Accepting Online Payments in Nigeria: A Practical Checklist

Nigerian businesses can accept cards, bank transfers and USSD payments online through payment gateways such as Paystack, Flutterwave and Interswitch. Getting a "Pay now" button onto a page takes an afternoon. Making sure every order is paid for exactly once, at the right amount, without exposing your customers' card details, takes a few more deliberate steps.

Choosing a gateway

• Payment methods: check which of cards, bank transfer and USSD are supported for your customers.
• Fees and settlement: understand the transaction fees, any caps, and how quickly money reaches your bank account.
• Documentation and support: clear developer documentation and a test mode make integration faster and safer.
• Refunds and disputes: know how refunds are issued and how chargebacks are handled.

Never handle card numbers yourself

Use the gateway's hosted checkout page or its embedded payment form, so card details go directly to the gateway and never touch your servers. Any business that stores, processes or transmits card data falls under the Payment Card Industry Data Security Standard (PCI DSS); letting the gateway handle card details keeps most of that burden with them.

Always verify payments on your server

The most common integration mistake is trusting the browser. When a customer is redirected back to your site saying "payment successful", that message can be faked. Before you deliver anything:

1. Call the gateway's verify transaction API from your server, using your secret key and the transaction reference. With Paystack, for example, this is a request to the Verify Transaction endpoint.
2. Check that the status is successful and that the amount and currency match the order in your database.
3. Only then mark the order as paid.

Use webhooks, and make them safe

Customers close tabs and lose connections mid-payment. Webhooks are notifications the gateway sends to your server when a payment succeeds, so you can complete the order even if the customer never returns to your site.

• Verify the signature on every webhook so you know it really came from the gateway.
• Make processing idempotent: the same event can arrive more than once, or arrive before the customer's redirect, so fulfilling an order twice must be impossible.
• Respond quickly and do slow work, such as sending emails, afterwards.

Details that prevent expensive mistakes

• Units: many gateway APIs expect amounts in the smallest currency unit. Paystack amounts, for example, are in kobo, so ₦5,000 is sent as 500000.
• Keys: keep secret keys on the server only, never in website or app code, and keep test and live keys separate.
• Reconciliation: compare the gateway's settlement reports with your own records regularly.
• Customer experience: show prices clearly in naira, send a receipt by email, and offer an easy retry when a payment fails.

Get these foundations right and online payments become the most reliable part of your sales process, rather than the part that keeps you up at night.

Further reading

• Verify Payments — Paystack documentation
• Flutterwave developer documentation
• PCI Security Standards Council