Card Authorization

Card authorization is the process in which a merchant requests and receives an approval or decline for a card transaction, usually from the card issuer through an acquirer, processor, and payment network. Approval confirms the issuer’s decision at that time; it is not final settlement and does not guarantee that the merchant will keep the funds.

Key Takeaways

• Authorization occurs before capture, clearing, settlement, and final account posting.
• The issuer evaluates the card or credential, available funds or credit, limits, and risk controls.
• Approval can create an authorization hold against available funds or credit.
• A decline does not necessarily mean the account is empty; card status, limits, fraud controls, data errors, or connectivity can also matter.
• Authentication and authorization are related but different: one evaluates identity or credentials, while the other decides whether the transaction may proceed.
• An authorization code is evidence of a response, not proof of settlement or immunity from a later dispute.

How Card Authorization Works

    flowchart LR
	    C["Cardholder"] --> M["Merchant terminal or gateway"]
	    M --> A["Processor or acquirer"]
	    A --> N["Payment network"]
	    N --> I["Card issuer"]
	    I -->|"Approval, decline, or other response"| N
	    N --> A
	    A --> M

1. The cardholder presents a card, token, or card details to a merchant.
2. The merchant’s terminal or gateway creates an authorization request with the amount and transaction data.
3. A payment processor or acquiring bank routes the request through the relevant network.
4. The issuer checks account status, available funds or credit, card controls, and risk indicators.
5. The issuer returns an approval, decline, or another supported response.
6. If approved, the merchant later captures the final amount and submits it for clearing and settlement.

The exact message path differs by payment arrangement. A gateway, processor, payment facilitator, acquirer, network, and issuer may be separate entities or may perform overlapping roles.

Authorization vs. Related Steps

These steps can occur close together, but they should not be treated as synonyms.

Worked Example: Authorization and Reduced Capture

Suppose an online merchant requests authorization for a $75 order. The issuer approves the request, but before shipment the merchant discovers that one $15 item is unavailable. The merchant captures only $60 and follows the applicable payment process for releasing or reversing the unused authorization amount.

The unused amount is $75 - $60 = $15. The cardholder may still see a $75 pending amount temporarily because the authorization display and the final posting do not necessarily update at the same time. This example also shows why an approval code is not evidence that $75 settled.

Common Authorization Outcomes

• Approval: the issuer permits the requested transaction at that time.
• Decline: the issuer does not approve it under the current account, data, or risk conditions.
• Partial approval: the issuer approves less than the requested amount where the product and merchant support it.
• Referral or additional action: the response may require another procedure under applicable network or issuer rules.
• Timeout or unavailable response: a system or communications problem prevents a normal response.

Merchants should follow the actual response and acceptance rules rather than guessing why a transaction failed or repeatedly resubmitting it without a valid basis.

What Authorization Does Not Prove

An approval does not prove that:

• the customer personally initiated the transaction
• all merchant acceptance rules were followed
• goods or services were delivered as agreed
• the captured amount will match the approved amount
• the issuer cannot reverse, reject, or dispute later processing
• settlement has occurred
• the transaction is free from fraud or chargeback risk

The merchant should retain the authorization response with the receipt, order record, authentication evidence, capture record, and fulfillment evidence appropriate to the transaction.

Risks and Controls

• incorrect amount, currency, or merchant data
• duplicate requests or repeated retries
• expired or stale approvals
• capture that exceeds or otherwise mismatches the approved amount
• card-not-present fraud or compromised credentials
• offline acceptance without current issuer approval
• system outages and ambiguous timeouts
• failure to reverse unused approvals
• weak reconciliation between authorization and settlement files

Controls can include transaction identifiers, duplicate detection, response-code handling, amount matching, expiry monitoring, velocity rules, fraud screening, and reconciliation.

How to Review an Authorization

1. Match the request and response using the transaction identifier.
2. Confirm merchant, amount, currency, timestamp, and card-present status.
3. Identify the issuer, network, processor, and acquirer roles.
4. Check the response code and approval identifier.
5. Compare authorized, captured, cleared, settled, and posted amounts.
6. Review reversals, voids, retries, partial approvals, and exceptions.
7. Preserve authentication, order, receipt, and fulfillment evidence.

Official Resources

• The PCI Security Standards Council glossary defines payment-card authorization and distinguishes it from authentication and access-control authorization.
• The CFPB explanation of declined credit-card authorization describes the issuer approval step in a U.S. consumer context.
• Federal Reserve Regulation II definitions identify issuer, acquirer, processor, merchant, and network roles for U.S. electronic debit transactions.

This article provides general financial education, not personalized payment, legal, fraud, or compliance advice. Authorization effects depend on the card product, network rules, merchant agreement, facts, and jurisdiction.

FAQs

Related Terms

• Authorization Hold: Temporary restriction on available funds or credit after approval.
• Acquiring Bank: Merchant-side institution that supports acceptance and settlement.
• Floor Limit: Threshold used in certain card-acceptance decisions about online authorization.
• Void Transaction: Cancellation before a transaction completes settlement.