Choosing a payment gateway: Cost, security and integration
· PoolByte Technology
For a business selling online, virtual POS and payment infrastructure is the last step in which the customer makes his purchasing decision. If the payment page opens slowly, the verification screen on mobile is broken, or gives an unexpected error, you will lose the customer who has made it all the way to the cart. On the other hand, the cost of the infrastructure you choose, the time it takes for the money to be transferred to your account, and security obligations also directly affect the cash flow of your business.
There are two basic ways for online card collection in Türkiye: making a virtual POS agreement directly with a bank or receiving collection through a licensed payment institution. In this article, we discuss the two models and the criteria you should look at when making your decision.
Two basic models
In a bank virtual POS, a business signs a merchant agreement with a bank and payments pass directly through that bank's infrastructure. It may offer commission negotiation opportunities for businesses with high transaction volumes. The application process usually requires company documents, operating information and bank evaluation. In order to benefit from installment campaigns of different banks, it may be necessary to make separate agreements with more than one bank.
Payment institutions, on the other hand, allow you to accept cards from many banks with a single integration. Application and installation are generally faster, ready-made ecommerce plugins are common, and getting started is easy for small businesses. Payment institutions in Türkiye are authorized and supervised by the Central Bank of the Republic of Türkiye within the scope of Law No. 6493. Check whether the institution you will work with is authorized or not from the list published by the Central Bank.
Calculate the cost with all its items
In virtual POS offers, looking only at the declared commission rate can be misleading. When making comparisons, consider these items together:
- Separate commission rates for single withdrawal and installment transactions
- Time for the money to be transferred to your account (value date) and additional costs of early payment options
- Setup, monthly or annual fixed fees
- Fees for returns and chargeback transactions
- Collection conditions with foreign cards and foreign currency
Calculate an example month based on your own sales distribution: how many transactions are single transactions, how many are in installments, what is the average basket amount? When you apply the same scenario for each quote, the real cost difference becomes apparent.
3D Secure and the place of card data in security
3D Secure is a protocol that allows the cardholder to verify the transaction through their bank. The user usually completes the transaction with a single-use code from his bank or with confirmation in the bank application. This step reduces the risk of fraud and, in many cases, shifts dispute responsibility to the cardholder's bank.
The second critical issue is where the card data is processed. Methods in which the card number never reaches your server, that is, the payment page hosted by the payment provider or the secure form component of the provider, significantly reduce your security burden. Do not store card information in your own database; If registered card feature is required, do so with the provider's card storage (tokenization) service. The international PCI DSS standard applies to all parties processing card data.
Test integration quality
When choosing a virtual POS, also consider the technical side. Is there an up-to-date and maintained plugin for the e-commerce platform you use? Is the API documentation clear and exemplary? Is there a test environment offered where you can try it without using real money?
The payment result is usually delivered to your site with a return address or notification (webhook). This notification must be verified, the order must not be confirmed again if the same notification is received twice, and the order must not be suspended if the notification is delayed. We explained these details in our webhook integration guide.
Don't neglect customer experience
Try the payment page on a real phone with mobile data. Check that the 3D Secure screen opens correctly, error messages are clear and installment options are clearly displayed with their amounts. When the payment fails, the user can try again without losing their cart, which also protects the conversion.
Payment forms are also the target of card-shaming attacks; Stolen card information is tested with small amounts of transactions. Against such attacks, rate limiting and bot controls in our form spam protection guide should also be applied at the payment step.
Prepare the legal and operational side
Payment infrastructure alone does not mean you are ready to sell online. The distance sales contract, preliminary information form and return conditions must also be located in the right place on your site; We have covered the details in our e-commerce legal pages guide. If you are planning the infrastructure of your e-commerce site, you can also take a look at our e-commerce solutions.
Frequently asked questions
Can I get card information through the form on my own site?
Processing card data on your own server imposes heavy security and compliance obligations. For most businesses, the best way is to use methods where card information is entered directly into the payment provider's secure component.
Should I use more than one payment provider?
If your transaction volume is high, it may be considered to keep a second infrastructure ready so that sales do not stop in the event of a provider outage. For small businesses, a single, well-integrated provider is often sufficient.