How Long Can You Hold a Card Authorization Before Capturing?

An approved authorization is not a payment. It is a hold on the customer's available credit with an expiry date, and the card networks set that date. Capture inside it and the sale settles normally. Capture after it and you have a transaction the issuer can treat as unauthorized, a set of network fees your processor will pass along, and a customer who may be surprised to see a charge appear weeks after the pending line disappeared from their statement.

Most merchants never think about this because their gateway authorizes and captures in one step. It matters the moment you separate the two: fraud review, delayed shipping, pre-orders, deposits, or adjusting a total. This guide sets out the time limits in the Visa Core Rules and Visa Product and Service Rules dated 18 April 2026 and the Mastercard Transaction Processing Rules dated 9 December 2025, what happens when an authorization runs out, and how to extend or release one properly.

What an authorization hold is

When a customer pays, your gateway sends an authorization request to the card issuer. If the issuer approves, it typically reduces the cardholder's available funds by that amount. Visa's own merchant guidance calls this an authorization hold. No money has moved yet. Money moves when you capture the transaction and your acquirer submits it for clearing, and only then does the pending hold turn into a posted charge.

The time between approval and clearing is what the networks limit. Visa calls it the approval response validity timeframe, and the clock starts on the date of the valid authorization, not the date you meant to ship. Since 13 April 2024, Visa has used a single authorization-to-clearing timeframe in place of the separate validity and clearing windows it had before.

Visa's time limits

Visa's table of general approval response validity timeframes sets these maximums, measured from the date of the authorization:

• Cardholder-initiated transactions in a card-absent environment, such as a normal online or phone order: 10 calendar days.
• Cardholder-initiated card-absent transactions carrying an extended authorization indicator: 30 calendar days.
• Estimated authorizations at lodging, vehicle rental and cruise line merchants: 30 calendar days.
• Estimated authorizations at other rental merchants, including aircraft, boat, bicycle and e-scooter, equipment and tool, furniture, motor home and motorcycle rental, clothing and costume rental, and trailer parks and campgrounds: 10 calendar days.
• All other card-present transactions: 5 calendar days.
• All merchant-initiated transactions, which Visa says include installment, recurring, advance payment and unscheduled credential-on-file transactions: 5 calendar days.

Two rules sit on top of the table. First, an incremental authorization does not extend the window. If a hotel guest stays longer than the original estimated authorization can cover, Visa's merchant guidance says the authorization has to be reversed and a new one requested, which starts a new window. Second, every authorization has to be one of the types Visa recognizes, such as an authorization for the final amount, an estimated authorization or an incremental one, and an estimated authorization must be a genuine estimate. It cannot include a buffer for damage, theft or tips.

Extended authorization: 30 days, for a fee

The 30-day card-absent window comes from an optional Visa service, the Extended Authorization Service. It is available to cardholder-initiated card-not-present transactions, it is not applied automatically, and it costs money. Chargebacks911 reports a Visa fee of 0.08% of each approved authorization that uses it, and Stripe's documentation says it charges an additional 0.08% per transaction for extended authorizations outside lodging, vehicle rental and cruise. Stripe also lists exclusions: transactions with businesses in Japan and transactions related to healthcare, bill payment or debt repayment. If your fulfillment routinely runs past 10 days, ask your processor whether it supports the indicator and what it charges for it.

Mastercard's time limits

Mastercard sorts authorizations by how they are coded rather than by merchant type, and the coding sets the window.

• Preauthorization: Mastercard advises this coding when the amount is an estimate, or when the transaction might not be completed for reasons other than a technical failure. Its examples include a hotel checkout where the guest may pay another way and an order where the products might turn out to be out of stock. Clearing must be presented within 30 calendar days of the approval date.
• Final authorization: for the final amount, on a transaction not expected to be cancelled. Clearing must be presented within 7 calendar days, and the cleared amount must equal the authorized amount.

A third category, the undefined authorization, is gone. Mastercard's rules show it ending in the United States on 16 June 2025 and no longer applying in any region from 17 September 2025. If your gateway documentation still describes a 7-day undefined authorization, it is out of date.

Mastercard also does something Visa does not: it lets you extend a preauthorization after approval. A merchant can submit an additional preauthorization request for the same transaction, and if that request is for a zero amount, it extends the protection period without changing the authorized total. A request for more than zero both extends the period and adds that amount. If the period has already lapsed, the new preauthorization must be for the full amount. On Visa, once an authorization is approved, the only route to more time is reversing it and requesting a new one.

What happens when you capture late

The dispute

On Visa, late capture falls under dispute condition 11.3, No Authorization/Late Presentment. Before April 2024, Visa handled late presentment under a separate condition, 12.1. One of the reasons 11.3 lists is a valid authorization that was obtained but not processed within the timeframes above. The issuer has 75 calendar days from the processing date to file.

There is a limit on this dispute that matters for planning. Visa's documentation requirement for 11.3 is a certification by the issuer that, on the dispute processing date, the cardholder's account was flagged as a credit problem, closed or fraud. That means a late capture on a healthy account is not the main exposure under this condition. The exposure lands on the accounts most likely to cost you: a card that has been closed, or flagged as a credit problem or fraud, by the time the issuer files. Do not read it as permission to capture late. Visa's own merchant guidance warns that transactions not processed within the maximum timeframe can carry 11.3 dispute liability.

On Mastercard, the equivalent is message reason code 4808, the authorization-related chargeback. Each authorization type carries a 4808 protection period matching its window: 30 days for a preauthorization and 7 days for a final authorization on a purchase. When the period expires, the rules say the approved amount of that authorization is deemed to be zero, and the issuer must release any hold by then at the latest. A capture after that point is a capture without a live authorization behind it.

The fees

The networks also charge acquirers for authorizations that are never matched to a clearing or a reversal, and for clearings that have no authorization. Visa's merchant guidance names two: the Misuse of Authorization System fee, for approved authorizations that cannot be matched to a clearing transaction or a reversal, and an unmatched clearing fee, for clearing transactions with no matching approval. Mastercard charges Transaction Processing Excellence fees, which some statements label processing integrity fees, including one for final authorizations that are not cleared or reversed within 7 days, or that clear for a different amount.

Amounts vary by acquirer, and a processor may not pass them through at cost. As one published example, Wells Fargo Merchant Services' pass-through schedule effective 1 July 2026 lists the Visa misuse of authorization fee at $0.15, the Visa zero floor limit fee for unmatched clearings at $0.20, and the Mastercard final authorization fee at 0.25% with a $0.04 minimum. The same schedule shows a Mastercard preauthorization fee on approved credit-card preauthorizations, 0.0125% card-not-present with a $0.01 minimum. That is a reason not to code every order as a preauthorization just to get the longer window.

Release what you won't capture

A hold that is never captured should be reversed, not left to expire. The networks set deadlines for that too.

• Visa: when the final amount is less than what you authorized, reverse the difference within 24 hours of completing the transaction. When a transaction will not be completed, reverse the full amount within 24 hours of the earlier of the cancellation, the customer choosing to pay another way, or the end of the validity period.
• Mastercard: reverse within 24 hours of a cancellation, such as a voided sale or another form of payment, or of finalizing a transaction for less than was approved. A partial reversal is not required if you submit the clearing within 24 hours of finalizing. Since 1 July 2026, reversals must carry a response code saying why: 32 for a partial reversal, 06 for an authorization sent in error, or 17 for a customer cancellation.

Mastercard requires the issuer to release the held funds within 60 minutes of matching a reversal to the original authorization. A hold left to expire on its own can sit on the customer's account for the full window. That is how a customer ends up seeing a pending charge next to a posted one and calling it a double charge, and a customer who thinks they were billed twice is a customer who may call their bank.

Holding orders for fraud review

Separating authorization from capture is a standard fraud control for card-not-present merchants: approve the authorization, review the order, then capture or cancel. The windows above are the limit on how long that review can take. A Visa online order authorized without the extended indicator has 10 days, and a Mastercard final authorization has 7. A review queue that regularly runs longer than that is producing late captures.

Mastercard has a specific procedure for cancelling an approved card-not-present transaction you believe is fraudulent. You must decide within 72 hours of the original authorization request and send a full reversal carrying response code 34, Suspect Fraud. On Visa, a cancelled order falls under the general rule: reverse within 24 hours of deciding not to complete it.

Delayed shipments, pre-orders and custom work

Shipped goods add a rule about when you may charge. Visa says that for goods that are shipped, other than an advance payment, the transaction date must be on or after the date the goods ship, and it limits full advance payments to a short list of merchant categories, including custom goods and travel and entertainment. Our guide to the FTC Mail Order Rule and shipping delays covers those rules and the split-shipment exception in detail. The authorization question is what to do when the ship date is further out than the window:

• Ask for Visa's extended authorization indicator, which gives cardholder-initiated online orders 30 days for the fee described above.
• On Mastercard, code orders that may not ship, such as backorders, as preauthorizations, which the rules give 30 days and let you extend.
• Do not authorize the full amount at checkout at all. Visa allows an account verification to check a card, but it must be for zero and cannot be used to start a purchase. Charging later means storing the card, which needs the customer's consent under Visa's stored-credential rules. The later charge can still be declined.

Each option trades something: a fee, a coding change your gateway must support, or the risk that the card fails when you finally charge it.

Questions to ask your processor

• Which authorization type does the gateway send by default: a final authorization, a preauthorization or an estimated authorization?
• What capture window does the gateway itself enforce? Gateways can set their own limits inside the network maximum. Stripe's documentation, for example, says most networks' default online validity is 7 days.
• Is Visa's extended authorization available on the account, and at what price?
• Does the gateway send reversals automatically when an order is voided or captured for less, or does it let authorizations expire?
• Which network fees for unmatched authorizations and clearings are passed through, and at what markup?
• Can you report on authorizations that are approaching expiry, so a stalled order gets captured, re-authorized or reversed before the window closes?

For a high-risk merchant, whose acquirer already watches disputes closely, a 4808 or 11.3 chargeback is the kind that comes from your own processing rather than your customer, and the easiest kind to prevent. Network rules are revised regularly, so confirm current timeframes and fees with your processor before you redesign a capture flow around them.