Getting Paid Online: Payment Gateways for SA Business

Every other page on your website is allowed an off day. The product photo can be a bit dark, the About page can be a year out of date, the blog can go quiet for a month. The checkout gets no such grace. It is the one screen where a customer has already decided to give you money, and every second of friction, every unfamiliar logo, every "transaction declined" with no explanation is a sale that quietly evaporates.

Choosing a payment provider looks like a pricing exercise. It is actually three decisions wearing one coat: how your customers want to pay, how quickly you need the money, and who carries the loss when a payment goes wrong.

What a gateway actually does

Three different things get called "the payment gateway", and confusing them is how businesses end up with a surprise contract. The gateway is the plumbing that carries the transaction from your checkout to the card networks. The merchant account is where the money lands before it reaches your bank account. The acquirer is the bank underwriting the whole arrangement and deciding whether you, as a business, are a risk worth taking.

The modern providers — Yoco, PayFast, Peach, Ozow, Stitch, iKhokha, Stripe and the rest — bundle all three into one signup, which is why you can be taking card payments the same afternoon. That convenience is real. It also means the underwriting decision has not disappeared; it has moved to a risk team you will never meet, who can hold your settlement if your refund rate spikes or your turnover jumps unexpectedly. Worth knowing before it happens rather than during.

The South African menu, honestly

There is no single best option, only a right mix for how your customers actually behave.

Cards are the default for online and the one payment method nobody has to be taught. They are also the most expensive per rand and the only method with chargebacks attached. Instant EFT — where the customer logs into their bank inside a payment window — is popular here in a way it is not everywhere, because a large share of South African shoppers hold cards they would rather not put into a website. It is generally cheaper than card and effectively irreversible, which cuts both ways: no chargebacks for you, and no recourse for a customer who feels wronged, which lands the dispute back on your support desk instead.

PayShap and the bank-led instant payment rails have quietly changed the low-value end: near-instant, cheap, paid from an account rather than a card, with a proxy instead of an account number. Debit orders, and DebiCheck for the authenticated kind, remain the right answer for anything recurring and predictable — a subscription, a service plan, a monthly retainer. And card machines from the same providers matter more than an online-only business expects, the moment a customer stands in front of you.

Customers do not choose a payment method the way a finance manager would. They choose the one they trust at 9pm on a phone. Offer two they trust, not five they have to think about.

The number on the rate card is not the cost

Published pricing moves constantly and every provider will negotiate above a certain volume, so treat any figure you read anywhere — including here — as out of date and get today's rate in writing. What does not change is the shape of the cost, and that is what you should compare:

• Percentage plus a fixed fee. The fixed portion is what quietly kills low-value transactions. A flat charge on a R60 sale is a different business than the same charge on a R6 000 one.
• Settlement period. Money that arrives the next business day and money that arrives a week later cost the same on the rate card and are worth very different amounts to a business paying suppliers on terms.
• Monthly fees, terminal rental and minimums. Cheap per-transaction rates often carry a floor you will not reach in a quiet month.
• International and forex. Foreign cards usually attract a higher rate, and a cross-border sale can carry a conversion spread on top.
• Refunds and chargebacks. Ask specifically whether the original transaction fee is returned on a refund. Frequently it is not, which means a refunded sale costs you money twice.

Never touch a card number

The single most expensive mistake in this space is building anything that stores, logs or emails a card number. The moment card data touches your server, you inherit a compliance burden that is not proportionate to any business your size. The correct pattern is boring and universal: the customer enters card details on the provider's hosted page or in their embedded field, and your system receives back a token — a meaningless reference that lets you charge the same card again without ever knowing what it is.

The same discipline applies to your own records. A support ticket with a card number in the body, a screenshot in a WhatsApp group, an "order notes" field with the last transaction pasted in for reference: all of it is a breach waiting to be discovered, and all of it also engages your obligations under POPIA. The rule is simple enough to put on a wall: if it identifies a card, it does not live in our systems.

The part nobody plans for: reconciliation

Here is what catches almost every business the first month. You invoice a customer R1 150. The customer pays R1 150. Your bank statement shows R1 118.43, three days later, bundled with fourteen other payments in a single settlement line.

The deposit is net of fees, batched by day, and offset by refunds — so it will never match an invoice, and your bookkeeper cannot allocate it. The fix is a clearing account: payments post to it when the gateway confirms them, the settlement clears it when the money lands, and the fees post to their own expense line where you can actually see what payments cost you per month. Any accountant will set this up in an hour; almost nobody does it before the first messy month-end. If your books live in Xero or QuickBooks, most providers have a feed that does the heavy lifting — but the account structure still has to be right underneath it.

Recurring billing is a different animal

Charging the same customer every month is not "the same integration on a schedule". Cards expire, get replaced after fraud, and decline for reasons the customer never sees. A serious subscription setup needs dunning — a defined sequence of retries and notices when a payment fails — or you will lose customers who never intended to leave. For a predictable monthly amount from a South African bank account, an authenticated debit order is often more durable than a card, at the cost of a slower, more formal mandate process. Pick per customer segment, not per ideology.

Fraud, and who eats it

On a card-not-present transaction that turns out to be fraudulent, the merchant usually carries the loss — the goods are gone and the money is clawed back. 3D Secure shifts much of that liability back to the issuer, at the cost of a little checkout friction. For most businesses selling physical goods, that trade is worth it. The practical defences are unglamorous: watch for orders that do not fit your normal pattern, be careful with first-time, high-value, express-delivery orders, and never ship on a payment your gateway has flagged for review because the customer is on the phone insisting.

Choosing, in three questions

Strip the marketing away and the decision comes down to this. What do my customers already use? — build for their habits, not your preferences. How fast do I need the money? — settlement speed is worth more than a tenth of a percent to most small businesses. What happens when something goes wrong at 4pm on a Friday? — the answer to that question is the actual product you are buying, and it is the one thing no comparison table shows you. If you are running a store on Shopify or WooCommerce, check which providers have a maintained plugin before you fall in love with a rate; a supported integration you can upgrade beats a cheaper one that pins you to an old version of your own store.