Authorization and Capture

What Is Authorization and Capture?

Authorization and capture is the standard two-phase process that card networks like Visa and Mastercard use to move money from a cardholder's account to a merchant's account. In the first phase (authorization), the merchant requests permission from the cardholder's issuing bank to charge a specific amount. The issuer verifies the card is valid, checks for fraud, confirms sufficient funds or credit, and places a temporary hold on the authorized amount. In the second phase (capture), the merchant tells its acquirer to actually collect the funds and complete the transaction.

This two-step design exists because many real-world transactions have a gap between when a customer commits to pay and when the merchant fulfills the order. A hotel guest checks in days before checking out. An online retailer accepts an order before shipping it. The authorization hold reserves the funds so the merchant knows they'll be available at capture time, without actually moving money prematurely.

How It Works

The authorization and capture flow involves four parties: the cardholder, the merchant, the acquirer (merchant's bank or processor), and the issuer (cardholder's bank). Messages travel through the card network (Visa, Mastercard) using the ISO 8583 standard.

Authorization Phase

1. The cardholder presents their card at a terminal or enters details online. The merchant's system sends an authorization request to its acquirer.
2. The acquirer forwards the request through the card network to the issuing bank.
3. The issuer validates the card, runs fraud checks, and verifies available funds. It returns either an approval with a six-digit authorization code or a decline with a reason code.
4. On approval, the issuer places a hold on the authorized amount. The cardholder's available balance drops, but no money has moved yet.

Capture and Settlement Phase

1. When ready to collect payment (for example, when shipping an order), the merchant submits a capture request referencing the original authorization code.
2. The capture amount can be equal to or less than the authorized amount. Capturing for more than the authorized amount is generally not permitted without an incremental authorization.
3. Captured transactions are batched (typically daily) and submitted for settlement through the card network.
4. The card network facilitates the transfer: the issuer debits the cardholder's account and sends funds (minus interchange fees) to the acquirer, which deposits them into the merchant's account.

Auth-Only vs. Sale Transactions

Not every card payment uses two separate steps. In many retail environments, the authorization and capture happen as a single combined message called a "sale" transaction. The customer taps their card, the issuer approves, and the transaction automatically enters the next settlement batch. No separate capture step is needed.

Auth-only (delayed capture) is chosen when the final amount may change or the merchant needs time before fulfilling the order. The tradeoff: auth-only requires more careful management of hold durations and capture timing to avoid penalties from the card networks.

Authorization Hold Durations

Card networks enforce strict time limits on how long a merchant can hold an authorization before capturing. Exceeding these windows can result in penalty fees and increased chargeback risk.

Visa Authorization Windows

As of Visa's April 2024 framework update, authorization validity depends on the transaction type:

Impact on Cardholders

Authorization holds reduce the cardholder's available balance even though the transaction has not settled. Cardholders see a "pending" charge on their statement. If the hold expires without capture, the funds are released back to the available balance, but this can take one to eight business days on debit cards.

Debit card holds are especially impactful because they reduce the actual spending balance, not just a credit limit. Multiple simultaneous holds (for example, a hotel auth plus a car rental auth on the same trip) can temporarily tie up significantly more money than the cardholder expects.

Use Cases

Hotels and Lodging

Hotels authorize at check-in for the estimated stay cost plus an incidental buffer (often $50 to $200 per night extra). The final capture happens at checkout for the actual total, which may include minibar charges, room service, or parking. Mastercard allows hotels to capture up to 20% above the original authorization amount.

Car Rentals

Rental companies authorize at pickup for the estimated rental cost plus a security deposit. They capture at return for the actual charges, which may include fuel, extra mileage, or damage fees. Visa requires an incremental authorization if the final amount exceeds the original estimate by more than 15%.

E-Commerce

Online retailers authorize at order placement and capture at shipment. This avoids charging customers for items that may be out of stock or backordered. If part of an order ships separately, the merchant can do multiple partial captures against the original authorization. Many payment gateway platforms default to auth-only mode for this reason.

Gas Stations

Fuel pumps authorize a preset amount (typically $50 to $175, capped by card network rules) before pumping begins. The actual amount is captured once pumping completes. These holds typically clear within a few hours but can take up to three days on weekends.

Void vs. Refund

When a transaction needs to be reversed, the method depends on timing. Understanding this distinction is critical for merchants managing chargeback risk and processing costs.

There is also the authorization reversal: a message to the issuer to release a hold without capturing. This is the proper way to cancel an auth-only transaction and differs from a void, which cancels a captured-but-unsettled transaction.

Comparison with Bitcoin Payments

The authorization and capture model exists because card networks are built on deferred settlement and reversible transactions. Bitcoin operates on a fundamentally different model.

When a Bitcoin transaction is broadcast and confirmed on-chain, it is final. There is no authorization phase, no hold period, and no separate capture step. The sender's UTXOs are spent, and the recipient receives funds in a single atomic operation. This finality eliminates the need for voids, reversals, chargebacks, and the multi-day settlement cycle that card payments require.

For merchants, this means no authorization holds tying up customer funds, no penalty fees for late captures, and no interchange fees flowing to issuing banks. Layer 2 solutions like Spark and the Lightning Network enable near-instant Bitcoin payments while preserving this single-step finality, making them a compelling alternative for use cases where the two-step card model creates friction and cost. For a broader look at how traditional card economics compare, see the research on card network economics.

Risks and Considerations

Expired Authorizations

If a merchant captures after the authorization validity window expires, the issuer may decline the capture or the cardholder may file a chargeback. Mastercard Reason Code 4808 specifically covers expired authorization protection periods. Card networks also impose penalty fees for late captures: Visa charges a "misuse of authorization system" fee for approved authorizations that are neither reversed nor settled within the validity window.

Hold Amount Mismatches

As of July 2025, Visa charges 25 basis points (with a $0.04 minimum) when a final authorization is captured for a significantly lower amount than authorized. This penalizes merchants who over-authorize and encourages the use of estimated (pre-authorization) transaction types when the final amount is uncertain.

Cardholder Confusion

Authorization holds appear as pending charges on statements, often confusing cardholders who may believe they have been double-charged. This is especially common with hotels and car rentals, where the hold and the final charge can appear simultaneously before the hold drops off. Such confusion frequently leads to support calls and, in some cases, unwarranted chargeback filings.

Debit Card Sensitivity

Holds on debit cards directly reduce the cardholder's available cash balance, unlike credit cards where only the credit limit is affected. A large hotel hold on a debit card can leave a traveler unable to pay for meals or transportation until the hold clears. Merchants accepting debit cards should be transparent about hold amounts and durations.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.