Authorization

Authorization is the initial synchronous stage of a card payment. The merchant poses an electronic question to the cardholder's issuing bank: "If I present a claim for this amount later, will you guarantee payment?"

An approval constitutes a binding electronic commitment: the issuer reserves the approved amount against the cardholder's credit line or account balance by placing an authorization hold. Crucially, no money changes hands at this stage.

The authorization message runs through the entire network circuit in under a second without moving money. The actual funds flow in reverse over subsequent days during interbank settlement.

Message routing across the switching fabric

Under normal operation, the issuer evaluates the payload and returns an approval containing a unique alphanumeric auth code, which is required to link subsequent capture files back to the authorization hold.

If the issuing bank is experiencing an outage or fails to respond within network SLA timeouts (typically 2–3 seconds), the card network can activate stand-in processing (STIP), approving or declining the transaction on the issuer's behalf within pre-negotiated transaction caps.

Issuer decision evaluation

Issuing bank decision engines assess dozens of risk attributes during the authorization evaluation:

• Available credit limit or checking balance.
• Card status (verifying the card is active and has not been reported lost, stolen, or expired).
• Transaction context: physical retail (card-present) versus digital checkout (card-not-present).
• Cryptographic authentication: evaluating 3-D Secure verification cryptograms or EMV chip transaction counters.
• Data consistency: Address Verification Service (AVS) postal code matches and Card Verification Value (CVV) checks.

Providing high-integrity contextual data at authorization improves approval rates, qualifies the transaction for lower interchange tiers, and establishes the foundation for a liability shift on disputed transactions.

Authorization response categories

Response type	Technical meaning	Recommended merchant action
Approved	The issuer confirmed credentials and placed a full authorization hold	Proceed with order fulfillment
Partial approval	Issuer approved a portion of the requested total (common on prepaid cards)	Confirm partial sale; prompt customer for alternative tender for balance
Soft decline	Transaction declined due to missing authentication (e.g. SCA required)	Re-attempt authorization prompting cardholder for 3-D Secure challenge
Hard decline	Account closed, card stolen, or credentials invalid	Terminate checkout; do not reattempt against the same card details
Referral	Issuer requests telephone verification with the cardholder	Rare in modern e-commerce; prompt for an alternative payment method
Network timeout	Dropped connection or timeout along the switching path	Do not immediately retry; query status or send an authorization reversal

When an authorization request times out, the outcome is uncertain: the issuer may have approved the transaction and reserved the cardholder's funds even if the response never reached the merchant. Reattempting the transaction immediately without investigating the timed-out attempt can result in duplicate authorization holds on the customer's account.

Handling network timeouts

Do not retry timed-out transactions immediately.

1. Issue an authorization reversal referencing the timed-out attempt, or query its processing status via the payment gateway API.
2. Wait for confirmation of the reversal or status query.
3. Prompt the customer or reattempt the transaction only after verifying that the initial attempt was cancelled or failed.

Intelligent retry policies and decline handling

Card schemes prohibit indefinite automated retries against declined authorizations. To prevent checkout abuse, schemes enforce rate limits and assess penalties:

• Submitting repeated automated requests against hard-declined cards can result in network non-compliance fines.
• An issuer-imposed velocity limit represents a temporary security cap restricting transaction frequency on a card within a short time window. Transactions rejected for velocity limits generally succeed if retried after a backoff window.

Automated retry policies

Evaluate the specific decline family before scheduling reattempts.

• Insufficient funds, velocity limit exceeded, or issuer system unavailable: retry using an exponential backoff schedule (e.g. 24–48 hours).
• Expired card, invalid CVV, or soft decline: prompt the customer for updated card credentials or step-up authentication.
• Stolen card, closed account, or fraudulent card: cease all processing attempts immediately.

Authorization lifecycles and expiration timeframes

An authorization hold does not remain valid indefinitely. If the merchant does not capture the transaction, the issuer releases the hold.

Visa enforces a unified authorization-to-clearing time frame, calculated in calendar days from the moment of approval:

Transaction classification	Visa maximum clearing window
Cardholder-initiated, card-not-present	10 calendar days
Lodging, cruise lines, and vehicle rentals (with estimated auth indicator)	30 calendar days
Equipment, motorcycle, and specialty rentals (with estimated auth indicator)	10 calendar days
General card-present retail transactions	5 calendar days
All merchant-initiated transactions (recurring subscriptions, installments)	5 calendar days

A merchant-initiated transaction (MIT) is a payment processed against stored credentials without active consumer interaction—such as automated monthly subscription billings or utility charges. Because the consumer consented in advance, MITs follow strict formatting and registration rules detailed in stored credentials.

Mastercard maintains a dual-classification structure under its transaction processing rules:

• A final authorization signifies that the authorized amount represents the exact final charge; it must be submitted for clearing within 7 calendar days.
• A preauthorization signifies an estimated charge where the final amount will be adjusted later; it permits a 30-calendar-day clearing window.
• Automated fuel dispensers operate under an expedited window, requiring completion or reversal within two hours of approval.

Specialized authorization patterns

Standard retail uses fixed authorizations, but specialized commercial flows require adaptable authorization patterns:

• An estimated authorization reserves a projected balance before final consumption is known—such as pre-authorizing $100 at a fuel dispenser or opening an open bar tab.
• An incremental authorization increases an active authorization hold as charges accumulate—such as extending a hotel reservation or adding room charges. Crucially, incremental authorizations do not extend the original clearing expiration clock; if a customer stay exceeds the initial window, the merchant must capture the original transaction and raise a fresh authorization.
• A zero-dollar authorization (also called account verification) verifies that a card credential is valid, active, and matches AVS records without placing a monetary hold on the cardholder's account.

Terms introduced

• Auth code: the issuer's reference for an approval, needed to link a later capture.
• Authorization hold: a reduction in available balance that is not yet a charge.
• Authorization-to-clearing time frame: Visa's single deadline covering approval through clearing.
• Estimated authorization: a hold for an amount not yet final.
• Incremental authorization: an addition to an existing hold.
• Stand-in processing: the network approving on the issuer's behalf when the issuer is unreachable.
• 3-D Secure: the authentication step that sends the cardholder to their own bank to confirm identity, shifting fraud liability towards the issuer.
• Final authorization: a request flagged as settled, whose amount will not change.
• Preauthorization: a request flagged as an estimate, with the real amount to follow.
• Merchant-initiated transaction: a charge raised against a stored card without the customer present, on consent given earlier.
• Soft decline: a decline inviting a retry with stronger authentication.
• Velocity limit: the issuer's cap on how often a card may be used in a period.