Credit Card AuthorizationHow Approval Works, Why It Fails, & How Long It Lasts

How Does Credit Card Authorization Work? Are There Risks & Why Do Authorization Requests Sometimes Fail?

Call a restaurant and book a table for seven. Nobody takes your money at this point, and nobody cooks anything, and no meal has been bought. A name goes in a book and a table stops being available to everybody else.

What if you never turn up, though? In that case, the table quietly goes back on the market with no money changing hands.

Card authorization is similar in a lot of ways. It is the moment a card gets approved, but not the moment you actually get paid. Those are two different moments with a gap in between.

In this post, we’ll look at what happens during an authorization, why requests get declined, and how long you have to close that gap before the approval expires.

What is Credit Card Authorization?

Credit Card Authorization

[noun]/kreh • duht • kard • aa • thr • uh • zay • shn/

Credit card authorization is a notification given by a credit or debit card issuer (i.e. a bank, credit union, etc.), confirming that the cardholder has enough funds or available credit to cover a transaction they’re making with their card.

Card authorization refers to the actual notification received by a merchant. It’s the “green light,” signaling to the merchant that the bank has validated the cardholder’s account, and that the bank approved this purchase.

This whole process happens in the span of a few seconds. However, it’s an essential step in the payment process.

The process of seeking approval is called an authorization request. It’s the merchant’s way of asking the cardholder’s bank to validate the buyer’s account, ensure that the transaction is valid, and verify that the cardholder can meet their financial commitments.

In short: the authorization process gives both businesses and customers some confidence about the security of their transactions.

Is Card Authorization the Same as Authentication?

No. Authentication asks whether the person holding the card is the person it belongs to. Authorization asks whether the account behind the card can cover the sale. They travel in the same request, come back in the same response, and answer completely different questions.

	Authentication	Authorization
The question	Is this the right person?	Can this account cover it?
Decided by	Checks on identity and card data	The issuing bank
What it uses	Address checks, the security code, a bank challenge	Balance, credit limit, account status, fraud screening
What it returns	A match, a mismatch, or a challenge	An approval or a decline

Authentication methods like CVV validation, address verification, and 3-D Secure don’t determine whether the sale goes through. They give the issuer more to go on, and the issuer makes a call based on all the indicators in aggregate. A card can pass every identity check and still get declined.

How Does Card Authorization Work?

You can have two different banks — the merchant acquirer and the card issuer — on opposite ends of the transaction. These two parties work together to make sure an authorization request gets completed. Here’s how:

• The customer presents their card (or card information) for payment at the point of sale. Card authorization is required for both online and in-person transactions.
• The business's point-of-sale software automatically sends a request for transaction authorization to the merchant’s processor, which forwards the request to the acquirer.
• The acquirer forwards the request to the issuer via the card network, seeking approval for the purchase from the cardholder's bank.
• The issuing bank examines the cardholder's account to verify that the card is valid, and that sufficient funds or credit are available to cover the purchase.
• The issuing bank either approves or denies the transaction, based on the cardholder’s ability to cover the funds for the transaction.

This entire process usually takes just a few seconds, in the brief pause between submitting a card for payment and the card reader displaying “approved.”

Why Do I Need Authorization for a Credit Card Transaction?

As mentioned above, the authorization phase confirms that the account exists, is in good standing, and has sufficient funds available. Requesting credit card authorization before completing a purchase leads to:

Incorporating the credit card authorization function into payment processing streamlines transactions and minimizes risk. It also creates a more positive experience for cardholders, leading to increased trust and loyalty.

Common Responses to an Authorization Request

If everything appears in order from the issuer's perspective, such as the card's validity and sufficient available funds, the issuer will grant approval for the transaction to proceed. This approval comes with an authorization code (“00” is the standard approval code).

Merchants may receive a variety of responses related to the card's eligibility for the transaction, though. Examples include:

That’s just a partial list. Check out our full article on card authorization codes to view the standard list of credit card denial codes:

Learn more about authorization codes

Alongside it comes a separate approval code of up to six characters, which is the one your terminal or gateway shows you. This is created through a combination of transaction data and credit card information.

The approval code identifies that particular approval so the sale can be matched to it later. It does not protect the card number; swapping the card number for a stand-in value is tokenization, and that is a different mechanism entirely.

What Happens When You Get a “Call for Authorization” Response?

Sometimes the issuer will not say “yes” or “no” up front. They say ask us.

The response is a referral, instructing you to call the bank to try and get an authorization. If you’re there in person, the terminal might print something like CALL AUTH, and the sale is stuck until somebody on the bank’s end picks up a phone.

• Your terminal returns the referral. Not approved, not declined, and instructs you to call to try and get authorization.
• You call your acquirer’s voice authorization line, not the cardholder’s bank. Have that number somewhere findable before you need it.
• You give the merchant number, the card number, and the amount. The operator reaches the issuer.
• If the issuer approves, an approval code is read out loud and you key it in. This is called a forced authorization code.
• If the issuer says no, then take that decline as a final answer. Running the card again will not turn it into an approval.

How Long Is a Credit Card Authorization Good For?

It varies, depending on the circumstances. Visa’s rules set a maximum window between the approval and the point at which the completed sale has to be processed. But, the exact timeline depends on how the sale was taken and what kind of business took it

How the sale was taken	Maximum window
Card-present	5 days
Card-absent, cardholder initiated	10 days
Merchant-initiated	5 days
Lodging, vehicle rental, cruise line	30 days

Remember, these numbers are pulled from the Visa Core Rules and Visa Product and Service Rules, meaning they only apply to Visa transactions. Mastercard, American Express, and Discover set their own windows. Ask your acquirer for the full list that applies to your account.

If you’re looking for a key takeaway here, it’s this: try to complete the sale as quickly as possible. The 30-day figure that gets repeated everywhere only applies to very select cases like hotels and rental cars. So, trying to adhere to a five-day window whenever possible is best.

Miss the window and the sale can be charged back as a late presentment, which is the dispute an issuer files when a sale arrives too late to post. This would be reason code 11.3 for Visa transactions, or reason code 4834 for Mastercard.

What About Pre-Authorization Settlement?

Using pre-authorization settlement gives merchants time to validate charges and look for potential fraud.

A pre-authorization settlement occurs when funds from a pre-authorization hold are deposited into the merchant’s bank account after the transaction has been settled. This is typically used when the final transaction amount is unknown at the time of purchase.

As mentioned above, a cardholder can’t dispute the transaction or issue a credit or debit card chargeback as long as the funds for a transaction are held but not settled. Merchants should note, however, that pre-auths can only be kept in place for a maximum of 30 days. Ideally, pre-auths should be replaced with settled transactions as quickly as possible.

Learn more about pre-auth settlement

How to Check a Card Without Holding Funds

Sometimes you want to know a card is real and the account is open without reserving any of the customer’s money. Saving a card for later, starting a subscription, updating a payment method on file. That sort of thing.

There is a message for this, called an account verification request.

An account verification request is basically an authorization request for zero dollars. It asks the issuer whether the card and account are good, and comes back approved or declined like any other authorization. The customer sees no pending amount.

What you should not do is run a small charge to test the card. Visa lists test transactions as a misuse of the authorization system, and are thus subject to Misuse of Authorization System Fee.

Authorization, Capture, Settlement, & Clearing: What’s the Difference?

Remember: authorization is the point at which the issuer checks if there are enough funds or credit to cover the purchase. The money doesn’t move just yet, though.

Capture happens when the acquirer asks for the authorized funds to be transferred from the issuing account. Payment capture can follow a flexible timeline. But since most card authorizations expire within 5 to 10 days, businesses and their payment processors usually capture funds before that happens.

Learn more about payment capture

Next, there’s clearing. This is where the acquirer sends the completed sale into the card network and the network passes it to the issuer to be posted against the cardholder’s account.

Finally, there’s settlement. This happens when the money from customer transactions finally moves from the cardholder’s issuing bank to the business’s acquiring bank.

Learn more about settlement

Authorization is the “yes,” clearing is the paperwork, and settlement is the money. Each represents a distinct phase in the transaction process.

How Is Debit Card Authorization Different?

Debit and credit look identical at the terminal, so people assume they work the same way.

Not quite.

A credit authorization asks whether there is room on a credit line. A debit authorization asks whether there is money in a deposit account right now, and it holds that money against a real balance. Which is to say: a credit hold makes a somebody’s credit limit smaller, and a debit hold makes existing money temporarily unavailable.

	Credit	Debit
What is checked	Available credit line	Available account balance
What the hold impacts	Spending limit	Real money the customer can access
Cardholder verification	Signature, or none online	PIN, or none where the card runs PINless
Message pattern	Authorize now, capture later	Sometimes authorize and capture in one message
Routing	The card brand on the front	Possibly a different debit network entirely

Two things follow for a merchant. Debit declines skew toward insufficient funds rather than risk rules, so a retry is less likely to fix one. Debit holds also generate more complaints, because the customer can see the money is missing. An estimated hold sitting for a week on a credit card is an annoyance. On a debit card, it could mean a bounced payment and an angry email.

Online, most debit cards run on the same rails as credit, which is why the process above describes both. Five days if the card was present, ten if it wasn’t, and nobody has ever explained why the card being in the room makes an approval go stale faster.

5 Reasons an Authorization Request Might Fail

Requests for authorization get declined all the time. But why, though? What happens when a credit card charge doesn’t go through? Can a card fail to authorize without something fishy going on?

Well, there are many reasons why a credit card authorization attempt might fail. Five of the most common decline triggers include:

Sometimes the business and customer are given a specific reason why a rejected charge was declined, and sometimes they won’t be. The amount of information that accompanies a rejected authorization depends on various factors, such as who the card issuer is, who the business’s payment processor is, what kind of POS system they have, and whether the transaction was online or in person.

Credit cards can fail for a range of reasons, no matter where they’re processed, but there are steps businesses can take to improve their authorization rate. 

What is an Authorization Reversal?

An authorization reversal is a message initiated by a merchant, intended for a cardholder’s issuing bank. The message notifies the issuer that a transaction (in full or in part) has been canceled, and that an authorization hold should be removed.

If a merchant detects an error in the transaction process, they can contact their acquiring bank to initiate an authorization reversal before the transfer is complete. This effectively cancels the sale and prevents that transaction from going through.

Prompt authorization reversal is not optional. Any time you have a transaction that will not be completed, Visa requires the merchant to reverse the entire authorized amount within 24 hours (or by the end of the authorization’s validity period; whichever comes first). The same 24-hour clock applies to the difference where an estimated authorization came in above the final amount.

Skipping the reversal will trigger a Misuse of Authorization System Fee, which is assessed any time an authorizations cannot be matched to a corresponding reversal. There’s also Visa’s Unmatched Clearing Fee, which lands on a completed sale that arrives with no approved authorization behind it. Basically the same bookkeeping problem, but seen from the other end.

Learn more about authorization reversals

Best Practices for Improved Authorization Rates

Best Practices for Improved Authorization Rates

Your authorization rate is the share of attempts that come back approved, and it moves for boring reasons more often than exciting ones. Think card details that have quietly gone stale, checkout fields that invite typos, retry logic that hammers a card the issuer already refused, risk settings tuned for a business you were three years ago.

Not to worry, though; a few best practices will improve authorization rates and decrease risk. These include:

This is a partial list; there are plenty more practices you can put in place that should help keep declined authorizations under control. Check out our authorization optimization guide below:

Authorization Optimization: How to Raise Your Auth Rate

The one thing worth saying here is that an authorization rate is not a fraud number. So, it should not be managed like one.

Squeezing declines down by loosening every rule works… right up until it doesn’t. Which is to say: authorization is a permission to be paid, held for a limited time, and a merchant’s whole job in this part of the process is to turn that permission into money before it expires.

Ready to Stop Losing Revenue to Failed Authorizations?

Orphaned authorizations, avoidable declines, and disputes that trace back to a missing approval all cost the same thing: money you already earned.

The data insights supplied by Chargebacks911® extend beyond just chargebacks. We provide the necessary KPIs for our merchants to pinpoint where transactions are leaking out of the payment process and close the gap. Plus, our services are backed by a performance-based ROI guarantee. Contact us today for a no-obligation analysis.