Authorisation
Also known as: Authorization, Auth
An authorisation is the card issuer's approval of a payment request. It is a yes or no on that card, for that amount, at that moment. It is not the transfer of money.
Last reviewed
Example
A guest hands over a card at hotel check-in. The hotel asks for an approval of €300 as a guarantee. The approval is granted. No money has moved, and the final bill may be €240.
Every card payment starts with a question. Will the bank behind this card say yes?
The card scheme rules define an authorisation as the process where an issuer, or someone acting for it, approves a transaction. The merchant's terminal or website sends the request to its acquirer. The acquirer passes it over the card scheme's network to the issuer. The answer travels back the same way.
An approval is a promise to pay, held against the cardholder's account. It is not a payment. The merchant has not been paid, and the cardholder has not yet been debited in the final sense. Money moves later, in capture and settlement.
An approval can also be cancelled. The scheme rules call that an authorisation reversal: a message that cancels an approval response. Restaurants, hotels and car rental desks lean on this because the final amount is not known at the start.
Two things merchants get wrong.
First, an approved payment is not a safe payment. The issuer said yes to the card, not to the person. A fraud claim can still come back as a chargeback.
Second, a declined payment is rarely a verdict on the customer. It may be a limit, a travel block, a missing authentication step or a bank being cautious. Asking for a second card is not an accusation.
For online payments in Europe, the approval often depends on strong customer authentication first. PSD2 requires it when a payer initiates an electronic payment, with limited exemptions.
Authorisation answers one question. Can this card pay? Everything after it answers a different one: will the merchant get the money?