How to accept debit and credit card payments in Pakistan

Card payments tend to be the last method a Pakistani seller sets up. Cash on Delivery works, EasyPaisa covers the wallet users, and taking cards sounds like a lot of paperwork for a small share of buyers.

The share really is small. Cards are still worth adding, for reasons that have more to do with who pays by card than with how many do. This guide covers who those buyers are, the realistic ways a business in Pakistan can accept cards, what a merchant account application generally involves, why the card number must never touch your website, the settlement mistake that ships unpaid orders, and how refunds and chargebacks work.

Who pays by card, and why they matter

Card buyers are a minority of online shoppers in Pakistan. The share is growing, but most orders are still Cash on Delivery, and you should plan around that rather than hope it changes. What makes the minority worth serving:

• Every card order is prepaid. The buyer has committed before the parcel leaves, so it doesn't carry the refusal risk a COD order does.
• Overseas buyers. A Pakistani in Dubai or Manchester sending an Eid gift home can't hand a rider cash in Lahore; a card is the obvious way for them to pay.
• Big orders. Someone buying an expensive item may not want to keep that much cash at home waiting for a rider.
• Card-first buyers. Some people simply prefer to pay by card. Without the option they either pick COD, bringing the refusal risk with them, or leave.

None of this is a reason to drop COD. It is a reason to give the buyers who want to pay upfront a way to do it. What an average refusal costs you, and so what each prepaid order saves, is worked out in how to price products.

Your realistic options

A local payment gateway. For most small stores this is the route. A Pakistani gateway such as PayFast gives you a merchant account and a hosted payment page where the buyer enters their card, and pays your takings out to you. You apply once and connect it to your store.

Your bank's own gateway. Some Pakistani banks offer online card acceptance to their business customers. If you already bank with one, ask its merchant services desk what it offers, and compare it with a gateway on fees, settlement time and whether your store platform supports it at all.

International processors. Stripe is the one sellers ask about most. As of writing it does not accept businesses based in Pakistan; check current availability on Stripe's own site before planning around it. If you have been weighing up Shopify, its built-in card processor has the same gap, which is covered in our Shopify comparison.

The workaround to avoid. Running your store's payments through a relative's account abroad almost certainly breaks the processor's terms. When the account is reviewed, the money in it can be held, and there is nobody on your side to appeal to.

What a merchant account application usually wants

A gateway that accepts cards for you takes on risk: if buyers dispute payments and a merchant can't cover them, the gateway and its bank are left holding the loss. So the application is a check that you are a real business, not a signup form.

Expect it to want evidence that you are a real business, identification for the owner, a bank account for the money to settle into, and an address and phone number that can be verified. The exact list changes and varies by account type, so get it from the gateway itself rather than from any article, this one included.

Three things make an application go more smoothly:

• Make the names agree. The business name on the form, the title of the bank account and the name on your website should match, or expect questions.
• Have the website ready first. It is common for a gateway to look at your store before approving it, so publish real products with prices, contact details, delivery information and a clear refund policy.
• Read the agreement for three numbers. The fee per transaction, how long settlement takes to reach your bank, and what you are charged when a buyer disputes a payment.

Whether you need to register a company first depends on the gateway and on how your business is set up; the registration section of how to sell online in Pakistan covers where to get that answer.

Why the card number should never touch your site

A hosted checkout works like this. The buyer chooses card at your checkout, is taken to the gateway's own payment page, enters their card details there, completes their bank's security check, often a one-time code sent to their phone, and is returned to your store.

The point is that the card number goes to the gateway and never to you. Anyone who stores, processes or transmits card numbers has to protect them to the card industry's security standard, PCI DSS, which is serious work for a small business. A hosted page keeps card data off your systems entirely, and you cannot leak what you never had.

The same logic gives you two rules for every channel you sell on:

• Never take card numbers over WhatsApp, a phone call or a form you built. Not for a regular customer, not once.
• Never ask a buyer for a one-time code. A genuine payment never needs them to share it with you, and saying so on your store makes life harder for anyone impersonating you to scam your customers.

When a buyer's card is declined on the gateway's page, the fix is sometimes on their side: some banks want online payments switched on for a card before it works on websites, and the bank's own app is often where that setting lives. Telling them so saves a sale that would otherwise quietly become COD.

On Storecrafto, card payments go through your own PayFast account on exactly this hosted-redirect pattern, so card details never touch your store.

The mistake that ships unpaid orders

When the buyer finishes on the gateway's page, their browser is sent back to your store, usually with something in the address that looks like a success code. Do not mark the order paid because of it.

• It can be forged. The redirect travels through the buyer's browser, so anyone can type a success-looking address and land on your thank-you page.
• A good-looking code is not settled money. Response codes often describe whether a request was accepted, not whether the funds cleared.
• It can go missing. A buyer who pays and then closes the tab or loses signal never makes it back, so a store that waits for the redirect also misses payments that really happened.

The correct pattern is the same for every gateway, and it is laid out step by step in our EasyPaisa guide: treat the return as a prompt to check, ask the gateway for the payment's status from your own server, ship only on a confirmed paid status, and make sure a payment reported twice still creates only one order.

Before you go live, test it with a real low-value payment end to end, then start a second payment and cancel it on the gateway's page. The first should become a paid order and the second should not.

On Storecrafto this is already handled. The store confirms each card and EasyPaisa payment with the gateway, server to server, before the order is treated as paid, and a browser redirect on its own is never trusted.

Settlement, refunds and chargebacks

Settlement. The gateway pays out your card takings on its own schedule. Ask what that schedule is before you sign, because it decides your cash flow. On Storecrafto the money settles directly with you: we take 0% of it and charge only a flat subscription.

Overseas buyers. If you want them, ask the gateway directly whether it accepts cards issued outside Pakistan. If your store is priced in dirhams, dollars or pounds, PayFast still charges in rupees, converted at your store's rate, and checkout shows the buyer the rupee amount before they pay; see selling in another currency.

Refunds. A card refund goes back to the card, through your gateway's dashboard. How long it takes to reach the buyer depends on the gateway and the buyer's bank, so say that plainly rather than promising a date you don't control. On Storecrafto you record the refund on the order with the amount and a reason, and the buyer is notified; the money itself moves through your own gateway, because we never hold your funds. Refund in the gateway first, then record it, so the buyer is never told about money that hasn't moved; see refunds and cancellations.

Chargebacks. A chargeback is when a buyer disputes a card payment with their own bank instead of coming to you. The bank pulls the money back, the gateway asks you for evidence by a deadline, and there may be a fee whichever way it goes; your agreement will say. The usual triggers:

• The buyer doesn't recognise the charge. Ask your gateway what name appears on the buyer's statement, and make sure your buyers will recognise it.
• The buyer says it never arrived. Tracked delivery with proof of delivery is your answer.
• The buyer says it isn't what was described. Honest photos and a clear listing are your answer.
• The card was stolen. Be wary of a first order that is unusually large, rushed, and going to an address that doesn't fit the name; a phone call before dispatch costs little.

When a buyer has a fair point, refund them yourself before it becomes a dispute. A refund you choose costs less than a dispute you lose, and a high dispute rate can put the merchant account itself at risk.

How cards fit with COD, EasyPaisa and bank transfer

No single method covers Pakistani buyers. Each one catches people the others miss:

Offer the set rather than one method, and let buyers choose. A Storecrafto store can offer all four, connected to your own accounts, and whichever you switch on are the ones buyers see at checkout; see how payments work and getting paid. Bank transfer has its own traps, covered in taking bank transfer payments.

The short version

• Card buyers are a minority in Pakistan, but every card order is prepaid, and cards reach overseas buyers COD can't.
• A local gateway such as PayFast is the practical route; Stripe doesn't accept Pakistani businesses as of writing, so check before planning around it.
• Get application requirements and fees from the gateway itself, and publish your policies before you apply.
• Use a hosted payment page, and never take card numbers or one-time codes over WhatsApp or the phone.
• Never mark an order paid from the browser redirect; confirm with the gateway from your server.
• Refund in the gateway first, then record it; answer chargebacks with tracking, honest listings and a published policy.
• Offer cards alongside COD, EasyPaisa and bank transfer, not instead of them.