What Is an Authorization Hold? Time Limits, Tips and Reversals for Merchants

How an Authorization Hold Works

An authorization hold is the amount a card issuer sets aside when it approves a sale, before the merchant has collected any money. Visa gives a hotel 30 days to turn that hold into a charge and most card-present sales 5, and both Visa and Mastercard expect you to release what you won't collect within 24 hours.

The hold starts with an authorization: your terminal or payment gateway asks the issuer to approve an amount, and the issuer cuts the cardholder's available credit or balance by that amount. Visa's merchant guide calls that reduction an authorization hold.

The hold is not the payment. Money moves later, when you capture the transaction (usually by closing your batch) and it clears and settles. The other way out is a reversal, which tells the issuer to drop the hold.

The gap matters when the final amount isn't known up front: hotels, rental counters, bar tabs, tipped checks, fuel pumps, and some salons and contractors.

Don't confuse the hold with a credit card authorization form, the signed document that lets you charge a card later. They often travel together.

Seeing an Authorization Hold on Your Own Card?

A pending charge bigger than what you spent is usually a hold, not the final charge. Hotels, rental counters and gas pumps often authorize an estimate first. The final charge replaces the hold once the merchant captures the real amount, and any excess should drop off, but the timing depends on the merchant sending a reversal and on your bank. On a debit card the hold ties up money in your checking account, not just credit, and the CFPB has warned that a pay-at-the-pump pre-authorization on a prepaid debit card can take up to 10 business days to be released. Ask the merchant first, since it can reverse an unused hold, then call your bank.

Pre-Authorization, Estimated and Incremental Authorizations

Both networks let you authorize an estimate and adjust it later. The names differ:

Estimated authorizations and pre-authorization holds

Visa's rules say an estimated authorization must be "a genuine estimation" of what the cardholder will spend. You must tell the cardholder the estimated amount and that more authorizations may follow, in writing or verbally. The estimate can't include amounts for potential damage, theft, other delayed charges, insurance premiums or tips.

Mastercard advises coding a request as a preauthorization when you're asking for an estimated amount, or when the sale might not be completed for reasons other than a technical failure, such as a hotel guest or rental customer who may pay another way at checkout. Vehicle rental merchants must disclose the authorization amount before the customer signs, and can't include an insurance deductible or damage amount in it.

Incremental authorizations

When a stay or a tab runs past the estimate, send an incremental authorization for the extra amount instead of starting over. Visa requires the incremental indicator and the same transaction identifier as the original estimate, and puts no cap on how many you send within the validity window. Mastercard lets lodging, cruise and vehicle rental merchants request additional authorizations as needed.

But under Visa's rules an incremental does not extend the clock, as the hotel example below shows.

Tip Adjustments and Authorization Holds at Restaurants and Bars

The classic restaurant flow authorizes the check, adds the tip, then captures the higher total. Visa's rule is that cleared and authorized amounts must match unless its tolerance table allows a difference.

In the US, effective February 21, 2026, that table allows up to 30% for caterers, restaurants and fast food restaurants (MCC 5811, 5812 and 5814). Bars and nightclubs (MCC 5813), beauty and barber shops (7230), health and beauty spas (7298) and taxis (4121) get up to 20%. After a partial approval, the amounts must match exactly. Your merchant category code decides which limit you get.

Mastercard, for US cards at US merchants, allows a tip to be added after authorization on key-entered, magnetic stripe and chip-and-signature card-present sales, and on card-not-present restaurant sales under MCC 5812 or 5814, up to 30% of the authorized amount. A bigger tip needs an incremental authorization if the original was coded as a preauthorization. For chip-and-PIN, contactless and QR sales, or anything coded as a final authorization, the tip must be in the authorization amount and can't be added afterward.

Worked example: the same $20 tip at a restaurant and a bar

The dollar amounts are illustrative; the percentages are the ones above.

A restaurant (MCC 5812) authorizes an $80 check on a Visa card, and the guest adds a $20 tip. The $100 total is 25% over the authorization. The restaurant may clear up to 30% over, or $104, so the $100 is inside the tolerance.

Run the same $80 tab and $20 tip at a bar coded MCC 5813. The bar's limit is 20%, so the most it can clear is $96. The $100 total is $4 outside Visa's tolerance.

On a Mastercard it depends on how the card was read. Swiped or keyed, the $20 tip is within 30%. Tapped, it can't be added after authorization at all.

At a bar or restaurant, taking the tip on screen before the card is authorized keeps you inside both networks' rules. If servers tap first and tip-adjust later, ask your processor how your terminals handle it.

How Long Does an Authorization Hold Last?

There are two clocks, and merchants often confuse them.

The first clock is how long you have to capture. Visa counts it from the date of the authorization. Under Visa's rules (April 2026 edition):

Under Mastercard's Transaction Processing Rules (June 9, 2026), a transaction on a preauthorization must be presented for clearing within 30 calendar days of approval. A final authorization must be presented within seven calendar days, for exactly the authorized amount.

The second clock is when the customer's money comes back. That's up to the issuer, but Mastercard sets an outer limit: the issuer must release any hold once the authorization's protection period expires, at the latest. That's 30 calendar days for a preauthorization and seven for a final authorization on a purchase. Visa's public rules set no equivalent release deadline for issuers, which is why Visa pushes merchants to reverse promptly instead of letting holds age out.

Hotel authorization hold: a stay from estimate to final charge

A fictional inn books a guest for three nights at $160 a night, taxes included. The rate is illustrative; the rules are Visa's.

The $480 carries no damage or minibar cushion. Many hotels still add a flat incidental deposit at check-in, but Visa's merchant guide says an estimated authorization must not contain incidental spend amounts such as tips or a buffer for damage. If your property management system adds one, ask your processor how it is coded. The October 7 incremental raised the amount but not the deadline. On a Mastercard, the partial reversal isn't required if the inn clears the $640 within 24 hours of checkout.

Stretch the booking to 40 nights and the Visa window still closes around November 4, so Visa's guide says to reverse the original authorization and request a new one. Mastercard instead lets you extend the protection period with an additional preauthorization for the same transaction.

Visa's tolerance table also lets lodging and cruise lines clear up to 15% over the authorization (vehicle rental: the greater of 15% or $75). On $800, that's $120: room for a late room-service charge, not two extra nights at $320. For hotels, base the estimate on the room rate, taxes and nights booked.

Gas Station Authorization Holds

Fuel pumps authorize before anyone knows how much fuel will go in, so both networks have separate rules for US automated fuel dispensers.

Visa lets a US pump use a status check authorization, a $1 request that counts as an authorization for up to $175 ($1,000 on a Visa Fleet card), or an initial authorization for an amount not exceeding $500 ($1,000 for Visa Fleet). Neither can be followed by an incremental authorization. The final amount must go to the issuer as soon as possible and no later than 2 hours after fueling is done.

Mastercard says the pump's first request must be a preauthorization for a maximum fuel amount, an amount the customer selects, or, in the US only, $1. Issuers are advised to hold up to $175 for most cards (up to $500 for certain corporate and fleet cards). The final amount must reach the issuer no later than 60 minutes after the pump's first request, and the issuer must then release any excess within 60 minutes of receiving it. If no fuel is dispensed, a zero-amount advice or full reversal is due within 60 minutes. Mastercard recommends showing the estimated amount in advance, on screen or on a pump sticker.

For example, a driver with a Visa debit card pumps $48 and finishes at 7:10 a.m. With a status check, the authorization counts for up to $175. With an initial authorization, the pump could ask for as much as $500 of that driver's checking balance. Either way, the completion telling the issuer the real number is $48 is due by 9:10 a.m. That matters to the driver: the CFPB has warned prepaid debit cardholders that a pay-at-the-pump pre-authorization can be greater than the purchase and may take up to 10 business days to be released.

How to Release an Authorization Hold You Won't Use

Both networks require reversals within 24 hours:

• Visa: if the final amount is less than what you authorized, reverse the difference within 24 hours of completing the transaction. If the sale never happens, reverse the full amount within 24 hours of the cancellation (or of the customer deciding to pay another way), or by the end of the validity period, whichever comes first.
• Mastercard: reverse within 24 hours of canceling a previously authorized sale (for example, a voided sale or the customer paying another way) or of finalizing a sale for less than was approved. A partial reversal isn't required if you submit the clearing message within 24 hours of finalizing.

Skipping reversals can cost you directly. Visa assesses a Misuse of Authorization System Fee on approved authorizations that can't be matched to a cleared transaction or a reversal, and names $1.00 "test transactions" used instead of its Account Verification Service as a common cause. It charges a separate fee on transactions that clear without a matching authorization. Visa's public documents omit the amounts, so ask your processor whether they appear on your statement, and under what name.

Worked example: a rental nobody reverses

A fictional tool-rental counter takes a $150 estimated authorization on a customer's Visa debit card on Friday, October 2, 2026. The customer returns the tool Saturday morning and pays cash.

The reversal is due within 24 hours, by Sunday morning, October 4. Say nobody sends it. The customer paid cash and still sees $150 pending in checking, which reads as a double charge.

Visa's window for an equipment rental estimate is 10 calendar days, so the authorization expires around October 12 with nothing matched to it, which is exactly what the Misuse of Authorization System Fee targets. Meanwhile the customer waits on the bank. Had it been a Mastercard preauthorization, the issuer's outer limit would be the 30-day protection period, around November 1.

Sending the reversal on Saturday avoids both problems.

Why Bad Holds Turn Into Complaints and Chargebacks

Visa's merchant guide says that when authorizations aren't settled or matched properly, funds can stay held longer or be held twice, and cardholders read that as an extra charge by the merchant. So when a customer calls about a pending amount bigger than what they spent, check whether your reversal went out. Without one, the customer waits on the bank, and on a debit card that's money in checking, not credit.

There's a direct dispute risk too. Visa's guide warns of chargebacks under Dispute Condition 11.3 (No Authorization/Late Presentment) when estimated and incremental authorizations are coded wrong, such as a missing estimated or incremental indicator, mismatched transaction identifiers, or a transaction processed after the maximum timeframe. Mastercard's equivalent is reason code 4808, tied to the protection periods above. See what is a chargeback, how to win a chargeback and, for approval problems, credit card decline codes.

Authorization Hold Best Practices for Merchants

1. Authorize a genuine estimate. No cushion for damage, incidentals or tips on Visa estimated authorizations.
2. Tell the customer the hold amount and that more authorizations may follow, on the registration card, rental agreement, tab slip or pump sticker.
3. Check your coding. Ask your processor to confirm your system sends the estimated and incremental indicators with one transaction identifier.
4. Capture inside the window. Close your batch daily rather than letting open tabs and folios age toward the 5-day or 30-day limit.
5. Reverse within 24 hours. Void unused authorizations and partially reverse when the final bill comes in lower.
6. Stop using $1 test charges to check cards. Use an account verification request instead.

This is general information, not legal advice. Card network rules change often, and your acquirer's agreement may add requirements on top of them.

To see how your holds, reversals and batch timing show up in your fees, send us a recent statement for a free statement review. You can also look up any unfamiliar term in our payments glossary.

Sources

• Visa, "Visa Core Rules and Visa Product and Service Rules," 18 April 2026 edition (sections 5.7.2.4-5.7.3.6 and 7.5.6), observed September 2026.
• Visa, "Estimated and Incremental Authorization and Reversal Processing Requirements for Visa Merchants" (2024), observed September 2026.
• Mastercard, "Transaction Processing Rules," 9 June 2026 (sections 2.5-2.11, 3.3.1, 4.10.1, and United States Region modifications), observed September 2026.
• Consumer Financial Protection Bureau, "How to use your Economic Impact Payment prepaid debit card without paying a fee", observed September 2026.