroll depends on Friday's settlement.

Choosing, and the mistakes worth avoiding

Reasonable defaults, stated plainly. A pre-launch or early-stage store should take an aggregator — Stripe, Square or PayPal — because instant onboarding and a flat rate beat every theoretical advantage of a negotiated account at low volume, and should assume it will migrate later. A US or Canadian small business wanting published interchange-plus and no contract should look at Helcim, and elsewhere the moment it needs European acquiring or wants to onboard sub-merchants, because it offers neither. A merchant with real international volume and an integration budget belongs with Adyen or Checkout.com, both of which hold their own acquiring permissions; neither will onboard a small merchant, and Adyen confirms a minimum invoice applies. Where PayPal and Venmo acceptance is load-bearing, Braintree is the fit — but it has no card-present product at all.

The recurring mistakes:

• Selecting on headline rate. A quote ten basis points cheaper and two points worse on authorization is a large net loss disguised as a saving.
• Accepting a blended effective rate as the comparison unit without asking what share is interchange and scheme fees, neither of which any processor controls.
• Turning 3-D Secure on globally, then blaming the revenue drop on seasonality, because abandonment during authentication is invisible in the decline reports.
• Treating a bundled fraud tool as free. Its cost is the fee plus the fraud that gets through plus the good customers it declines, and only the first appears on an invoice.
• Ignoring the exit. Ask before signing where the tokens live, whether they are exportable, and what the platform charges for using an outside gateway.

Frequently asked questions