How to Accept Card Payments Online in Nigeria

Card acceptance is the part of a Nigerian checkout that people assume is hardest and that is actually the most standardised. The gateway handles the card networks, authentication and security; your job is verification, correct integration and handling what happens when a card fails.

That last part is where stores lose money. Cards decline far more often than owners expect, for reasons that have nothing to do with your website. This guide covers the setup, then the operational detail that separates a checkout that converts from one that quietly leaks orders.

What happens when a customer pays by card

Understanding the flow makes every later decision obvious.

1. The customer enters card details in the gateway's checkout, not on your server.
2. The gateway sends the request through the card scheme (Verve, Mastercard or Visa) to the customer's issuing bank.
3. The bank applies authentication, usually 3D Secure, which may mean an OTP, a PIN or an in-app approval.
4. The bank approves or declines, based on funds, limits and its own risk checks.
5. The gateway returns the result and sends a webhook to your store.
6. Your store marks the order paid only after verifying that webhook server-side.
7. The gateway settles the funds, net of fees, to your business bank account on its published cycle.

Two points matter commercially. First, the approve-or-decline decision belongs to the customer's bank, not to you or your gateway. Second, the money does not arrive instantly; there is a settlement cycle between the sale and usable cash.

What you need before you start

• [CAC](https://www.cac.gov.ng/) registration. A registered business name or limited company. Gateways require this for full settlement limits, and it is what makes a corporate bank account possible. Verify current requirements at https://www.cac.gov.ng/.
• A corporate bank account in the business name, at a Nigerian bank the gateway settles to.
• Directors' identification and BVN details for verification.
• A live website or app showing real products, prices in naira, contact details, a delivery policy and a refund policy. Compliance teams check these.
• A privacy notice covering how you handle customer and payment data, in line with the Nigeria Data Protection Act 2023.
• HTTPS across your entire site, not just the checkout page.
• A developer or a platform plugin to complete the integration and verify webhooks.

If you are not yet registered, some providers allow a starter or individual account with lower limits. Treat that as a temporary stage rather than a destination.

Choosing a payment gateway

All the main Nigerian gateways will accept cards. Judge them on the things that differ.

Test rather than assume: open accounts with two providers, run a live low-value transaction through each on a real phone, and compare the experience your customer would actually have. For a deeper look at two of the common choices, see the Paystack and Flutterwave comparison.

How to set up card payments, step by step

1. Register the business and open a corporate account. Do this first; everything else depends on it.
2. Publish your policies. Delivery terms, refund and returns policy, contact details and privacy notice must be live on the site before you apply.
3. Create the gateway account and complete business verification, uploading CAC documents, identification and bank details.
4. Work in test mode first. Use the provider's test keys and test cards to run successful payments, declines and refunds.
5. Install the official plugin for your platform, or integrate the API if you have a custom build.
6. Configure webhooks. Point the gateway at your endpoint, verify signatures server-side, and handle retries idempotently so a repeated webhook never double-processes an order.
7. Set the order state machine. An order becomes "paid" only on verified server-side confirmation, never on a browser redirect alone.
8. Enable bank transfer and USSD alongside cards in the same checkout. This single change usually matters more for Nigerian conversion than anything else on this list.
9. Switch to live keys and run three real transactions with your own cards: one success, one deliberate failure, one refund.
10. Test on a mid-range Android phone over mobile data, including the 3D Secure step and what happens if the network drops mid-payment.
11. Document the process for staff: how to check a payment, how to issue a refund, what to tell a customer whose money has been debited but whose order did not complete.
12. Monitor from day one: payment success rate by method, decline reasons, and time from payment to order confirmation.

Integration options and what each suits

Hosted checkout page. The customer is redirected to the gateway's page, pays, and returns. Simplest, safest, lowest compliance burden. Suits most small and medium stores.

Inline modal or embedded checkout. The payment form opens over your page without a full redirect. Better perceived experience, still keeps card data off your server. Suits stores that want a smoother flow.

Mobile SDK. For apps, using the provider's official SDK. Handle the case where payment completes while the app is backgrounded, which happens regularly on Nigerian networks.

Direct API with your own form. Requires you to handle card data, which brings substantial PCI DSS obligations. Not appropriate for ordinary retailers; only consider it with specialist advice and a strong reason.

Payment links and storefront pages. No website needed. Useful for testing demand, for social sellers, and as a fallback when your site has a problem.

For almost every Nigerian SME, the honest recommendation is hosted checkout or an inline modal with an official plugin, plus payment links as a backup.

3D Secure, PCI DSS and keeping card data off your server

3D Secure is the authentication step that sends an OTP or asks for an in-app approval before a card transaction completes. It reduces fraud and shifts liability for certain disputed transactions, and it is standard on Nigerian card payments. It also adds a step where customers drop off, particularly if the OTP is slow to arrive on a congested network. You cannot remove it, but you can reduce its damage: tell the customer an OTP is coming, keep the page alive while they wait, allow a retry without re-entering everything, and offer transfer as an alternative if the attempt fails.

PCI DSS is the card industry's security standard. If card details never touch your systems, because you use hosted checkout, an inline modal or an approved SDK, your obligations are minimal and largely satisfied by a self-assessment questionnaire that your gateway will guide you through. The moment you build your own card form and transmit card numbers through your server, your obligations increase dramatically. That is the single strongest argument for using the gateway's own flow.

Your remaining security responsibilities are real and non-negotiable:

• HTTPS across the entire site, with a valid certificate.
• Strong, unique admin credentials with two-factor authentication.
• Least-privilege staff accounts and prompt removal of leavers.
• Prompt platform, plugin and library updates.
• Webhook signature verification and server-side confirmation.
• No card numbers in emails, WhatsApp messages, support tickets or spreadsheets, ever.
• Access controls and retention limits on customer and transaction data, consistent with the Nigeria Data Protection Act 2023.

Why cards fail in Nigeria and what to do about it

Card declines are a normal, high-volume event. Common causes:

• Insufficient funds.
• Transaction limits, including daily limits and, for naira cards, limits on international transactions.
• Failed or expired OTP, often because the SMS was slow on a congested network.
• Issuer risk checks flagging an unusual transaction.
• Bank or network timeouts, especially at peak hours.
• Expired or incorrectly entered card details.
• Cards not enabled for online transactions by the customer's bank.

What to do about each, practically:

The highest-return action for most Nigerian stores is not optimising cards at all: it is making bank transfer equally prominent so that a card failure becomes a completed order rather than an abandoned cart.

Settlement, fees and reconciliation

Settlement. Gateways settle in batches on a published cycle, commonly next business day for local transactions, with international transactions taking longer. Timing can vary by account type and risk profile, and banking holidays affect it. Confirm your cycle in writing, particularly if you restock from sales proceeds.

Fees. Nigerian gateways typically charge a percentage of the transaction, often with a flat naira component and a cap on local card transactions, and a higher rate for international cards. Refunds, disputes and payouts may carry their own charges. Rates change, so take the current figures from each provider's own pricing page and model them against your actual transaction mix rather than relying on quoted numbers.

Reconciliation. Build the routine early:

• Store the gateway transaction reference on every order.
• Export settlement reports and match batches to orders monthly.
• Track refunds and reversals in the same report.
• Investigate any order marked paid with no matching gateway record, and any gateway payment with no matching order.
• Give whoever keeps your books access to the dashboard in a read-only role.

Unreconciled card payments become an accounting problem that compounds quietly for months.

Chargebacks, fraud and refunds

Chargebacks happen when a cardholder disputes a transaction through their bank, usually claiming non-delivery, an item not as described, or an unauthorised transaction. Your gateway opens a dispute with a window to submit evidence.

Win them with operational discipline, not argument:

• Keep delivery confirmation with date, recipient name and address.
• Keep the address and phone number captured at checkout.
• Keep customer communication in one place, including WhatsApp order threads.
• Publish clear delivery timelines and a refund policy, and follow them.
• Describe products accurately, with real photographs.

Fraud. Use your gateway's built-in risk checks. Add your own rules for high-risk patterns: unusually large first orders, mismatched delivery details, or multiple failed attempts followed by a success. For pay-on-delivery orders, confirm phone numbers before dispatch and record refusals so you can tighten rules by area.

Refunds. Process them through the gateway so the money returns to the original card and the record stays clean. Tell the customer the expected timeline, which depends on their bank. Never refund a card payment by bank transfer to an account the customer supplies; that pattern is a common fraud route and it breaks your reconciliation.

International cards and diaspora customers

If you sell to Nigerians abroad or to international buyers, check three things with your provider: whether international cards are enabled on your account, which currencies you can collect in, and how and when those funds settle. International card rates are typically higher than local rates, and currency conversion may apply.

Practical measures for diaspora sales:

• Display prices clearly and state the currency.
• Publish international shipping costs and realistic timelines before checkout.
• Expect a higher fraud and dispute rate on international transactions; keep delivery evidence carefully.
• Consider requiring verified addresses or additional confirmation for high-value international orders.

Note also the reverse constraint: many Nigerian-issued naira cards have limits on international transactions, which is why a Nigerian customer may fail on a foreign-currency checkout while succeeding on a naira one. If your buyers are local, collect in naira through a Nigerian gateway.

Example (hypothetical): a Lagos electronics store

Example (hypothetical): an electronics retailer in Ikeja sells phones and accessories online, average order value around ₦180,000, about 300 orders a month. High basket values mean card limits bite, and fraud risk is above average for the category.

Their setup:

1. Gateway hosted checkout offering card, bank transfer and USSD, with transfer given equal visual weight because large amounts often exceed card limits.
2. Webhook-verified order confirmation; no order is released from the warehouse on a browser redirect alone.
3. For orders above ₦250,000, an automatic step asking the customer to confirm by phone before dispatch, reducing chargeback exposure on high-value items.
4. No pay on delivery for high-value electronics; a pickup option at the shop instead.
5. Delivery evidence captured as a photograph and recipient name at handover, stored against the order for dispute defence.
6. Weekly reconciliation of settlement batches to orders, with a read-only dashboard role for their accountant.
7. A monitored dashboard of payment success rate by method, reviewed monthly.

Indicative costs: integration within a standard e-commerce build, gateway fees as a percentage plus flat component per transaction on their actual mix, and staff time for reconciliation. Their measures: payment success rate by method, share of orders completing on transfer versus card, chargeback rate, and time from payment to dispatch.

Mistakes to avoid

• Card-only checkout. Nigerian buyers use transfer and USSD heavily; omitting them costs orders every day.
• Building your own card form. It creates serious PCI obligations for no commercial benefit.
• Trusting the browser redirect. Confirm payment server-side from a verified webhook.
• Accepting screenshots as proof. They are trivially faked; the gateway is the source of truth.
• Generic error messages. "Payment failed" with no next step is an abandoned order.
• No reconciliation routine. Unmatched settlements become a compounding accounting problem.
• Refunding to a different account. A common fraud route and a reconciliation nightmare.
• No delivery evidence. You will lose disputes you should have won.
• Ignoring mobile testing. The OTP step behaves differently on a phone with weak data.
• Storing card details anywhere. Never in email, WhatsApp, notes or spreadsheets.

Conclusion

Accepting card payments online in Nigeria is a solved problem: register the business, verify with a licensed gateway, integrate the hosted checkout or SDK so card data never touches your systems, confirm payments server-side through webhooks, and test live before you rely on it. The value is in the operational detail around it. Keep bank transfer and USSD equally visible so failures convert, write decline messages that give the customer a next step, reconcile settlements to orders every month, and keep the delivery evidence that wins disputes.

If you want card, transfer and USSD payments integrated properly into your store, app or custom system, with verified webhooks and clean reconciliation, Linestech builds and integrates payment flows for Nigerian businesses. Tell us your platform and average order value and we can recommend the right setup.

Frequently asked questions

Do I need a registered business to accept card payments online in Nigeria?

For full settlement limits, generally yes. Gateways verify merchants and usually require CAC registration, a corporate bank account and directors' identification. Some providers offer starter or individual accounts with lower limits that let you begin trading, but registration is the practical requirement for a serious store. Confirm current rules with your provider.

How long does it take to go live with card payments?

If your business documents and corporate account are ready, verification often takes a few working days, and integration through an official plugin can be done in a day. Allow one to three weeks overall for a first-time setup, including publishing policies, testing and live transaction checks.

Can I accept card payments without a website?

Yes. Payment links, invoices and gateway storefront pages let you take card payments through WhatsApp, Instagram or email without a website. They are a good way to start or to keep trading if your site has a problem, but they lack a catalogue, search and the search-engine visibility a store provides.

Why do so many cards fail at my checkout?

Most declines originate at the customer's bank: insufficient funds, daily or international transaction limits, failed or delayed OTPs, or issuer risk checks. Network timeouts at peak hours add more. Show specific messages, allow an easy retry, and keep bank transfer visible as an alternative so a failed card does not become an abandoned order.

Is it safe to accept card payments on my own website?

Yes, when you use the gateway's hosted checkout, inline modal or approved SDK so card data never reaches your server. Your responsibilities are HTTPS everywhere, secure admin accounts with two-factor authentication, prompt updates, server-side webhook verification and never storing card details in any system of your own.

When does the money actually reach my bank account?

On the gateway's settlement cycle, commonly next business day for local card transactions, with international payments taking longer. Timing varies by provider, account type and banking days. Confirm your specific cycle in writing with the provider, especially if your purchasing depends on sales proceeds.

What is a chargeback and how do I protect my store?

A chargeback is a cardholder disputing a transaction through their bank. You protect yourself operationally: keep delivery confirmation with date and recipient, retain the checkout address and phone number, keep communication records, describe products accurately with real photos, and publish and honour a clear refund policy.

Should I also accept bank transfer and USSD?

Yes. In Nigeria those methods carry a large share of online payments, and the same gateway checkout can offer all three with automatic confirmation. Adding them typically does more for completed orders than any card optimisation, because a customer whose card fails can pay immediately by another route.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Corporate Affairs Commission (CAC)
• Nigeria Data Protection Act 2023 — NDPC
• Paystack developer documentation
• Flutterwave developer documentation
• MDN Web Docs — web platform reference
• Node.js documentation
• Baymard Institute e-commerce UX research