Payment Gateway Glossary: 30 Terms Every Ecommerce Operator Should Know

Payment contracts and dashboards are full of terminology that's rarely explained anywhere convenient. Here's a working reference, grouped by category.

Fees & settlement

• MDR (Merchant Discount Rate): The fee a merchant pays per transaction, typically a percentage plus a small fixed amount. Varies by payment method and merchant category.
• Interchange fee: The fee paid by the merchant's bank (acquirer) to the customer's bank (issuer) on card transactions — usually the largest component of MDR on card payments.
• Settlement cycle: The time between a transaction being captured and funds landing in the merchant's bank account (commonly T+1 or T+2 in India).
• Rolling reserve: A percentage of transaction volume a gateway holds back for a period, used as a risk buffer against chargebacks — common for higher-risk merchant categories.
• Chargeback: A forced transaction reversal initiated by a customer's bank, typically due to a dispute or fraud claim, often carrying an additional penalty fee beyond the refunded amount.

Integration & technical

• Payment gateway: The technology layer that securely captures and transmits transaction data from checkout to processor.
• Payment processor: The entity that actually moves funds between the merchant's and customer's banks.
• Payment aggregator / PSP (Payment Service Provider): An entity that lets merchants accept payments without setting up a direct merchant account with a bank — most Indian gateways (Razorpay, Cashfree, PayU) operate this way.
• Merchant of Record (MoR): An entity that takes on legal responsibility for a transaction (tax collection, compliance, chargebacks) on behalf of the actual seller — Paddle is a well-known example for SaaS.
• Tokenization: Replacing sensitive card data with a non-sensitive token for storage/reuse, reducing PCI scope since raw card numbers aren't retained.
• 3D Secure (3DS): An additional authentication step (e.g., OTP) for card transactions, shifting fraud liability away from the merchant when used correctly.

Compliance

• PCI DSS: Payment Card Industry Data Security Standard — the security requirements that apply to anyone storing, processing, or transmitting card data.
• SAQ (Self-Assessment Questionnaire): The specific compliance form a merchant fills out, with the type (A, A-EP, D, etc.) determined by their integration model — hosted checkout vs. direct card handling carry very different SAQ burdens.
• CVV/CVC: The card verification code — PCI rules generally prohibit storing this after authorization, even in tokenized systems.

India-specific

• UPI (Unified Payments Interface): India's real-time, account-to-account payment rail, now covering roughly 85% of the country's retail digital payment volume.
• UPI AutoPay: The e-mandate framework enabling recurring UPI payments (subscriptions), requiring a one-time mandate approval by the customer.
• VPA (Virtual Payment Address): The UPI equivalent of an account identifier (e.g., name@bank), used instead of sharing bank account/IFSC details directly.
• NPCI (National Payments Corporation of India): The umbrella organization that operates UPI, RuPay, and related retail payment infrastructure in India.

Risk & fraud

• AVS (Address Verification Service): A fraud check comparing the billing address entered at checkout to the one on file with the card issuer.
• Velocity checks: Fraud rules that flag unusual transaction frequency (e.g., many attempts in a short window) from the same card, device, or IP.
• Involuntary churn: Subscription cancellations caused by failed payment renewals (expired cards, insufficient funds) rather than a deliberate customer decision to leave.

This isn't exhaustive, but it covers the terms that show up most often in gateway contracts, PCI questionnaires, and settlement reports — the vocabulary you need to actually negotiate and audit a payments stack rather than just use one.