Payment Authorization: What Happens Between Checkout and Capture
Authorization is where a card payment is won or lost. Here is the full lifecycle from hold to capture and settlement, and why a subscription rebill is judged differently from a first purchase.
Every card payment your business will ever collect starts with a question to a bank you have never met: will you honor this charge? That question, the authorization, is answered in under two seconds, and for a subscription business it is answered thousands of times a month on cards whose owners are nowhere near a checkout. Understanding what happens in that window, and what happens to the money afterward, is the difference between treating declines as weather and treating them as a rate you can manage.
What is payment authorization?
Payment authorization is the card issuer's real-time decision to approve or decline a charge before any money moves. When the issuer approves, it places a hold that reduces the cardholder's available balance by the transaction amount. Funds only transfer later, at capture and settlement. An authorization is a reservation, not a payment.
That distinction does most of the work in this article. Authorizing a payment reserves the amount by holding it on the customer's payment method; capture is the separate step that actually collects the funds. Visa's own merchant guidance is blunt about the consequence: every successful authorization ties up real cardholder money, and holds that are never settled or reversed generate complaints for which merchants get blamed.
One clarification before going deeper, because the search results blur it. Technically, an unauthorized charge is one the issuer never approved, and card rails do not allow that: every charge, including a subscription rebill, passes through issuer authorization. What a consumer means by an 'unauthorized charge' is that they did not consent to it. That is a dispute and liability question, not a failure of the authorization step. The two meanings share a word and nothing else.
Authorization, capture and settlement: what happens when
A card payment moves through three distinct stages. Authorization reserves the money: the issuer approves the charge and holds the amount. Capture is the merchant's instruction to collect what was authorized. Settlement is when funds actually transfer from the issuing bank through the network to the merchant's acquirer, usually one to three business days after the transaction.
- Authorization request: your gateway or processor packages the card details, amount and transaction context and routes them through the card network to the issuing bank.
- Issuer decision: the issuer approves or declines. The entire round trip across merchant, acquirer, network and issuer completes in under two seconds.
- Hold placed: on approval, the issuer reduces the cardholder's available balance by the approved amount. No money has moved.
- Capture: the merchant tells its processor to collect the authorized amount. Many businesses capture immediately; some capture later on purpose.
- Clearing and settlement: transaction records are matched between banks, and the issuer transfers funds to the acquirer, typically over one to three business days.
What the issuer is actually deciding in those milliseconds
The issuer is not just checking a balance. During the round trip, Visa's network-level risk engine analyzes 400 risk attributes in less than a millisecond and hands the issuer an in-flight score. Issuers combine that score with 70 or more transaction parameters of their own to build approve-or-decline rules. The inputs cluster into a short list.
- Available funds or credit on the account
- Card status: active, expired, reported lost or stolen, closed
- Velocity and pattern: how this attempt compares to the account's history
- AVS (Address Verification Service) and CVV verification results, when those signals are present
- Merchant context: the MCC (Merchant Category Code, the four-digit code identifying your line of business), the billing descriptor, and the recurring or merchant-initiated flags on the message
- The network's fraud risk score for this specific attempt
The issuer decides with something no one else in the chain has: the cardholder's full account history. When it says no, the reason often stays opaque. Response code 05, 'Do Not Honor', accounts for close to half of all decline responses across the industry, which is why reading the issuer's verdict takes real work. We cover how to interpret those verdicts in our guide to the issuer decline.
How long does an authorization hold last, and what releases it?
Most online card authorizations are valid for about 7 days, and in-person authorizations for about 2 days, before they expire. Capture in time and the hold becomes a completed payment. Miss the window and the authorization expires: the issuer releases the held funds back to the cardholder and the payment is canceled.
| Network | Customer-initiated (CIT) | Merchant-initiated (MIT) | Note |
|---|---|---|---|
| Visa | 7 days | 5 days (exactly 4 days 18 hours) | The rebill's clock is literally shorter |
| Mastercard | 7 days | 7 days | Pre-authorizations get 30 days; late capture draws a fee |
| American Express | 7 days | 7 days | Same window for both |
| Discover | 7 days | 7 days | Same window for both |
Card-not-present authorization validity windows. In-person windows are shorter: 5 days on Visa, 2 days on Mastercard, Amex and Discover.
Expiry is the passive release. The active one is an authorization reversal: a message telling the issuer to remove the hold and restore the cardholder's open-to-buy. Visa requires the entire authorized amount to be reversed within 24 hours of the merchant learning a transaction will not complete. One consumer-facing wrinkle explains a lot of support tickets. Even after a merchant voids or reverses, the pending entry can linger on the cardholder's statement for a few days. The issuer removes it on its own schedule. The hold is released; the display catches up later.
Letting authorizations dangle is not free. Visa's Authorization Misuse Fee, charged on any approved authorization that is never matched to a clearing record or a reversal, rose to $0.15 per transaction on January 1, 2025, up from $0.09. Card-not-present transactions must clear within 10 days. Merchants who legitimately need longer between auth and capture can request an extended authorization, which reaches up to 30 days on eligible transactions, priced at an extra 0.08% on Visa.
Pre-authorization, incremental authorization and re-authorization
A pre-authorization (Visa calls it an estimated authorization) is an approval obtained before the final amount is known, used to secure funds while the customer is still consuming the service. Hotels, vehicle rentals and fuel are the classic cases; Mastercard gives pre-authorizations a 30-day life versus 7 days for a final authorization. Two related tools handle what happens when the estimate or the clock runs out. For the consumer-side view of these holds, see our guide to the pre-authorization charge.
- Incremental authorization: raises an already-approved total when the estimate proves too low. Each increment appears as an additional pending entry on the cardholder's statement until capture consolidates them, and increments never extend the original authorization's validity window.
- Re-authorization: when a hold must outlive its validity window, the merchant reverses the old authorization and requests a new one from scratch. It is a fresh issuer decision, not an extension.
- Reversal: the cleanup tool for all of the above. Unused amounts must be reversed within 24 hours so the cardholder's funds are freed.
Why recurring and card-on-file authorizations are judged differently
A recurring charge is a merchant-initiated transaction (MIT): a payment the merchant starts without the customer's direct participation, under a prior stored-credential agreement. The issuer knows this. Visa's own definition notes that the merchant cannot perform cardholder validation or authentication on an MIT. The rebill is scored on the context the merchant supplies, not on cardholder presence.
Start with what a rebill structurally cannot carry. PCI DSS (Payment Card Industry Data Security Standard) prohibits storing the card verification code after the original authorization. A rebill therefore arrives without a fresh CVV. The strongest card-verification signal a checkout purchase has is absent by design. Networks do not take the merchant's word for what kind of transaction this is. They classify CIT versus MIT from actual signals of cardholder participation, a fresh CVC being the canonical one, rather than from the API flag alone.
The rulebooks then codify the difference. On Visa, a card-not-present merchant-initiated authorization is valid 5 days, against 7 for a customer-initiated one. Under Visa's current framework, merchant-initiated transactions, explicitly including recurring and credential-on-file billing, get a 5-calendar-day authorization-to-clearing window. That is half the 10 days a cardholder-initiated online purchase gets. The network itself treats a rebill as a different transaction class.
Liability follows the same asymmetry: merchant-initiated transactions carry no 3DS (3-D Secure) fraud liability shift, so the merchant keeps chargeback exposure on every rebill even when the original signup was authenticated. Issuers also apply their most sensitive fraud filters to card-not-present traffic, the category every rebill falls into. The result is what recovery specialists call a confidence problem rather than a funds problem: the issuer declines a legitimate rebill because it lacks enough confidence in a cardholder-absent request.
Time adds a failure mode first purchases never face: the credential itself goes stale. Expired or reissued cards cause roughly 10 to 15% of recurring payment failures, and stale credentials drive up to half of hard declines in subscription portfolios. Mastercard now even charges a $0.09 Credential Continuity fee per recurring transaction run on an outdated credential. The fixes the networks built live in the authorization message. The first is chaining: each rebill points back to the original authenticated setup through Visa's Network Transaction ID or Mastercard's Trace ID. The second is network tokens, whose adoption grew 44% year over year in 2024 while lifting approvals and cutting fraud. Tokens update automatically when a card is reissued, so the credential stays current without the customer touching it.
Put together, the mechanism (no cardholder, no CVV, aging credentials, tighter windows, warier scoring) shows up in the numbers. Typical domestic recurring authorization rates run 85 to 90%, versus mid-to-high 90s for healthy one-time domestic card traffic, and cross-border recurring drops to 72 to 80%. The gap is not uniform across datasets or payment methods, and debit behaves worse than credit in benchmark data. The structural handicap is the same either way. The rebill is judged on the message, because the message is all the issuer gets.
What causes an authorization to fail, and which failures are recoverable
Authorizations fail for reasons that range from permanent (a closed account) to momentary (a velocity limit). The split that matters is soft versus hard. A soft decline means the payment method is still valid but the issuer would not approve this attempt. A hard decline means the credential itself is dead. Soft declines account for roughly 80 to 90% of all declines. The full breakdown is in our guide to soft declines vs hard declines.
| Visa decline category | What it means | Can you retry? |
|---|---|---|
| Category 1 | The issuer will never approve this credential | No. Any reattempt is automatically excessive |
| Category 2 | The issuer cannot approve right now (insufficient funds, velocity limits) | Yes. This is where legitimate retry logic operates |
| Category 3 | Data-quality failure (wrong card number, expired date) | Only after correcting the data; retrying unchanged data does nothing |
Visa's decline categories dictate recoverability. Mapping your decline codes to these classes is the first step of any recovery strategy.
Retries are governed by network rule, not merchant preference. Visa caps retryable declines at 15 reattempts per 30-day period, with the 16th attempt billed as excessive at $0.10 domestically. Mastercard requires merchants to stop after 10 declines on the same card within 24 hours, and its excessive-authorization fee reached $0.50 per excess attempt in January 2025. Blind retry loops are now a direct cost line. Which code you received determines which side of the line you are on; our credit card decline code reference maps them.
The encouraging half of the story: a large share of failed rebills are winnable. Benchmark research across subscription businesses found the three most common decline messages all recover at over 45%, and even invalid-card-number declines recover at over 20% once the credential is refreshed. But recovery is time-boxed: 90% of successful recoveries happen within the first 10 days after the failure. A failed authorization is not a lost sale; it is a decaying asset.
How do you measure authorization performance across issuers and MIDs?
Authorization rate is the percentage of authorization requests the issuer approves out of all attempts submitted. It is distinct from acceptance rate and checkout conversion, which include drop-offs before a card is ever submitted; mixing them corrupts issuer-level measurement. Treat it as a rate you manage, segmented by issuer, BIN, gateway, MID and billing cycle, not as a binary event.
Segmentation is the entire game. A blended number hides the problems. A 92% blended rate can conceal a 78% rate on one BIN range in one corridor. That is a fixable revenue leak, and it never surfaces in the average. Processors default to reporting blended figures. Issuer-level and BIN-level metrics usually exist in their reporting APIs, but are rarely surfaced unless the merchant asks. That is why merchants running serious recurring volume build or buy their own measurement layer.
- Pull authorization rate by issuer and by BIN, not just the blended number
- Separate first-purchase approval rates from rebill approval rates
- Split declines into soft, hard and data-quality classes before deciding anything
- Track retry counts per card against the 15-in-30-days network ceiling
- Compare approval rates across gateways and MIDs carrying comparable traffic
- Monitor stale-credential declines and network-token coverage by billing cycle
- Time recovery attempts inside the 10-day window where most recoveries happen
The stakes justify the discipline. Failed subscription payments were projected to cost businesses $129 billion in 2025 through involuntary churn. Retry strategies informed by broader payment data outperform single-merchant retry logic by 10 to 20 points of recovery. Measurement is what turns a decline from an event you log into a decision you can act on; a structured failed payment recovery program is where that measurement becomes revenue.
Frequently Asked Questions
What does payment authorization mean?
Payment authorization means the card issuer has checked a transaction and approved it, placing a hold on the cardholder's available balance for the amount. It is a promise that funds are reserved, not a transfer of money. The merchant must capture the authorization before it expires to actually collect the payment.
How do I authorize a payment?
You authorize a payment by submitting the card details to your gateway or processor, which routes an authorization request through the card network to the issuing bank. The issuer approves or declines, usually in under two seconds. Merchants never authorize payments themselves; only the issuer can approve, and the merchant then captures the approved amount.
How long does a payment authorization last?
Most online card authorizations last about 7 days, and in-person authorizations about 2 days, before they expire and the hold is released. Visa gives merchant-initiated transactions only 5 days. Mastercard pre-authorizations can last 30 days, and extended authorization services can stretch eligible holds to roughly 30 days.
What is the difference between authorization and capture?
Authorization reserves the funds; capture collects them. An authorization places a hold that reserves the amount on the customer's card, while capture is the separate instruction that tells the issuer to actually transfer the money. If the merchant never captures, the authorization expires and the held funds return to the cardholder.
Can someone charge your card without authorization?
No. Every card charge requires an issuer authorization, including recurring subscription charges, which are authorized under the stored-credential agreement accepted at signup. When a cardholder calls a charge 'unauthorized', they mean they did not consent to it, which is a dispute and liability question, not a failure of the technical authorization step.