A virtual terminal and a payment gateway are not competing products. The gateway is the secure pipeline that carries card data from your checkout to the processor and returns the issuer’s response. The virtual terminal is a browser-based screen where a person on your team types a card in by hand, and it relies on a gateway to move that payment. If customers pay themselves on your website or in your app, you need a gateway integration. If your staff takes payments by phone, mail or email, you need a virtual terminal. Most high-volume and high-risk merchants end up with both on the same merchant account.
This guide explains how each works, where PCI scope and fraud exposure differ, how 3D Secure fits in, and how to decide, with particular attention to merchants that mainstream processors have declined.
A payment gateway is the technology layer that captures payment data, encrypts it, routes it to the processor and acquiring bank, and returns an approve or decline message to the merchant. It can be embedded in a website through hosted pages, a JavaScript form or an API, and it can also connect to subscription billing platforms, shopping carts and ERP systems. Because the customer enters the card details, the process is automated and scales with traffic.
Our payment gateway service covers this layer, and our page on payment gateway integrations for ecommerce lists how it connects to the platforms merchants already run.
A virtual terminal is a secure web interface that works like a card reader on a screen. An employee logs in, keys in the card number, expiration date, billing address and amount, and submits the payment. Behind that screen, the same gateway authorizes the transaction. That is why the two are often confused: the virtual terminal is the manual front end, and the gateway is the engine.
Virtual terminals suit phone and mail order payments, invoices paid over the phone, and B2B accounts receivable. Ours is offered alongside ACH and eCheck processing on the B2B and B2G payments page.
| Factor | Virtual terminal | Payment gateway |
|---|---|---|
| Who enters the card | Your staff | The customer |
| Typical channel | Phone, mail order, email, invoices | Website, app, recurring billing |
| Volume fit | Low to moderate, limited by staff time | High, automated |
| Setup | Login and browser, often live quickly after approval | API or plugin integration, development time |
| Relies on the other | Yes, runs on a gateway | No, works on its own |
| PCI path | Often SAQ C-VT if conditions are met | Depends on integration (hosted page, direct post, API) |
| Main risk | Keying errors, staff handling card data | Card testing, bot attacks, integration flaws |
| Fraud tools | AVS and CVV checks, manual review | AVS, CVV, velocity rules, 3D Secure, tokenization |
The gateway handles steps 2 through 4 in both cases. Only step 1 differs.
Choose a virtual terminal when a human is already in the conversation:
The limits are plain. Every payment depends on a person, so volume is capped by headcount, and each manual entry introduces a chance of typos and of card data lingering on paper, in email or in a spreadsheet. A virtual terminal also does nothing for customers who want to pay themselves at 2 a.m.
Choose a gateway integration when customers pay without your involvement:
The cost of a gateway is integration effort and a larger security surface. The upside is speed, consistency and the ability to apply fraud rules automatically to every transaction.
All businesses that accept cards, regardless of size or volume, must validate PCI DSS compliance, as the PCI Security Standards Council states for merchants. Small businesses usually do this through a Self-Assessment Questionnaire (SAQ), while larger entities may need a Report on Compliance from a Qualified Security Assessor. Your acquirer will tell you which level applies to your volume.
The path differs by channel:
The practical rule: the less card data touches your own systems, the lighter your compliance burden and the smaller your breach exposure. The same logic applies to staff using a virtual terminal. Train them not to write card numbers down, and keep the workstation dedicated to payment entry.
The other question merchants raise is where 3D Secure fits. 3DS is an authentication step. As Visa explains, authentication verifies that the person paying is the actual cardholder, while authorization confirms the transaction is valid with the issuer, for example by checking funds and account status. They are separate checkpoints, with authentication happening before authorization.
Modern EMV 3DS runs risk-based authentication in the background. According to EMVCo, it analyzes data points about the transaction and only triggers a challenge, such as a one-time password or biometric check, when the risk warrants it. That keeps friction low for the majority of shoppers.
Because 3DS needs the cardholder to interact with their bank, it belongs in customer-entered flows on a gateway. A phone order keyed by an employee generally cannot run a 3DS challenge in the same way, which is one reason manual channels lean on AVS, CVV and careful verification instead. Visa published a case study in which Best Buy Canada’s card-not-present fraud rate fell from 36 bps to 19 bps in the first quarter after implementing Visa Secure with EMV 3DS. Results vary by merchant and portfolio, but it shows what authentication can do to your ratios.
For implementation details, see our 3D Secure 2 implementation guide and the walkthrough of the 3DS 2.0 authentication flow.
Both channels are card-not-present, so both carry chargeback exposure. Visa’s dispute rules give CNP merchants compelling evidence options, such as device IP, geolocation and proof of delivery of digital goods, to contest certain disputes. A gateway captures much of that data automatically. A virtual terminal does not, so you need to preserve call notes, signed authorizations, order confirmations and delivery records yourself.
Whatever the channel, build the evidence file at the time of sale, not after the dispute arrives. Our chargeback management and representment service and the guide on preventing chargebacks cover the process in more depth.
If your business is in CBD, nutraceuticals, subscriptions, adult, firearms, vape or similar categories, the gateway and terminal question comes second to a more basic one: which acquiring bank stands behind them. A gateway is only a connection. If the merchant account behind it is frozen or terminated, the gateway stops working too, and a virtual terminal goes dark along with it.
Two practical consequences follow:
It also pays to understand the other side of this market. The FTC has pursued processors that enabled deceptive free trial schemes through credit card laundering. Legitimate high-risk providers differ by running transparent underwriting and client screening, which is why a thorough application should feel rigorous, not casual.
Most of the merchants who come to us asking about a virtual terminal versus a gateway are really asking about a different problem: a processor has frozen funds or declined them, and they need to know what to rebuild. Our view is that you should choose the channel by how customers actually pay, and the merchant account by how resilient it is.
We treat the virtual terminal as a controlled back-office tool and the gateway as the system of record for everything customer-facing. Where possible we want card data to stay out of your environment entirely, because that is the cheapest compliance and the safest breach posture. We also insist on being transparent about reserve structures and quote-based pricing before you sign, since a clean integration is worth little if the reserve terms surprise you in month three.
For high-risk volume, we recommend planning your gateway, your terminal and your chargeback process together, with a backup acquiring path, rather than adding each after something breaks.
— Joshua Benedetti
If mainstream processors have turned you away, we place high-risk businesses with sponsor-bank-backed merchant accounts and connect the gateway, virtual terminal, ACH and chargeback tools you need. Start with our high-risk merchant account page, or look at the broader merchant services and payment processing offering. Pricing is quote-based, and we explain reserve terms up front.
No. A virtual terminal is an interface, and it needs a gateway to encrypt the data and send it to the processor. In practice, providers bundle the two, so you receive a login and the gateway is already built in.
It is often cheaper to start because there is no development work, only a login. Per-transaction cost depends on your processor’s pricing, and manual entry may carry less favorable rates because of the card-not-present risk. Pricing varies by merchant, so ask for a quote for each channel.
Not by itself. Compliance is something you validate, and the PCI Council requires it of all card-accepting businesses. Using a processor-hosted virtual terminal on an isolated computer may qualify you for the shorter SAQ C-VT, but only if you meet its conditions, including not storing cardholder data electronically.
Generally, 3DS is built for customer-entered checkouts because the cardholder must authenticate with their issuer. Manual phone and mail entries rely on AVS, CVV checks and documentation instead. If you want 3DS protection, route those customers to a payment link or hosted page on your gateway.
Every merchant's processing setup is different, so the right answer depends on your industry, sales channels, average ticket size and chargeback history. CARDZ3N's payments specialists review those details with you and match your business with the right sponsor bank, gateway and risk tools, whether you sell online, in store, by invoice or on a recurring subscription.
We work with merchants across the USA, Canada, the UK and the EU, including high-risk, B2B and fast-growing businesses that traditional processors often turn away. If you would like a second opinion on your current rates, contract terms or approval options, contact our team for a free, no-obligation processing review.
Joshua Benedetti is the CEO of CARDZ3N, a Las Vegas-based merchant services provider specializing in high-risk payment processing and B2B payment technology.
Joshua Benedetti on LinkedInCARDZ3N Inc is headquartered in Las Vegas, Nevada, and provides merchant services to businesses that traditional processors turn away. Backed by top-tier sponsor banks and processors, CARDZ3N combines institutional stability with the speed of a specialized team that understands high-risk industries. Services include high-risk account underwriting and placement, gateway solutions across the major gateway platforms, POS integrations, ACH and check processing, chargeback prevention through ChargebackZ3N, and business lending and working capital. Its AerospacePay division serves OEMs, MROs, FBOs, and repair stations with B2B and B2G payment processing. CARDZ3N serves merchants in the USA, Canada, the UK, and the EU.
Start protecting your revenue from chargebacks today — schedule your complimentary consultation with CARDZ3N’s dispute management specialists.
