In short: A shop needs cards, PayPal, digital wallets such as Apple Pay and Google Pay and, depending on its customers, bank transfer, instalments or cash on delivery. Card data must not pass through your server: you use a payment provider. PSD2 requires strong customer authentication, with some exemptions.
The payment method is the last step before the order. If the option the customer expects is missing, or the payment looks unsafe, the sale falls through. It pays to choose carefully without filling the page with logos nobody needs.
The methods you need in most cases
- Credit and debit cards. The basic method. Visa and Mastercard are the most widespread. American Express is only worth offering if your customers use it.
- PayPal. Many customers would rather not type their card details into a site they don't know.
- Apple Pay and Google Pay. On a phone, customers pay with a single tap. They greatly reduce the number of fields to fill in.
- Bank transfer. Useful for large orders and for B2B. Its drawback is that you have to check by hand that the money has arrived.
- Paying in instalments. Pay-in-instalments services can raise the average order value on expensive products. Weigh up the fees and requirements before switching them on.
- Cash on delivery. Still requested by part of the Italian public. It comes with costs and the risk of parcels being refused on delivery.
Don't add a method just because it exists. Every method has fees and needs handling in your accounts. Start with the three or four your customers use and look at the data after a few months.
What lies behind a secure payment
3D Secure and strong authentication
The European payments legislation (PSD2) requires strong customer authentication (two factors) for electronic payments, usually through the bank's app. There are some exemptions, for example for very small amounts. Your payment provider switches it on for you. For the customer it means one extra step. For you it is a safeguard, because card scheme rules normally shift liability for fraud on authenticated transactions to the issuing bank.
Who holds the card data
Card numbers must not pass through your server. Reputable payment providers (Stripe, PayPal, Nexi and others) display the card field inside a secure window and send you back only the outcome. This greatly reduces the obligations that the PCI DSS security standard places on anyone handling card data. If an agency suggests storing card data on your site, say no.
Certificate and an up-to-date site
The HTTPS padlock is essential but not enough. A site that isn't kept up to date can be compromised and used to steal data elsewhere. Theme, plugins and apps need to be kept current.
Fraud and disputes
- Check unusual orders: shipping and billing in different countries, very large amounts, many attempts from the same person.
- Keep proof of delivery with the courier's tracking.
- Respond to disputes (chargebacks) within the deadlines set by your provider. Attach the order, your correspondence and the tracking.
How to choose a provider
- Total fees, not just the percentage: the fixed fee and the charges for foreign payments count too.
- How long it takes for money to reach your account.
- Integration with your platform and your management software.
- Support in your language.
- Handling of refunds and disputes.
Further reading: where orders get lost at checkout · mandatory information for an online shop · integrations
Frequently asked questions
Which payment methods does an online shop need?
Cards, PayPal and digital wallets cover most purchases made on a phone. Bank transfer, instalments and cash on delivery depend on your customers and the value of your orders.
What is 3D Secure?
It is the mechanism the bank uses to verify the identity of the person paying by card, usually through its app. It implements the strong customer authentication required by PSD2.
Can I store card data on my site?
It is not advisable. Reputable payment providers display the card field in a secure environment and return only the outcome. That greatly reduces your obligations under the PCI DSS standard.