Skip to main content

Authorization and Capture

Prerequisites

Before diving into auth and capture, understand:

TL;DR
  • Authorization = "Can this cardholder pay?" (issuer checks credit limit, fraud risk, account status)
  • Capture = "Actually move the money" (triggers clearing and settlement)
  • Auth hold = Temporary hold on funds; expires if not captured (typically 7-30 days)
  • The gap between auth and capture is your fraud review window - use it wisely
On this page

The Authorization-Capture Flow​

What is Authorization?​

Authorization is asking: "Can this card pay for this?"

When you request authorization, the issuer checks:

  1. Does this card exist and is it valid? (Not expired, not reported stolen)
  2. Is the account in good standing? (Not frozen, not over limit, not flagged for fraud)
  3. Are there sufficient funds or credit available?

If all three answers are yes, the issuer sends back an approval code - a 6-digit alphanumeric promise: "We've verified the funds and are holding them for you."

Key Concept

An authorization is not a charge. No money has moved. The issuer has placed a "hold" on that amount, temporarily reducing available credit. Think of a hotel putting a hold on your card at check-in - they haven't charged you yet.

What is Capture?​

Capture (also called "presentment" or "clearing") is when you say: "Okay, now actually take the money."

This is when the transaction becomes real:

  1. You submit the transaction for settlement
  2. The issuer debits the cardholder's account
  3. Funds flow: Issuer → Network → Acquirer → You

After capture, the "pending" charge becomes a "posted" charge. The transaction is complete.

Combined vs. Separated​

Combined (Auth + Capture together): Most retail transactions. Tap your card at a coffee shop, and auth/capture happen simultaneously.

Separated (Auth now, Capture later): Some businesses deliberately separate them. This is "manual capture" or "auth-only" followed by capture.

Why Separate Auth and Capture?​

1. Final Amount Unknown​

IndustryWhy
HotelsDon't know final bill until checkout (minibar, room service, extended stay)
RestaurantsTip added after authorization
Gas stationsAuth fixed amount ($100-150), capture actual pump amount
Vehicle rentalsAuth estimated, capture based on actual duration, fuel, tolls

2. Fulfillment Not Complete​

ScenarioApproach
E-commerceAuth at order, capture at shipment
Pre-ordersAuth to validate card, capture when item ships
Custom goodsAuth confirms payment ability, capture when ready

3. Fraud Review Window​

This is the big one for fraud teams. The window between authorization and capture is your opportunity to review before committing.

Why this matters: Once you capture, reversing requires a refund:

  • Costs you interchange fees you don't get back
  • Creates accounting complexity
  • May take days to post to customer's account
  • Looks bad if customer disputes instead

But if you void before capture, the hold simply releases. Cleaner operationally and financially.

The Fraud Review Window​

What You Can Do During the Window​

CheckPurpose
Velocity checksCard used at unusual speed? Multiple orders quickly?
Device fingerprintingDevice matches previous fraud patterns? VPN/proxy?
AVS/CVV verificationBilling matches issuer records? Shipping to reshipping service?
Manual reviewHigh-risk orders flagged for human review
3D Secure step-upChallenge with additional authentication
Behavioral analysisSession recordings, mouse movements, typing patterns

Void vs. Decline Decision​

Decline at authorization: Transaction never approved. Customer sees "card declined." Clean, but friction for legitimate customers.

Approve, then void before capture: Authorization succeeds, but you cancel before capturing. Hold releases. Softer approach - you're giving yourself time to investigate without hard-declining at checkout.

Segment Your Approach​

Risk LevelCapture Timing
Low-risk ordersCapture immediately (no review needed)
Medium-risk ordersCapture same-day after automated checks
High-risk ordersHold for manual review, capture next day if approved

Authorization Windows​

Authorizations don't last forever. Each network sets validity windows:

NetworkStandard Window
Visa7 days CNP, 5 days card-present
Mastercard7 days final auth, 30 days preauth
Amex7 days standard

Miss the window? Auth expires, hold releases, you need to re-authorize (might fail if card is now maxed/closed/stolen).

For detailed network-specific windows, see Authorization Windows Reference.

Why Fast Capture Sometimes Wins​

Delayed capture isn't free:

Customer Confusion​

Statements don't clearly distinguish pending vs. posted. Customer might see:

  1. "Pending" charge when they order
  2. Pending disappears (auth expired/voided)
  3. New charge appears (re-authorized and captured)

To the customer: looks like double charge. They call support. Or worse, file a dispute.

Authorization Decay​

The longer you wait, the more likely something changes:

  • Customer spends available credit elsewhere
  • Card reported lost/stolen
  • Account closed or flagged for fraud

Reconciliation Complexity​

Every auth-capture pair is two events to track in settlement:

  • Did this auth get captured?
  • Did this capture match the right auth?
  • Partial captures? Split shipments?

When to Use Which Approach​

Use Immediate Capture When:​

  • Transaction is low-risk (known customer, low value, consistent pattern)
  • Goods/services delivered immediately
  • Customer experience is priority
  • Reconciliation simplicity matters

Use Delayed Capture When:​

  • You need time for fraud review
  • Fulfillment is delayed (pre-orders, backorders, custom items)
  • Final amount isn't known yet
  • Regulatory or business rules require it

Industry-Specific Patterns​

IndustryAuthCaptureSpecial Rules
HotelsAt check-in (estimated + buffer)At checkout (actual)Extended auth windows (30 days)
Vehicle RentalsAt pickup (estimated + deposit)At return (actual charges)Can capture more than auth for fuel/tolls
E-commerceAt checkoutAt shipment7-day window typically
RestaurantsPre-tip amountWith tip addedCan exceed auth by tip tolerance (~20%)
Subscriptions$0 or $1 validationAt billing period startSpecific recurring indicators required

Pre-Authorization Holds​

When you authorize but don't immediately capture, customers see a "pending" or "hold" on their account. This confuses customers and drives support calls.

How Holds Appear to Customers​

What You DidWhat Customer SeesDuration
Auth only"Pending: $X"Until capture or expiration
Auth + void"Pending" then disappears1-7 days to clear
Auth expired"Pending" then disappears7-30 days depending on issuer
Auth + capture"Pending" becomes "Posted"1-3 days

The problem: Customers don't understand "pending." They see the charge, assume they were billed, and when the pending disappears (auth expired), they think they got a free refund. Then the real charge posts and they dispute for "duplicate billing."

Industries That Create Holds​

IndustryHold AmountWhy
HotelsRoom rate × nights + 20-50% bufferIncidentals, minibar, damages
Gas stations$100-150 fixedUnknown pump amount
Car rentalsDaily rate × days + $200-500Fuel, tolls, damages
RestaurantsBill amountTip to be added

Managing Customer Expectations​

Best practices for hold-heavy businesses:
□ Disclose hold amount at point of sale
□ Explain when and how holds release
□ Provide hold reference on receipt
□ Train support staff on hold timing
□ Consider email/SMS when hold releases

Hold Release Timing​

You don't control when holds release. The issuer does.

Card TypeTypical Release Time
Debit cards1-3 business days after void/expiration
Credit cardsUp to 7 days after void/expiration
Prepaid cardsUp to 10 days (highly variable)

Debit card pain: For debit cards, holds reduce actual available cash, not credit limit. A $500 hotel hold on a debit card with $600 balance leaves the customer with $100 accessible. This generates the angriest calls.

Reducing Hold Complaints

For high-hold industries: capture as quickly as possible. A captured transaction posts faster than a voided authorization releases. If the final amount is known, capture immediately rather than holding.

Authorization Expiration and Re-Authorization​

Authorizations expire. If you don't capture in time, the hold releases, and you need to re-authorize. This creates risk and customer confusion.

Network Expiration Windows​

NetworkCard-PresentCard-Not-PresentExtended (Hotels/Rentals)
Visa5 days7 days31 days (with proper MCC/indicator)
Mastercard7 days7 days30 days (preauthorization)
Amex7 days7 daysVaries by agreement
Discover10 days10 daysExtended available

What Happens at Expiration​

Re-Authorization Risks​

RiskWhat Happens
Card maxedCustomer spent available credit elsewhere
Card closedAccount closed, reported lost/stolen
Fraud flagSecond auth attempt triggers fraud decline
Customer confusionTwo "pending" charges visible
Higher decline rateRe-auths have ~5-15% lower approval vs. original

Preventing Auth Expiration​

StrategyImplementation
Track auth timestampsAlert before expiration window
Capture earlierShip faster or capture at earlier fulfillment stage
Use proper indicatorsExtended windows for hotels/rentals
Incremental authFor changing totals, use incremental instead of full re-auth
Customer communicationIf re-auth needed, warn customer

When Re-Authorization Is Required​

ScenarioAction
Auth expired, need to chargeRe-authorize with customer notification
Auth amount increasedIncremental auth (if supported) or void + new auth
Long fulfillment delayConsider auth closer to ship date
Subscription renewalNew auth each period (not re-auth)
Ask Your Dev

"Are we tracking authorization timestamps? Do we have alerts for approaching expiration? What's our re-authorization decline rate?"

Partial Authorization​

Sometimes the card doesn't have enough available credit for the full amount, but the issuer approves a partial amount. You decide what to do with the remainder.

How Partial Auth Works​

When Partial Auth Happens​

ScenarioExample
Prepaid cardsCard has $60 balance, purchase is $100
Debit cardsAccount has $60, purchase is $100
Credit at limitAvailable credit is $60, purchase is $100
Gift cardsRemaining balance less than purchase

Handling Partial Authorization​

OptionWhen to UseUX Consideration
Accept partialLow-friction preferredCustomer pays remainder with second method
Void and retrySingle payment requiredCustomer must use different card
Split tenderPOS supports itSmooth for in-person, complex online
Decline entireSimplicity over conversionBad UX, customer frustrated

Processor Support​

Not all processors handle partial auth the same way:

Processor BehaviorWhat You See
Returns partialAuth response includes partial amount approved
Auto-declinesReturns decline if full amount unavailable
ConfigurableYou choose whether to accept partials

Online vs. In-Person​

EnvironmentPartial Auth Handling
Card-present (POS)Display approved amount, prompt for second payment method
E-commerceMore complex - must handle in checkout flow
Mobile appSimilar to e-commerce, needs UI support
Unattended (kiosk/gas pump)Often auto-accepts partial for prepaid

Implementation Considerations​

Partial auth checklist:
□ Does your processor support partial auth responses?
□ Can your checkout flow handle split payments?
□ What's your policy: accept partial or decline?
□ How do you handle partial for digital goods (can't partial-deliver)?
□ Staff training for in-person split tender?
Prepaid Card Reality

Prepaid cards are the main source of partial authorizations. If you sell to demographics that use prepaid heavily (gift recipients, unbanked customers, teens), build proper partial auth handling into your checkout flow.

Partial Captures (Split Shipments)​

Partial capture lets you capture less than the authorized amount. This is essential for split shipments and order modifications.

When to Use Partial Capture​

ScenarioHow It Works
Split shipmentAuth $100, ship item A ($60), capture $60. Ship item B ($40), capture $40.
Item out of stockAuth $100 for 2 items, one unavailable, capture $50 for delivered item.
Order modificationCustomer removes item after auth, capture reduced amount.
Partial fulfillmentService partially delivered, capture proportional amount.

Partial Capture Flow​

Network Rules for Multiple Captures​

NetworkMultiple CapturesNotes
VisaSupportedMust complete within auth window
MastercardSupportedFinal capture should close auth
AmexLimitedCheck with processor
DiscoverSupportedStandard window applies

Accounting Implications​

ConsiderationImpact
Revenue recognitionRecognize when captured, not authorized
Refund complexityPartial captures + partial refunds = reconciliation headaches
InterchangeEach capture may incur separate fees
ReportingOne order = multiple settlement records

Implementation Checklist​

Partial capture readiness:
□ Does your processor support multiple captures per auth?
□ Can your OMS track remaining auth balance?
□ How do you handle auth expiration mid-shipment?
□ Does your accounting system handle split captures?
□ What's your policy if remaining items are cancelled?

Common Pitfalls​

PitfallPrevention
Capturing more than authTrack remaining balance
Auth expires between shipmentsRe-authorize or ship faster
Lost track of capturesSingle source of truth for auth state
Customer confusionExplain multiple charges upfront
Ask Your Dev

"Can we do multiple captures against a single authorization? How do we track remaining authorized balance? What happens if we try to capture more than the remaining amount?"

Operational Best Practices​

For Merchants​

  1. Track authorization timestamps. Know exactly when each auth expires.
  2. Build automated capture triggers. When order ships, capture immediately.
  3. Void unused authorizations. Don't let them expire - release holds faster for customers.
  4. Use proper transaction indicators. Ensure processor flags transactions correctly for extended windows.

For Fraud Teams​

  1. Segment by risk for capture timing. Not every transaction needs review.
  2. Set review SLAs inside the auth window. 7-day auth = 5-day max review SLA.
  3. Use void wisely. Softer than decline at auth for uncertain cases.
  4. Track void reasons. Analyze why transactions are voided to improve upstream detection.

Void vs. Refund: Which To Use​

One of the most expensive mistakes SMBs make is refunding when they should have voided. The cost difference is real.

The Decision Tree​

Cost Comparison​

ActionWhat HappensYour Cost
Void (before capture)Authorization hold releases. Transaction never settles.$0
Void (same-day after capture)Some processors allow. Transaction reverses before settlement.$0 - $0.10
Refund (after settlement)New transaction crediting the customer. Original interchange not returned.Original interchange + refund fee (~$0.30)

Real Money Example​

A $100 order with 2.9% + $0.30 processing:

  • Void before capture: You pay $0
  • Refund after settlement: You pay $3.20 (interchange) + $0.30 (refund fee) = $3.50 lost

At 100 refunds per month, that's $350/month you could save by voiding earlier.

When to Void​

ScenarioAction
Order cancelled before fulfillmentVoid
Fraud detected before captureVoid
Customer changes mind same dayVoid (if still possible)
Duplicate authorizationVoid the duplicate
Wrong amount authorizedVoid and re-authorize

When to Refund​

ScenarioAction
Customer returns product days laterRefund (partial or full)
Service complaint after deliveryRefund
Chargeback prevention (already settled)Refund
Order already shippedRefund (void not possible)

Processor-Specific Behavior​

Not all processors handle voids the same way:

Processor TypeSame-Day VoidNext-Day Void
PayFac (Stripe, Square)Usually worksUsually works (before batch close)
Traditional processorWorks before batchDepends on settlement timing
Gateway + ProcessorCheck both systemsMay need to void in gateway
Ask Your Dev

"What's our batch settlement schedule? Can we void transactions after capture but before batch close? What's the cutoff time?"

Operational Practice​

  1. Build void-first workflows. When cancelling orders, check if void is possible before issuing refund.
  2. Track batch timing. Know your daily cutoff for same-day voids.
  3. Train support staff. "Can we void this?" should be the first question.
  4. Monitor void-to-refund ratio. High refund rate when voids were possible = money leak.

Next Steps​

Just learning auth/capture?

  1. Check your processor's default behavior - auth-only or combined?
  2. Understand your auth validity window
  3. Learn what happens after capture

Optimizing your flow?

  1. Review auth optimization to improve approval rates
  2. Consider separated auth/capture for fraud review
  3. Track auth-to-capture timing to stay within windows

Troubleshooting issues?

  1. "Ghost charges" on statements - check if auths are being voided properly
  2. Declined at capture - auth expired or amount mismatch; see decline codes
  3. Amount mismatches - verify industry tolerance rules (tips, fuel, hotels)

See Also​