What is the Cybersource payment gateway?

Cybersource is a payment gateway plus a set of fraud, tokenization and checkout tools for larger and international businesses. It was founded in 1994, bought Authorize.Net in 2007, and was acquired by Visa in 2010. Today it's part of what Visa calls the Visa Acceptance Solutions family of brands. Like any gateway, it doesn't approve your business or hold your money. That's the merchant account's job.

	Cybersource payment gateway	Merchant account
What it does	Sends payments from your site, app or terminal; screens fraud, stores cards as tokens	Accepts the card sale and deposits the money to your bank account
Who approves you	Not the gateway	The acquiring bank, through underwriting
Who you contract with	Cybersource (Visa)	An acquirer or a provider such as START
Who handles chargebacks	Reports them	Processes them and debits or credits your account

Do you need a merchant account for Cybersource?

Yes. Cybersource connects to what it calls "200+ acquirers and processors," and one of them has to accept your transactions. The confusing part is the wording. In Cybersource's own documents, a "merchant account" usually means your Business Center organization, which is your gateway account. You still need an acquiring merchant account behind it.

There are three common ways to get one:

→Through Cybersource's sales team, usually for larger and multi-country businesses.
→Through a Cybersource reseller partner, who sells the gateway and often the processing too.
→From an acquirer or provider whose processor Cybersource supports, while you contract for the gateway with Cybersource. That's how START fits: our merchant accounts run through Elavon, and Cybersource's developer documentation includes a payments guide for Elavon Americas.

Who Cybersource fits, and who it doesn't

Businesses selling in many countries and currencies
High-volume sellers with their own fraud team
Enterprises on large commerce platforms
Brands that want online and in-person payments on one token vault

It's usually not the right tool for a small business. Cybersource says so itself: its small-business page calls Authorize.net "our small business platform." If you sell in the U.S. or Canada through one website or cart, the Authorize.Net payment gateway publishes its prices and connects to most carts out of the box.

What the Cybersource platform includes

In Cybersource's own words, checked September 27, 2026:

→Payment gateway: "over 50 currencies" and "200+ acquirers and processors in over 160 countries and territories." Which of those you can use depends on the acquirers you contract with.
→Decision Manager: machine-learning fraud screening with rules you can tune, plus optional Managed Risk Services analysts. Fraud Management Essentials is its simpler tool for small and midsize businesses.
→Payer Authentication: 3-D Secure for Visa Secure, Mastercard Identity Check, Amex SafeKey and JCB J/Secure.
→Token Management Service and Account Updater: stored cards and network tokens, with monthly card updates that Cybersource says cover Visa, Mastercard and American Express.
→Checkout: Unified Checkout (cards, Click to Pay, Apple Pay, Google Pay, PayPal, Venmo, eCheck and more), Microform hosted card fields and mobile SDKs.
→Recurring Billing, Virtual Terminal and in-person: subscriptions, keyed payments in a browser, and PAX terminals or Tap to Pay managed from Business Center.

The Cybersource Business Center dashboard

Business Center is where the daily work happens: searching transactions, keying payments in the Virtual Terminal, voids and refunds, reports, reviewing orders that Decision Manager flagged, and managing users and permissions. Your login belongs to an Organization ID, which Cybersource says was formerly called a Cybersource Merchant ID. Larger setups also have account-level IDs ending in _acct that group several organizations.

Two practical tips from Cybersource's September 2026 release notes: transaction search accepts up to 15 identifiers per request, and it recommends date ranges of seven days or less. Your merchant account statement still comes from your acquirer, not from Business Center.

Comparing Visa's two gateways

Cybersource or Authorize.Net?

Both belong to Visa, and both need a merchant account behind them. Authorize.Net is built for U.S. and Canadian businesses that want published prices and standard shopping carts. Cybersource is built for multi-country acquiring, enterprise fraud operations and large commerce platforms, and is sold by quote.

→Pricing: Authorize.Net publishes its plans; Cybersource publishes none.
→Reach: Authorize.Net needs a U.S. or Canadian merchant account; Cybersource connects to acquirers in over 160 countries and territories.
→Switching: saved cards and subscriptions don't move between gateways on their own.

Full guide: Cybersource vs Authorize.Net

What Cybersource costs

Gateway fees and processing fees

Cybersource doesn't publish prices. Every product page sends you to its sales team, so the cost depends on your quote. Most businesses pay two bills: Cybersource for the gateway and each service they turn on, and the acquirer for card processing, unless one contract bundles both.

→Published: the Virtual Terminal is "free with your Cybersource account."
→Interchange-plus: whether you get itemized interchange-plus pricing depends on who acquires your sales, not on the gateway.

Full guide: Cybersource pricing and fees

Cybersource changes in 2026

If a developer or platform built your Cybersource connection, check these with them. Dates come from Cybersource's developer release notes, as of September 27, 2026.

→Secure Acceptance sunset: Cybersource set September 30, 2026 as the target date for merchants to finish moving off Secure Acceptance (its older hosted checkout). Its recommended replacement is Unified Checkout.
→SOAP Toolkit sign-in: from October 7, 2026, production requests that use username and password authentication are rejected. P12 certificate authentication is required.
→New hostnames and IP addresses: API hosts now include api.visaacceptance.com. The network move is dated October 15, 2026 for test and January 31, 2027 for production. Connections that use DNS aren't affected; hard-coded IP allowlists are.
→Message-level encryption: Cybersource says its updated encryption becomes mandatory by March 2027.

Sources: Secure Acceptance sunset, SOAP Toolkit P12, IP migration, message-level encryption (Cybersource release notes, September 25, 2026).

High-risk and international businesses

High risk: Cybersource doesn't approve or decline your business. The acquirer behind it does, so a gateway alone can't get a restricted business approved. Read how a high risk payment gateway works with a merchant account approved for what you sell.

Outside the U.S. and Canada: this is where Cybersource earns its place. Authorize.Net requires a merchant account from a U.S. or Canadian provider and points businesses elsewhere to Cybersource. If you sell in Canada, see Authorize.Net in Canada. If you're in Australia, see Australian merchant accounts.

Why talk to START first

You get the Cybersource gateway from Cybersource. We provide the merchant account that sits behind a gateway, and we'll tell you plainly whether Cybersource or Authorize.Net suits the way you sell.

Registered with Elavon: A registered MSP/ISO of Elavon, Inc. and the Canadian branch of U.S. Bank National Association.
Interchange-plus pricing: You pay the card networks' cost plus a set markup on the merchant account. Send us a statement and we'll show you the difference.
20+ years with Authorize.Net: We've worked with Authorize.Net for more than two decades and set up over 60,000 Authorize.Net accounts.
Real people in Salt Lake City: Monday to Friday, 9 to 5 Mountain Time, at 888-573-7587.

Cybersource FAQ

Is Cybersource a merchant account?

No. Cybersource is a payment gateway. What Cybersource calls a "merchant account" is your gateway account in Business Center. You still need an acquiring merchant account behind it to accept cards and get paid.

Is Cybersource the same company as Authorize.Net?

They're sister companies. Cybersource bought Authorize.Net in 2007, and Visa bought Cybersource in 2010. They're still separate gateways with separate accounts and prices. Cybersource vs Authorize.Net →

How much does Cybersource cost?

Cybersource doesn't publish prices; you get a quote from its sales team. Expect a gateway bill from Cybersource and a processing bill from your acquirer. How Cybersource pricing works →

Is Cybersource good for a small business?

Usually not the first choice. Cybersource's own small-business page points small businesses to Authorize.net, which publishes its prices and works with most shopping carts.

What replaces Cybersource Secure Acceptance?

Unified Checkout. Cybersource set September 30, 2026 as the target date for merchants to finish moving off Secure Acceptance and named Unified Checkout as the recommended path.

What is a Cybersource Organization ID?

It's the ID for your Cybersource account, formerly called the Cybersource Merchant ID. You'll need it to log in to Business Center and when you contact Cybersource support.

This page is general payments guidance, not legal advice. Cybersource facts are taken from its own pages and developer release notes as of September 27, 2026, and can change. START is not a Cybersource reseller and doesn't set Cybersource's prices.

Cybersource Merchant Services: Gateway, Merchant Account and Costs

What is the Cybersource payment gateway?

Do you need a merchant account for Cybersource?

Who Cybersource fits, and who it doesn't

What the Cybersource platform includes

The Cybersource Business Center dashboard

Comparing Visa's two gateways

Cybersource or Authorize.Net?

What Cybersource costs

Gateway fees and processing fees

Cybersource changes in 2026

High-risk and international businesses

Why talk to START first

Cybersource FAQ

Go deeper on any topic

Cybersource vs Authorize.Net

Pricing & Fees

Ready to Get Started?

Thank you for contacting START Merchant Services!

There was a problem submitting your form

Call Us

Email Us

Visit Us