Track 08
Promise: you will know the three ways a website gets paid, which one fits your business, and the one security rule that keeps card data from ever becoming your problem.
Card numbers should never touch your website, your computer, or your email. Every legitimate way of getting paid online is engineered around that rule: the customer's browser talks to the payment gateway, the gateway talks to the card networks, and you receive a confirmation and a token — never the number itself. This is not just hygiene. The card industry's security standard (PCI DSS) applies to any system that stores, processes, or transmits card numbers. Keep numbers out of your systems entirely and your compliance obligation shrinks to a short self-assessment and good account habits. Let numbers touch your systems and you have adopted an auditor's workload you do not want.
The simplest door: your gateway generates a hosted payment page with its own address, and you send the link — by text, email, invoice, or a button on your site. The customer pays on the gateway's page, with card-not-present protections running by default: CVV required, AVS available, tokenization built in (Track 04). Payment links fit deposits, one-off invoices, phone-order follow-ups, and service businesses that do not need a catalog. If your website today is a brochure and a phone number, a payment link is your fastest honest upgrade: one button — "Pay a Deposit" — changes what the site does for you.
When you sell products or bookable services, a real checkout earns its keep: a cart or booking flow on your site that hands the payment step to the gateway — either by redirecting to the gateway's hosted page or by embedding the gateway's payment fields, which send the number directly from the customer's browser to the gateway without it passing through your server. Either architecture honors the one rule. What checkout adds over links: itemized orders, automatic receipts, inventory or calendar integration, and a complete evidence trail per order — the same records that make disputes winnable (Track 03). The discipline to observe: itemized, clearly named products. A customer who cannot recognize the charge on their statement — because your descriptor or product names do not match your storefront — is a chargeback you authored.
For memberships, plans, and repeat services, the website's job is the agreement, not just the payment. The customer authorizes you to store their card as a gateway token and charge it under stated terms: amount or how it is calculated, frequency, and how to cancel. That authorization — captured at signup, with the terms on the screen they agree to — is what separates a subscription business from a stack of future disputes. Keep the record of consent with the token, send receipts for every charge, and make cancellation genuinely easy: a customer who can cancel in two clicks does not need their bank's help, and recurring revenue built on friction-free exit is the kind that lasts.
Walk-through — a detailing shop, three steps
Step 1 — the deposit link. The shop adds a "Book & Pay Deposit" button that opens its gateway's hosted page. Bookings stop depending on phone tag, and deposits arrive as card-not-present payments with CVV and AVS on record instead of numbers read aloud at the counter.
Step 2 — services as checkout items. The three detail packages become checkout products with clear names that match the in-store menu, so the statement descriptor and the purchased item both read recognizably to the customer.
Step 3 — a maintenance plan on file. Regulars are offered a quarterly plan: written terms at signup, card held as a gateway token, a receipt emailed at every charge, cancel anytime from a link in the receipt. The shop never stores a single card number at any step — the gateway holds every token, and the shop's PCI self-assessment stays the short version.
Website payments are card-not-present transactions and price like them (Track 04): higher interchange than a chip read at your counter, because the fraud risk is real. That is the cost of selling while you sleep, and for most businesses the trade is worth it — but budget for it with open eyes rather than discovering it on a statement (Track 01). Also know what a website does not do: it does not generate its own traffic, and it does not replace the counter for card-present sales. It is one channel in a setup that should be designed as a whole — which is the conversation we have with every merchant, whether the website is one we build or one you already have.
If any item fails, fix that item before adding features.
Two Minutes
Websites and payments are two of the six areas in the free EBS Growth Check — payments, equipment, funding readiness, benefits, formation, and marketing. See the whole picture in one pass.