An authorization hold is what happens when a card issuer approves an amount and reduces the cardholder’s available balance before the transaction is fully completed. For a merchant, that approval reserves the customer’s funds; it does not mean the money has arrived. The hold is later captured, released or left to expire, and each outcome has different consequences for operations, customer experience and dispute exposure. This guide explains how authorisation, pre-authorisation and capture fit together, and why a hold is not a settled payment, a refund or a rolling reserve.
What an authorisation hold is
An authorisation hold is the reduction in a cardholder’s available funds that follows an approved authorisation. Nothing has been paid to the merchant yet. Visa describes it the same way: with each successful authorisation, the issuer typically reduces the amount available to the cardholder for other purchases, and this is commonly known as an authorisation hold.
A hold is therefore not yet a charge. Until the transaction is captured, cleared and settled, the merchant holds an approval, not funds.
Cardholders usually see a hold as a “pending” transaction in their banking app. That is the bank’s label for an authorised transaction that has not cleared, and it should not be read across to a payment provider’s own status values. A platform’s pending status normally means a payment has been created but has not completed, not that a hold exists. The payment status API guide covers those states, and the payment glossary defines the terms used here.
Authorisation, pre-authorisation and final authorisation are different requests
Not every card authorisation works the same way. The request type depends on whether the final amount is known when the purchase starts.
Final authorisation
A final authorisation is used when the amount is already known, as in most online purchases. The issuer approves or declines that exact amount, and the transaction normally moves on towards capture and clearing without adjustment.
Pre-authorisation or estimated authorisation
A pre-authorisation, which Visa calls an estimated authorisation, is used when the final amount is not yet known. Typical examples include:
- hotel bookings, where extras are added during the stay;
- car rentals, where the total depends on duration and condition;
- deposits held against a booking or rented item;
- services whose value changes after ordering.
Visa requires an estimated authorisation to be a genuine estimate, not an arbitrary amount, and it must not include incidental amounts such as tips or a buffer for possible damage. Scheme rules allowing a request type do not mean every provider offers it: availability depends on the merchant’s acquirer or payment provider and on the payment flow it has approved.
Incremental authorisation
An incremental authorisation raises the amount already held when the cardholder spends more than estimated, for example when a hotel stay is extended. Under Visa’s rules, it does not extend the validity timeframe of the original estimated authorisation. Other schemes treat increments differently.
Authorisation vs capture: when the merchant actually gets paid
Authorisation reserves the cardholder’s funds. Capture moves the transaction towards clearing. Settlement is when funds are paid to the merchant, according to the provider’s or acquirer’s schedule.
A card payment moves through five stages:
- Authorisation: the issuer approves or declines the requested amount.
- Hold: the approved amount is reserved against the cardholder’s available balance.
- Capture: the transaction is submitted for collection, for an amount equal to or lower than the amount authorised.
- Clearing: the captured transaction is exchanged between acquirer and issuer, and the hold gives way to the posted transaction.
- Settlement: funds move to the merchant on the agreed schedule, net of fees and adjustments.
In most online payments, authorisation and capture happen in one flow; in a pre-authorisation flow they are deliberately apart. The full journey is covered in the checkout-to-settlement flow guide, and what happens after capture in payment settlement and merchant payouts.
How long an authorisation hold lasts
There is no universal hold period. Validity depends on the card scheme, the transaction type, the merchant category code (MCC), the region and the acquirer’s or provider’s setup.
For estimated authorisations, Visa’s merchant guidance sets these maximum timeframes:
Visa authorisation validity examples, as reviewed October 2026
| Transaction context | Maximum time from estimated authorisation approval |
|---|---|
| Lodging, vehicle rental and cruise line merchants | 30 days |
| Rental merchant categories | 10 days |
| Cardholder-initiated transactions, card absent | 10 days |
| Card-present transactions | 5 days |
The figures come from Visa’s guide to estimated and incremental authorisation and reversal processing, which states that the Visa Rules govern in any conflict. Scheme rules change and vary by region, so confirm them with the acquirer.
According to processor documentation, including Adyen’s guide to authorisation holds, a Mastercard pre-authorisation expires after 30 days and a final authorisation after 7 days. Providers may also apply shorter capture windows than the scheme maximum.
Three ways a hold ends: capture, release or expiry
An authorisation hold normally ends in one of three ways: the transaction is captured, the authorisation is actively reversed, or it is allowed to expire. The mechanics below describe card-network and processor behaviour in general, not the controls of a particular platform.
Capturing the full or partial amount
When the final amount matches the authorisation, the full amount is captured. When it is lower, such as a partly used deposit, only the actual amount should be captured and the rest released. For estimated authorisations, Visa requires that difference to be reversed within 24 hours of the transaction being completed. Some processors release the remainder automatically, as Stripe’s documentation on placing a hold describes.
Releasing or voiding an authorisation
If the merchant learns that the sale will not go ahead, the uncaptured authorisation should be released. Providers call this a reversal, a void or a cancellation. Under Visa’s guidance, the entire authorised amount must be reversed within 24 hours of the merchant becoming aware that the transaction will not be completed.
Letting the authorisation expire
Expiry is passive: the validity window runs out with no capture or reversal, and the issuer eventually makes the funds available again. Relying on it is worse than reversing: the customer’s balance stays reduced for longer.
It also creates scheme exposure. Visa assesses a Misuse of Authorization System Fee on approved authorisations that cannot be matched to a clearing transaction or a reversal. A capture submitted after the validity period, or an estimated authorisation coded incorrectly, can lead to dispute liability under Visa Dispute Condition 11.3 (No Authorization/Late Presentment). The chargeback representment guide explains how disputes are contested.
Releasing a hold is not a refund
A release removes an authorisation that was never captured; a refund returns money from a transaction that was. Neither is a chargeback, and neither is a rolling reserve.
| Event | When it happens | Who acts | What happens to customer funds | Is the payment already captured? |
|---|---|---|---|---|
| Authorisation release / reversal | Before capture, when the sale will not complete or the final amount is lower | Merchant or its provider | The reserved amount stops being held | No |
| Expiry | When the validity window ends without capture or reversal | Nobody: the authorisation lapses | The issuer eventually makes the funds available again | No |
| Refund | After capture, for a returned order or price adjustment | Merchant | A new credit is sent back to the card | Yes |
| Chargeback | After the transaction, when the cardholder disputes it | Cardholder, through the issuer | Funds may be returned under the dispute process | Yes |
| Rolling reserve | During settlement, as an account condition | Acquirer or provider | None: it affects the merchant’s payout | Yes, it applies to settled volume |
A payment that was only authorised should be released, not refunded. Reserve terms are covered in the settlement and payouts guide.
Where 3D Secure fits
3D Secure authentication happens before the authorisation request, when it is required. It confirms that the person paying is the legitimate cardholder but does not create a hold: the issuer then decides whether to approve the amount, and a payment can pass 3D Secure and still be declined. The 3D Secure and SCA guide covers authentication in detail.
When authorise-then-capture makes sense, and when it doesn’t
Separating authorisation from capture makes sense when the final amount, or the delivery of the service, is not settled at checkout. When the price is final and fulfilment is immediate, a single sale is usually simpler.
| Situation | Better fit |
|---|---|
| Final amount unknown at checkout (hotel stays, car rentals) | Pre-authorisation, then capture of the final amount |
| Deposit held against a booking or rented item | Pre-authorisation, then capture or release |
| Service delivered later, with a value that can change | Authorise first, capture on completion |
| Fixed price, immediate fulfilment | Immediate sale |
A separated flow adds work: tracking open authorisations, capturing in time and reversing unused amounts.
Some transaction types are excluded. Visa states that estimated and incremental authorisations are not permitted for Account Funding Transactions (AFTs), including cryptocurrency purchases, or for instalments, recurring transactions and advance payments. A pre-authorisation is a temporary hold on funds, not a recurring charge.
What changes, and what doesn’t, for high-risk merchants
Authorisation holds do not follow a separate set of rules simply because a merchant is classified as high risk. Scheme timeframes depend on the transaction type, the MCC and the use case, not on the merchant’s risk profile.
What differs is access and settlement. Underwriting decides whether a provider offers pre-authorisation at all, and settlement terms such as a rolling reserve are set at approval.
The two sit on opposite sides of the transaction. An authorisation hold sits on the cardholder side: it reduces the customer’s available balance until the transaction is captured, released or expires. A rolling reserve sits on the merchant settlement side: it withholds part of the merchant’s settled funds for an agreed period. A high-risk classification does not make holds last longer.
How Niftipay supports preauthorisation for approved flows
Niftipay Card Payments supports preauthorisations for approved payment flows such as hotel bookings, car rentals and deposits. Availability is confirmed during onboarding and is not enabled automatically for every merchant or industry. Terms, hold periods and completion rules depend on the approved merchant setup and card-network conditions.
Around that, Card Payments follows the standard flow:
- customers pay on a hosted Niftipay checkout;
- 3D Secure is applied when required by the issuer or the transaction;
- status updates reach the merchant’s systems by webhook, with statuses such as
pending,paid,cancelled,expiredandrefunded. These are standard payment statuses and should not be read as documented pre-authorisation, capture or release states; - full and partial refunds are issued after a payment has been taken, separately from releasing an uncaptured hold.
Operational completion and release steps should be confirmed during onboarding for the merchant’s approved setup. See the Niftipay Card Payments page for checkout, refunds and settlement.
Authorisation hold FAQs
How long does an authorization hold last?
There is no universal duration. It depends on the card scheme, transaction type, MCC, region and provider setup. For Visa estimated authorisations, limits range from 5 days for card-present transactions to 30 days for lodging, vehicle rental and cruise line merchants.
What happens if a payment is authorised but never captured?
It should be reversed once the sale will not complete; Visa expects this within 24 hours. Otherwise the hold expires, and lapsed authorisations or late captures can lead to scheme fees and late-presentment disputes.
Is an authorisation hold the same as a pending card payment?
Not exactly. A bank may show an authorised but uncleared transaction as “pending”, while a payment provider’s pending status usually means a payment has not yet completed. They are not interchangeable.
Is releasing an authorisation hold the same as giving a refund?
No. A release, or reversal, removes an authorisation before capture, so no money has been collected. A refund is a new credit issued after a payment has been captured.
Does every Niftipay merchant get pre-authorisation?
No. Preauthorisation is available only for approved payment flows, such as hotel bookings, car rentals and deposits, and must be confirmed during onboarding. It is not enabled automatically for every merchant or industry.