A card payment gateway lets customers pay your online business with a debit or credit card. It securely passes the card details to the banks involved, asks the customer's bank to approve the payment, and tells your server whether it succeeded.
This guide explains how card payments online in Pakistan work, what merchants should know about security, refunds and chargebacks, and how to choose a gateway. It also shows how ZurvaPay helps you manage payments, notifications and onboarding.
- What is a card payment gateway?
- How a card payment works
- Debit cards, credit cards and card networks
- Security: 3-D Secure and hosted checkout
- Refunds and chargebacks
- How to choose a card payment gateway
- Reducing fraud
- How ZurvaPay fits in
- Frequently asked questions
What is a card payment gateway?
A payment gateway is the service between your website and the card payment system. Card details are entered on a secure page, sent through the gateway to the bank that processes the payment for you, and approved or declined by the customer's own bank. The gateway then reports the result to you.
How a card payment works
- Checkout. The customer chooses to pay by card on the payment page.
- Authorization. The card details are sent to the customer's bank (the issuer), which checks the card and the available funds and approves or declines.
- Authentication. For many online payments the bank asks the customer to confirm, for example with a one-time code. This step is often called 3-D Secure.
- Result. The gateway receives the outcome and notifies your server.
- Settlement. The money is later settled to the merchant through the banks involved.
Debit cards, credit cards and card networks
- Debit cards take money straight from the customer's bank account.
- Credit cards use a credit line from the issuing bank.
- Card networks such as Visa and Mastercard connect banks internationally, and PayPak is Pakistan's domestic card scheme.
Offering cards matters most for customers who do not use mobile wallets, for international customers, and for higher-value purchases.
Security: 3-D Secure and hosted checkout
Card payments carry strict security requirements. Two ideas keep your risk low:
- Authentication. A step such as a one-time code shows that the person paying controls the card.
- A hosted checkout. When customers enter payment details on the gateway's page instead of yours, those details never pass through your own server. The card industry's security standard, PCI DSS, applies to anyone who stores, processes or transmits card data, so keeping card entry off your website reduces what you need to manage.
ZurvaPay's checkout follows the hosted model: customers pay on the ZurvaPay page, and your server only receives a signed result.
Refunds and chargebacks
- Refunds return money to the customer at your request, for example for a cancelled order.
- Chargebacks are disputes raised by the customer through their bank, often because they do not recognise a charge or did not receive what they paid for.
To reduce disputes, use a clear billing description, keep proof of delivery, publish your refund policy, and answer customer messages quickly.
How to choose a card payment gateway
- Transparent pricing. Ask what you pay per transaction and whether there are setup or monthly fees. Charges differ between providers and merchants.
- Reliable confirmation. You need a signed server notification, retries and a status check.
- A hosted, mobile-friendly checkout. Most customers pay on a phone.
- Clear onboarding. Look for online registration and a defined KYC process.
- Reporting. A dashboard with transactions and pending payments saves time.
- Support. Fast, reachable support matters when a payment is in doubt.
Reducing fraud
- Verify every notification's signature before you mark an order paid.
- Never trust the success page alone.
- Watch for unusual order patterns such as many small attempts or mismatched details.
- Keep secret keys on your server and rotate them if they leak.
- Restrict API use to your approved domain.
How ZurvaPay fits in
ZurvaPay gives merchants the building blocks that any good payment gateway needs:
- Self-service onboarding. Register online, complete KYC and receive API keys after approval.
- A hosted checkout and one API. A single request starts a payment, and the customer chooses how to pay.
- Signed IPN with up to 8 delivery attempts and a Payment Status API for pending orders.
- Domain-locked API keys and a secret key that stays on your server.
- Dashboard, invoices and withdrawals to your registered bank account.
- Sub-merchants and an agent program for agencies and referrers.
Alongside card-minded customers, many shoppers pay with JazzCash, Easypaisa or Raast QR, all through the same integration. Developers can start with the API documentation.
Frequently asked questions
How do online card payments work?
The customer enters their card details on a secure payment page. The gateway asks the customer's bank to approve the payment, often with an extra confirmation step, and reports the result to your server.
What is 3-D Secure?
It is an extra authentication step in which the customer's bank confirms the cardholder, commonly with a one-time code.
What is PCI DSS?
It is the payment card industry's security standard for organisations that store, process or transmit card data. A hosted checkout keeps card entry off your own server.
What is the difference between a refund and a chargeback?
A refund is something you initiate to return money. A chargeback is a dispute the customer raises through their bank.
How do I get started?
Open a merchant account, complete KYC and connect your website with the API. If you want to discuss card payments for your business, contact the ZurvaPay team.
Talk to ZurvaPay about card payments for your business
Tell us what your customers need and we will help you plan the right setup. Contact the team or open a merchant account.
Related guides
- Bank payment gateway guide
- JazzCash payment gateway guide
- Easypaisa payment gateway guide
- Raast QR payment gateway guide
Brand, bank and card network names are used only to describe payment methods and belong to their respective owners. ZurvaPay is an independent payment gateway and is not affiliated with or endorsed by them.
Start accepting payments with ZurvaPay
Open a merchant account, connect your website with one API and get notified the moment a customer pays.