Collecting deposits and progress payments on a services website
Adding a payment button is the easy part. The decisions that matter come afterwards: a percentage fee on a five-figure milestone is real money, a surcharge program that is fine in one state is restricted in another, and a deposit chargeback on custom work is usually decided by whatever documentation you kept at checkout. This is how we think about payments for U.S. services businesses — which rail to use for which payment, what the site has to record, and when a payment page is not worth building.
Match the rail to the payment, not the other way round
Cards are excellent for small, fast, low-friction payments: booking deposits, retainers, consultation fees. Familiar, instant, and the fee is a rounding error on a small ticket. On a large milestone payment, the same percentage stops being a rounding error, which is why bank debit — ACH through your payment provider, or a straightforward bank transfer for larger commercial clients — is usually the right rail once the numbers get serious. Card fees are percentage-based; ACH is typically flat or capped, which inverts the economics as the amount grows.
ACH is not simply the safer option, though. Settlement is slower, and under Nacha rules consumer accounts have an extended window to return a debit as unauthorized — considerably longer than most people expect. It does not fail less often than cards; it fails differently and later. For recurring retainers, a stored card with proper authorization for merchant-initiated transactions usually beats chasing an invoice every month, and for the final payment collected on site, a mobile reader avoids the whole question.
Surcharging and convenience fees: the part that changes at the state line
Passing card costs to the customer is permitted by the card networks in the U.S. under conditions: advance notification to your acquirer and the networks, disclosure at the point of entry and again on the receipt, a cap tied to your actual cost of acceptance and to a network-set maximum, and no surcharging of debit or prepaid cards at all. On top of that sits state law. Connecticut, Massachusetts and Maine still have statutory prohibitions on the books, several other state bans have been challenged in court, and the picture changes.
For most U.S. services businesses, the practical conclusion is unglamorous. If you operate across state lines, running a compliant surcharge program is administrative work with legal edges, and the cleaner answers are to price acceptance costs into the job or to route large payments to ACH where the fee is small enough not to matter. If you do want to surcharge, confirm the current position with your acquirer and with counsel for every state you bill into — and note that a cash discount is a different construct from a surcharge, with different rules.
What the checkout has to record so you keep the money
Disputes on custom work concentrate in one category: services not rendered as described. The merchant tends to lose when there is no dated evidence of what was agreed and what was delivered. Everything below is cheap to capture at payment time and impossible to reconstruct afterwards.
The statement descriptor deserves a specific mention because it causes disputes that have nothing to do with the work. If your legal entity name appears on the card statement and your customer only knows your trade name, some percentage of them will not recognize the charge and will call their bank instead of you.
- The exact estimate or scope document the customer approved, with a version and a timestamp
- A written cancellation, refund and deposit policy the customer had to accept explicitly, with the accepted version stored
- A statement descriptor that matches the name the customer recognizes
- Completion evidence: dated photos, signed sign-off, delivery notes — the material you would submit to represent a dispute
- An itemized receipt emailed automatically, not on request
- A refund path that is easier for the customer than calling their bank
Keep card data out of your business
Use hosted fields or a hosted checkout — Stripe Checkout or Elements, Square, or your provider's equivalent — so card data never touches your server. That keeps you in the lightest PCI self-assessment tier, and the lighter tier is worth more than the design flexibility you give up. Taking card numbers by phone and writing them into a CRM note, an email or a text is the fastest way to turn a small business into a data breach.
Two details people miss. PCI DSS version 4 adds explicit requirements around managing and monitoring scripts on payment pages, so loading a chat widget, heatmap and three tag manager containers onto your checkout is no longer just a performance issue. And storing a card for later charges requires proper cardholder authorization and correct handling of the stored credential, not simply an internal note that they said it was fine.
When we would tell you not to build a payment page
If you invoice a handful of clients a month, hosted invoice links from your accounting software already do this, and building a custom payment page saves you nothing. If your bookings are small and frequent, payment belongs inside the scheduling flow rather than on a separate page. If every job is bespoke, a simple pay-your-invoice page that takes a reference number will outperform anything shaped like a shopping cart, because there is no catalog to browse.
The build is justified when payment is a step in a flow you actually run — a deposit that releases a scheduling slot, a milestone tied to project stages, a client area with balances — and when payments need to reconcile automatically against your accounting rather than being typed in twice. That is the point at which a payment page stops being a button and starts being an operations improvement, and it is the only version we would quote enthusiastically.
Frequently asked questions
Can I pass credit card fees on to my customers?
Sometimes, and conditionally. Card network rules require advance notice, specific disclosure and a cap, debit and prepaid cards cannot be surcharged, and some states restrict the practice while others have seen bans challenged. Confirm the current position for every state you bill into before switching it on.
Is ACH safer than cards for large payments?
It is usually cheaper, which is a different thing. Consumer ACH debits can be returned as unauthorized well after the fact under Nacha rules, and settlement is slower. Treat it as a lower-cost rail with a different risk profile, not a guarantee.
If Stripe handles the card, do I still have PCI obligations?
Yes, at reduced scope. Using hosted fields or a hosted checkout keeps you in the lightest self-assessment tier, but the self-assessment still exists, and PCI DSS v4 adds requirements about scripts running on payment pages.
Can I keep a card on file for the final balance?
With the right authorization, yes. Stored credentials require the customer's agreement to future charges, correct flagging of merchant-initiated transactions, and a clear record of what they authorized. An informal verbal go-ahead is not a defense in a dispute.
How do I stop customers disputing their deposit?
Documentation, mostly. An approved scope with a timestamp, an explicitly accepted cancellation policy, a recognizable statement descriptor, dated evidence of work performed, and a refund route that is less effort than a chargeback. That combination resolves most disputes before they start.
Tell us what a typical job looks like — deposit size, milestone amounts, how you invoice today and what your accounting runs on — and we will map which rail fits each payment, what the site needs to record, and whether a payment page is worth building at all in your case.