Authorization Windows Reference
- Visa gives you 10 calendar days card-not-present and 5 card-present. Mastercard gives 7 for a final authorization and 30 for a flagged preauthorization. Amex gives 7. Every number here is calendar days.
- Only Visa splits by channel. It goes the way most people don't expect: CNP gets the longer window, not the shorter one. Mastercard and Amex don't split at all.
- Incremental authorizations extend your protection on Mastercard. On Visa they do nothing. The only route to 30 days on Visa is the right indicator on the original authorization, plus an eligible MCC.
- Capture against an expired authorization and you're exposed. Mastercard treats the approved amount as zero, so you get an authorization chargeback, not a soft one.
An authorization window is how long you've got to capture after approval. Miss it and you have to re-authorize. That might fail.
Three networks, three different structures. Visa splits by channel. Mastercard splits by authorization type. Amex doesn't split at all. Read the section for the network you're on, not the one next to it.
Every figure on this page is calendar days, not business days. Visa and Mastercard count from the authorization approval date, not the transaction date. Weekends and holidays sit inside the window. Nothing here counts business days, so the usual off-by-two trap doesn't apply.
Visa Authorization Windows
Visa used to run two clocks. How long the authorization stayed valid, and when you had to clear by. On 13 April 2024 it merged them into one authorization-to-clearing timeframe. So "how long is my auth good for" and "when do I have to clear by" are now the same question.
| Transaction Type | Window | Notes |
|---|---|---|
| Card-not-present, cardholder-initiated | 10 calendar days | Most e-commerce |
| Card-present | 5 calendar days | In-store, terminal |
| Merchant-initiated | 5 calendar days | Recurring, installment, advance payment, unscheduled credential-on-file. Effective 13 April 2024 |
| CNP with the extended authorization indicator | 30 calendar days | Not MCC-restricted |
| Cruise, lodging, vehicle rental with the estimated authorization indicator | 30 calendar days | MCC-restricted |
| Other rental MCCs with the estimated authorization indicator | 10 calendar days | See the list below |
| Automated Fuel Dispenser preauthorization | 2 hours | Completion message or reversal |
Source: Visa Core Rules and Visa Product and Service Rules, 18 October 2025, section 5.7.3.5, Table 5-11.
Visa is the only network with a different card-present number. Watch the direction. Card-not-present gets 10 days, card-present gets 5. That's the opposite of what most merchants assume.
Fuel is hours, not days. An AFD preauthorization needs a completion message or a reversal. Within 2 hours of the approval response.
Extended Windows (Special Categories)
The long windows need an indicator in the authorization message. Two different indicators, two different rules:
- Extended authorization indicator, card-not-present: 30 calendar days, no MCC restriction
- Estimated authorization indicator plus an eligible MCC: 30 calendar days for cruise lines, lodging and vehicle rental
Not all rentals are equal. These merchant categories get 10 calendar days with the estimated authorization indicator, not 30:
- Aircraft rental
- Bicycle and e-scooter rental
- Boat rental
- Clothing and costume rental
- DVD and video rental
- Equipment and tool rental
- Furniture rental
- Motor home rental
- Motorcycle rental
- Trailer parks and campgrounds
The 30-day window depends on the indicator being in the message. Not on what business you're in. If your processor isn't sending the flag, you've got 10 days on Visa and 7 on Mastercard. Your MCC doesn't matter. That's the most common way a merchant thinks they have 30 days and actually has 7.
Incremental Authorization Does Nothing on Visa
Visa says it flatly: "An Incremental Authorization Request does not extend the processing timeframes." No exceptions listed. The clock runs from the original approval. Nothing you send afterward moves it.
Mastercard says the opposite, below. So a 21-day car rental is protected on Mastercard, as long as the operator keeps sending incremental preauths. The identical rental on a Visa card is unprotected from day 6. Unless the original authorization carried the estimated authorization indicator, and you're in an eligible MCC.
Nobody selling hotel or rental software will tell you this. The whole point of the feature is that it sounds network-agnostic. The tactic and the indicator are different things. Only the indicator works on Visa.
Country Overrides
Visa's Table 5-12 carries country-specific overrides. India, Japan, Malaysia, Nepal and Argentina. We're not printing those numbers, because we haven't verified the pairings to our own standard. Process in those markets? Get the current table from your acquirer.
Mastercard Authorization Windows
Mastercard splits by authorization type, not by channel. There's no card-present versus card-not-present table here. Mastercard doesn't write one. A final authorization gets 7 calendar days, at a terminal or in a browser.
Mastercard also still runs two clocks. A presentment deadline, and a separate message reason code 4808 chargeback protection period. They carry identical numbers today, which is why they get conflated. They're different rules. They can diverge.
| Authorization Type | Window |
|---|---|
| Preauthorization (flagged as such) | 30 calendar days |
| Final authorization | 7 calendar days |
| Final authorization, India domestic | 4 calendar days |
| Deferred authorization (offline chip-approved) | 7 calendar days |
| Undefined authorization | 7 calendar days |
| Refund transactions | 5 calendar days |
Source: Mastercard Transaction Processing Rules, 9 December 2025, sections 2.5.1, 2.6, 2.7 and 2.8. The clock starts on the authorization approval date, not the transaction date. India's 4 days took effect 3 April 2024. The 5-day refund protection period took effect 12 April 2024. Costa Rica final authorizations get 30 calendar days for presentment.
Mastercard separates a "preauthorization," flagged as such, from a regular "final authorization." The preauth gets the longer window. Make sure your processor is sending the right indicator.
Incremental Authorization Does Work on Mastercard
Section 2.9 exists for exactly this. Submit an additional preauthorization request for the same transaction. That extends the 4808 protection period on an approved preauthorization. A zero-amount one extends the clock without changing the authorized amount. A non-zero one extends the clock and raises the amount.
That's the opposite of Visa. Visa ignores incremental requests entirely.
An Expired Mastercard Auth Is No Auth
Section 2.8: the approved amount of any authorization with an expired 4808 protection period "is deemed to be zero."
Capture on day 8 against a 7-day final authorization. Mastercard treats you as having never authorized. That's why the chargeback is 4808 Authorization-related, not something softer.
Europe Contactless
Europe intraregional contactless carries one more rule. Clearing within 2 calendar days of the transaction date.
American Express Authorization Windows
One number, no channel split.
| Type | Window |
|---|---|
| Standard transactions | 7 calendar days |
| Lodging, cruise lines, vehicle rentals on estimated charge amounts | Valid for the life of the stay or rental agreement |
Source: American Express Merchant Reference Guide - U.S., section 5.4 "Authorization Time Limit." Amex measures all of its timeframes in calendar days.
An authorization approval is valid for 7 days. That same 7 days is the submission window. The travel exception isn't a fixed number of days. The authorization holds for the length of the stay or the rental agreement. Expresspay at transit access terminals is handled separately.
Discover: Nobody Can Tell You
Discover doesn't publish a current edition of its Merchant Operating Regulations. The last public full edition is Release 11.1, from 2011. It set 30 calendar days of authorization validity and 10 days to submit sales data.
Those figures are more than a decade old. Processors enforce much shorter windows in practice. A widely repeated "90 days" figure traces only to third-party aggregators, not to Discover. Three incompatible numbers, and no current primary source.
So we're not printing one. Get your Discover window from your acquirer in writing.
Wallets Are Not Card Networks
PayPal, and wallets generally, set their own authorization windows. Those aren't network rules. They don't belong in the tables above.
PayPal's numbers aren't stated here, because the public sources disagree with each other. Circulating figures run from a 3-day honor period with roughly 29 days of validity, to a 10-day hold that auto-extends once. Check PayPal's current developer documentation, or read the value your API returns. Don't plan capacity against a number you found on a reference page. Including this one.
Chargeback Protection Periods
These windows drive your chargeback defense.
Mastercard Chargeback Protection
This is the message reason code 4808 protection period. It's a separate rule from the presentment deadline above. Same numbers today. Different rule.
| Authorization Type | Protection Period |
|---|---|
| Preauthorizations | 30 calendar days |
| Final authorizations | 7 calendar days (4 days India domestic, effective 3 April 2024) |
| Deferred authorizations | 7 calendar days |
| Undefined authorizations | 7 calendar days |
| Refund transactions | 5 calendar days (effective 12 April 2024) |
Source: Mastercard Transaction Processing Rules, 9 December 2025, section 2.8.
"Statused" accounts. The issuer flags an account negatively: closed, fraud investigation, severely delinquent, lost or stolen. If you captured after the protection period expired, the issuer can charge back the transaction.
Captured within the protection period? You're generally safe, even if the account gets statused afterward. Captured late? You're exposed to reason code disputes.
Visa Late Presentment
Visa Dispute Condition 11.3 covers:
- Valid authorization required but not obtained
- Valid authorization obtained but transaction not processed within required timeframe
This has a 75-day dispute window from transaction processing date.
Visa retired Condition 12.1 Late Presentment on 12 April 2024 and folded it into 11.3. Reading anything that treats late presentment as its own dispute condition? It predates the change.
Amex Authorization Disputes
American Express allows chargebacks when:
- Authorization was declined, reversed, or partially reversed but merchant submitted anyway
- Initial authorization is more than 7 days before clearing date (unless qualified for estimated charges)
- Merchant failed to follow authorization requirements
What Happens If You Miss the Window
- The hold on customer's funds releases
- You can't capture against that authorization
- You must request a new authorization
- New auth might be declined (insufficient funds, card lost, etc.)
- If you capture anyway against expired auth, you're exposed to chargebacks
Quick Reference Table
All calendar days, counted from the authorization approval date.
| Network | Transaction Type | Window |
|---|---|---|
| Visa | Card-not-present, cardholder-initiated | 10 calendar days |
| Visa | Card-present | 5 calendar days |
| Visa | Merchant-initiated (any channel) | 5 calendar days |
| Visa | CNP with extended authorization indicator | 30 calendar days |
| Visa | Cruise, lodging, vehicle rental with estimated authorization indicator | 30 calendar days |
| Visa | Other rental MCCs with estimated authorization indicator | 10 calendar days |
| Visa | Automated Fuel Dispenser preauthorization | 2 hours |
| Mastercard | Final authorization (any channel) | 7 calendar days |
| Mastercard | Preauthorization | 30 calendar days |
| Mastercard | Deferred authorization (offline chip) | 7 calendar days |
| Mastercard | Undefined authorization | 7 calendar days |
| Mastercard | Final authorization, India domestic | 4 calendar days |
| Mastercard | Refunds | 5 calendar days |
| Amex | Standard (any channel) | 7 calendar days |
| Amex | Lodging, rental, cruise on estimated charges | Life of the stay or rental agreement |
| Discover | Any | Not published; get it from your acquirer |
Sources: Visa Core Rules 18 October 2025 section 5.7.3.5 Table 5-11; Mastercard Transaction Processing Rules 9 December 2025 sections 2.5.1 to 2.9; American Express Merchant Reference Guide - U.S. section 5.4.
Your processor may enforce a shorter window than any of these. Stripe caps Visa at 4 days and 18 hours where Visa allows 5. It caps card-present Mastercard, Amex and Discover at 2 days where the networks allow 7. That's a clearing buffer, not a network rule. Need day 6 on a card-present Mastercard? You're asking your processor to change a setting, not asking the network for an exception.
Next Steps
Checking auth windows?
- Use quick reference table - All networks at a glance
- Check Visa specifics - 10 days CNP, 5 card-present, 30 with the indicator
- Check Mastercard specifics - 7 days final, 30 days preauth
Avoiding late capture issues?
- Know what happens if you miss - Re-auth required
- Understand chargeback exposure - Late = liability
- Track auth dates - Capture within window
Qualifying for extended windows?
- Check extended categories - Hotels, rentals, cruise
- Use correct indicators - Must flag in request
- Verify preauth flags - Preauth vs final
See Also
- Authorization and Capture - Core concepts
- Capture Operations - Holds, voids, partial captures
- Decline Codes - When captures fail
- Chargeback Reason Codes - Dispute categories