Payment method

Just like with delivery when making a purchase in an online store, offering a suitable payment method plays a crucial role.

The decision to operate in a foreign market also involves market research, as it is necessary to determine which payment methods are most commonly used in each market. This information then needs to be integrated into the payment system on our website, as different countries have different payment methods for online purchases.

Payment provider. You almost never connect payments directly to banks; you go through a payment service provider (PSP). It gives you a payment page or an embedded form, runs 3DS2, handles refunds, chargebacks and fraud detection, and pays the amount out to you. When choosing, compare: the range of methods (cards, wallets, transfers, installments), fees, payout speed, support for the markets you sell in, integration with your platform, fraud-prevention tools and data location. If you sell in several countries, bear this in mind too: one provider with local payment methods is better than five separate ones.

Here is a brief list of various payment methods, from technologically primitive to currently most popular payment methods.

Cash on Delivery (COD)

With this method, the customer makes the payment upon the delivery of the items by the delivery service. This means that we do not receive payment for the order when it is placed on the online store but only upon the delivery of the package. In the case of our own package delivery, the customer makes the payment directly to the online store, while in the case of delivery by delivery services, the payment is usually made to their account, and the delivery services later transfer the funds to our account.

With cash on delivery, we need to be cautious about delayed receipt of funds, as there may be several days between the order and the receipt of funds. Payment usually takes at least one day, but it can take longer, especially for orders to remote addresses, which can take a week or two, depending on the delivery time.

For larger stock turnovers, especially for new stores, this payment method can tie up a significant portion of available funds.

We also need to be careful about uncollected packages, which are most common with this payment method. This happens mainly because customers have no obligation to collect the package since they have not yet made the payment. Additionally, customers may change their minds, especially for impulsive purchases.

Cash on delivery is more expensive due to the delivery process, as there are additional costs associated with it.

Bank Transfer

In this case, payment for the order is not made immediately. Upon placing an order, the user receives payment details and the order is dispatched after the payment is received. This payment method offers higher security in terms of receiving the items and causes fewer issues compared to cash on delivery.

However, payment by bank transfer presents a challenge to online stores due to the slightly different order processing procedure. First, we need to wait for the payment and then process it appropriately, which can result in a longer delivery time. We must check the payments with the bank and then send out the paid items. If the banks have external system connections, we can automate the entire process. Otherwise, we may need to manually review transfers, which can take additional time. In both cases, we need to ensure the use of references or reference numbers to track orders and received payments. It is common for customers to overlook this aspect, which leaves us with more research work to reconcile and deliver items correctly.

Cards (Debit and Credit)

Payment cards are the most common payment method for online purchases. With a debit card the amount is debited immediately from the customer's account, with a credit card at the end of the billing period. For the seller every card is welcome, because the payment arrives immediately and there is no risk of an uncollected package. The customer usually enters the card number, expiry date and security code (CVC/CVV, a three- or four-digit number), and then confirms the payment with additional authentication (see below).

Strong Customer Authentication (SCA) and 3-D Secure 2

Under the EU Payment Services Directive (PSD2), most online card payments in the European Economic Area must include strong customer authentication: confirmation with two of three elements (something the customer knows, has or is). In practice this means the 3-D Secure 2 (3DS2) protocol, where the customer confirms the payment in their banking app, most often with biometrics or a PIN. The advantage is less fraud; liability for fraud is shared under the rules of the card schemes and legislation, so check this with your payment provider.

The payment provider uses the legal exemptions (low amounts, low risk, recurring payments) so that the customer is not burdened unnecessarily. Every additional step still reduces the number of successful payments, so choose a provider that implements 3DS2 well, and tell customers clearly at checkout what they will see.

Data Security and PCI Compliance

PCI DSS is a global security standard applied when handling personal data in an online store (e.g., debit and credit card numbers). This security standard is necessary for storing, transmitting, and processing card data because in case of misuse the provider may be liable for the damage, pay penalties imposed by the card schemes and suffer reputational harm. The current version of the standard is PCI DSS 4.0.1. What it requires of you depends on how the payment form is integrated (redirect to the provider or an embedded form). With an embedded form you must be able to show that the page is not vulnerable to script-based attacks. Confirm with your payment provider.

This standard represents a unified approach to protecting sensitive card data and preventing card abuse in the payment card industry. Implementing the standard provides a higher level of security, maintains trust, protects against misuse, and safeguards against financial losses and damage to reputation. It is designed for organizations that handle cardholder data, either directly or indirectly.

The standard's requirements include establishing and maintaining a secure network, protecting cardholder data, implementing a vulnerability management program, implementing access control measures, regular monitoring, network testing, and maintaining a security policy.

Achieving compliance can be a significant financial burden, so many smaller merchants choose to process cards through a payment provider, avoiding the need to handle credit card data and the need for PCI-compliant pages.

Installment Payments and "Buy Now, Pay Later" (BNPL)

The customer pays for the order in installments or with a delay, while the payment provider pays you the full amount immediately and takes on the risk of non-payment. The advantage is a higher average basket value and fewer abandoned purchases for more expensive products. But be careful: the new EU Consumer Credit Directive (Directive (EU) 2023/2225), which applies from 20 November 2026, classifies such payments as consumer credit, including for small amounts. The only exemption is a deferral of payment that you grant the customer yourself, without a third party, interest or other charges, for a maximum of 50 days (for online sellers that are not micro, small or medium-sized enterprises, a maximum of 14 days). Payment through a BNPL provider is therefore credit granted by the provider, not by you: creditworthiness checks, information and warnings to the customer are its duty. So choose a provider that really takes this on, and check its terms, fees and refund rules before integrating. If you offer a deferral or your own installment scheme without a provider, consult a lawyer. Check the rules in your country too. More: Online store legislation in the EU.

Wallets and Bank Transfer Payments

Apple Pay and Google Pay store the card in the phone, and the customer confirms the payment with a fingerprint or face. They do not enter numbers, the payment is fast, and so conversion is often higher. Offer them in the cart and on the product page too. PayPal remains widespread among customers who do not want to disclose their card details.

Payment by direct bank transfer ("pay by bank"), where the customer confirms the payment in their own bank, is also increasingly popular. Costs for the seller are often lower than with cards, and this channel will become even more useful in the euro area, because banks must offer instant euro transfers with payee verification from 2025. The European wallet Wero is already available for online payments in some countries (for example Germany, Belgium and France; in Luxembourg from September 2026); availability varies by country, so check what is offered in your market. In the Netherlands, iDEAL is gradually moving to it.

If you sell to other countries, offer the payment methods local customers know: for example iDEAL in the Netherlands, Blik in Poland, TWINT in Switzerland (examples, not a complete list). Cryptocurrencies are not important in an ordinary online store; if you offer them, use a provider that converts them to euros immediately.

AuthorAnže Voh

My name is Anže, I am a certified Magento solution expert and the maker of several award-winning online stores. I am the architect of all Degriz projects.

Write to me →