Authorization

Authorization asks the issuer a question: if I claim this money later, will you stand behind it? An approval is a promise and a hold. No money moves.

That gap between the promise and the money is where most payments confusion lives. The message takes under a second. The money takes days.

The message path

What the issuer weighs

Not just whether the money is there — the issuer page covers what it is weighing and why it tells you so little about a decline. The issuer is looking at the balance or credit line, the card's status, how the card has been used recently, and the context of this particular request: was the card physically present at a terminal (card-present) or not (card-not-present), did 3-D Secure run, did the address match.

That card-present distinction decides who carries a fraud loss, and it reappears in every deadline table below; cards explains why. 3-D Secure is the authentication step that redirects the cardholder to their own bank to confirm they are who they say they are. Running it moves fraud liability towards the issuer, which is why the schemes reward it.

Context is worth money as well as approval odds. A transaction carrying stronger verification tends to qualify for cheaper interchange and shifts more dispute liability away from you. Clearing and settlement covers how that turns into cost.

Responses are not just yes or no

Response	Meaning	What to do
Approved	Full amount held	Proceed
Partial approval	Issuer approved less than you asked for, usually against a prepaid balance	Decide whether a partial sale works, collect the rest another way
Soft decline	Issuer wants stronger authentication	Re-attempt with 3-D Secure
Hard decline	Card is invalid, closed, or reported	Stop
Referral	Issuer wants voice authorization	Rare, mostly legacy
No response	Timeout somewhere in the chain	Treat as unknown, not declined

Timeouts are the case worth planning for. A timeout does not mean the issuer said no. It means you have no idea what the issuer said. The issuer may well have approved and placed a hold, so if you simply retry you can end up holding the customer's money twice for one purchase.

After a timeout

Do not retry the transaction immediately.

1. Send a reversal for the attempt that timed out, or query its status.
2. Wait for the result.
3. Retry only if the first attempt did not approve.

Declines and retries

Decline reasons are vague on purpose. If a checkout page told an attacker exactly why a card failed, the page would become a free card-testing tool. So you have to drive retry logic from the decline code family, not from a guess about the real cause.

Retrying badly is expensive rather than merely useless. Visa charges per attempt once you cross its reattempt limits, so a loop that hammers a dead card turns a lost sale into a running cost.

One decline family in the rule below needs naming. A velocity limit is the issuer's cap on how often a card may be used in a period. It is a rate limit, not a judgement about the card, so the transaction that trips it will usually succeed later.

Retry policy

Read the decline code before you retry.

• Insufficient funds, velocity limit, or issuer unavailable: retry later. Use a backoff.
• Expired card, invalid data, or soft decline: retry only with new card data or with 3-D Secure.
• Stolen card, restricted card, revoked authorization, or closed account: do not retry.

Put this logic in one payment service. Do not put it in the checkout page.

How long an approval lasts

Visa used to run two separate clocks, one for how long an authorization stayed valid and one for how long the acquirer had to clear it. Since 13 April 2024 there is a single authorization-to-clearing time frame, counted in calendar days from the approval.

Transaction type	Visa maximum
Cardholder-initiated, card-not-present	10 calendar days
Cruise line, lodging, vehicle rental, with an estimated authorization indicator	30 calendar days
Aircraft, boat, motorcycle, furniture, equipment and similar rental categories, with an estimated authorization indicator	10 calendar days
All other card-present	5 calendar days
All merchant-initiated, including recurring and installments	5 calendar days

The last row covers merchant-initiated transactions: charges you raise against a stored card without the customer present, such as a subscription renewal. The customer agreed once, in advance, rather than at the moment of the charge.

Mastercard keeps its own clock and it is not the same one, and it turns on how the request was flagged. A final authorization says this amount is settled and will not change. A preauthorization says this is an estimate and the real figure will follow, which is why it is given longer. Under Mastercard's transaction processing rules, a transaction flagged as a final authorization must be presented for clearing within 7 calendar days of approval, and a preauthorization within 30 calendar days. If you build one internal deadline for both schemes, you will breach the tighter one.

Fuel is stricter still. A preauthorization at an automated fuel dispenser needs a completion or a reversal within two hours of the approval.

Variants worth knowing

An estimated authorization holds a likely amount before the final figure exists, as at a fuel pump or on a bar tab. An incremental authorization adds to a hold as a bill grows, which is how hotels and rental firms handle a lengthening stay. Incremental authorizations do not extend the original clock, so a stay that outlasts the window needs the original transaction closed and a fresh authorization raised.

A zero-dollar authorization, also called account verification, checks that a card is real and the details match without holding anything. It is the right tool for storing a card for later use. Do not use a one-cent authorization for this; that pattern attracts a misuse fee.

Terms introduced

• Auth code — the issuer's reference for an approval, needed to link a later capture.
• Authorization hold — a reduction in available balance that is not yet a charge.
• Authorization-to-clearing time frame — Visa's single deadline covering approval through clearing.
• Soft decline — a decline inviting a retry with stronger authentication.
• Estimated authorization — a hold for an amount not yet final.
• Incremental authorization — an addition to an existing hold.
• Stand-in processing — the network approving on the issuer's behalf when the issuer is unreachable.
• 3-D Secure — the authentication step that sends the cardholder to their own bank to confirm identity, shifting fraud liability towards the issuer.
• Final authorization — a request flagged as settled, whose amount will not change.
• Preauthorization — a request flagged as an estimate, with the real amount to follow.
• Merchant-initiated transaction — a charge raised against a stored card without the customer present, on consent given earlier.
• Velocity limit — the issuer's cap on how often a card may be used in a period.

Authorization and capture

0 of 5 answered

1. Under Mastercard's rules, why does a preauthorization get longer to reach clearing than a final authorization?

   A preauthorization is flagged as an estimate, so the real amount is still to come.A preauthorization is only used in card-present environments, which clear more slowly.A final authorization has already been captured, so its clock has stopped.A preauthorization carries stronger authentication data, which earns a longer window.
2. A subscription renews and you charge the stored card. What kind of transaction is that?

   A merchant-initiated transaction, raised on consent the customer gave earlier.A card-not-present transaction requiring fresh 3-D Secure authentication.An incremental authorization against the original sign-up transaction.A cardholder-initiated transaction, because the customer chose to subscribe.
3. A customer cancels an order minutes after checkout, before capture. What should the merchant send?

   An authorization reversal.A refund.A chargeback.Nothing; the hold expires on its own.
4. A furniture retailer authorizes at checkout and ships six weeks later. What is the main risk?

   The authorization expires before capture, weakening protection and worsening the rate.The customer is double-charged when the goods ship.The acquirer refuses to route the capture.The issuer converts the hold into a payment automatically.
5. Why are decline reasons often vague, such as "do not honour"?

   Detailed reasons would help attackers probe cards, so issuers withhold them.The card networks do not support detailed decline codes.Acquirers strip the detail before passing it to the merchant.The issuer usually does not know why its own model declined.