A credit card authorization form for third-party payments is a written permission slip: the cardholder signs a document letting a business charge their account for goods or services delivered to someone else. The form has to identify the cardholder, name the person receiving the benefit, spell out exactly what’s being paid for, and carry a signature. Get those pieces right and the charge holds up. Leave them vague and the cardholder can dispute it with almost no resistance from the bank.
When You Actually Need One
The classic case is a hotel stay booked by someone who won’t be at check-in. A parent pays for an adult child’s room. A company pays for an employee’s travel. Healthcare providers use the same form when one family member covers another’s out-of-pocket bill. Corporate purchasing departments use it when an executive’s card covers conference registrations, event fees, or equipment for staff.
The common thread: the person presenting the card at the counter, or the person receiving the service, is not the person whose name is on the account. The merchant needs a paper trail linking the two. Without one, the cardholder can call their bank, deny the charge, and win. Skipping the form is extending credit on trust alone.
What the Form Must Contain
A workable authorization form collects enough to verify who the cardholder is and pins down what they’re agreeing to pay. At minimum:
- Cardholder’s full legal name, exactly as it appears on the account.
- Complete billing address, including the zip code tied to the card, which the merchant will run through address verification.
- Card number and expiration date.
- Card verification code (three digits on the back of Visa and Mastercard, four on the front of American Express), collected for the initial authorization only.
- Name of the third-party beneficiary who will actually receive the goods or services.
- The specific charges authorized: a fixed dollar amount, or a clear description of the services with a cap on the total.
- A consent statement and a signature, dated.
The consent statement is the piece that decides disputes. It should say, in plain language, that the signer authorizes the named business to charge their credit card for the benefit of a specific person, for specific services, up to a stated amount. Vague wording invites chargebacks. “Miscellaneous charges” is much easier to dispute than “five nights at $350 per night plus incidentals up to $250.”
The Rule About the Security Code
Merchants can ask for the card verification code to run the first transaction. They cannot keep it afterward. PCI DSS Requirement 3.2 prohibits storing the code once the transaction is authorized, and the prohibition holds even if the cardholder gives permission or the code is encrypted or hashed. Only the card-issuing bank has a legitimate reason to retain it.1PCI Security Standards Council. FAQ: Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions For a recurring arrangement, the code goes with the first charge and never again.
One-Time Charges Versus Recurring Payments
A one-time form covers a single transaction or a defined set of charges over a set period, like a hotel stay. Once the stay ends and the charges post, the authorization is spent.
Recurring arrangements need more on the page: the billing frequency, the amount of each charge or the formula if it varies, the start date, and how the cardholder cancels. Mastercard requires merchants running recurring billing to send an electronic receipt after each approved charge, and that receipt must include cancellation instructions. For promotional trials longer than seven days, the merchant has to send a reminder three to seven days before the first regular billing date.2Mastercard. Revised Standards for Subscription/Recurring Payments and Negative Option Billing Merchants
These disclosures are mandatory for merchants flagged for excessive chargebacks or fraud and recommended for everyone else. A recurring form that lays out the billing terms and cancellation path also gives the merchant a much stronger position if a charge is later disputed.
Sending and Verifying the Form
A completed form contains everything a fraudster needs: full card number, expiration, billing address, and a signature. Emailing it as a plain attachment is one of the most common mistakes. PCI security standards require cardholder data in transit to move over connections using Transport Layer Security (TLS) 1.2 or higher.3PCI Security Standards Council. PCI Security Standards In practice, that means an encrypted portal, a secure online form, or at minimum a secure fax line. A merchant asking for a photo of your credit card in email is telling you something about their overall security posture.
Address Verification
When the merchant submits the transaction, they run the billing address through the Address Verification Service (AVS). AVS checks the street address and zip code from your form against the records held by the card-issuing bank. The response indicates whether both match, one matches, or neither does. A mismatch doesn’t automatically block the charge, but it pushes fraud liability onto the merchant if the cardholder later disputes.
Confirming Identity
Many merchants also ask for a copy of the cardholder’s government-issued photo ID with the form. The point is to confirm that the person signing is the account holder, not someone with stolen card details. Hotels are especially strict because the cardholder, by definition, isn’t at check-in. Matching the signature on the form to the ID and matching the name on the ID to the name on the card account closes the most obvious gap.
The Cardholder’s Rights After Signing
Credit card transactions are protected by the Fair Credit Billing Act, part of the Truth in Lending Act. A cardholder who spots an unauthorized charge or a billing error has 60 days from the date the statement was sent to notify the issuer in writing.4Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The issuer must acknowledge the notice within 30 days and resolve the dispute within two complete billing cycles, no longer than 90 days.5eCFR. 12 CFR 1026.13 – Billing Error Resolution
Federal law caps a cardholder’s liability for unauthorized use at $50, and even that cap applies only if the issuer met conditions like providing a way to identify authorized users and giving adequate notice of potential liability.6Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers waive the $50 through zero-liability policies. Cardholders also have the right to assert claims against the issuer for problems with the underlying transaction, such as undelivered goods, if the charge exceeded $50 and the transaction happened in the cardholder’s home state or within 100 miles of the billing address.7Office of the Law Revision Counsel. 15 USC 1666i – Assertion by Cardholder Against Card Issuer of Claims and Defenses
One boundary worth naming: these rules cover credit cards. Debit cards and ACH transfers fall under the Electronic Fund Transfer Act and Regulation E, which have different timelines, liability caps, and procedures.8Office of the Law Revision Counsel. 15 USC Chapter 41, Subchapter VI – Electronic Fund Transfers If you’re authorizing a credit card for someone else’s use, your protections come from the FCBA and Regulation Z.
Revoking an Authorization
A cardholder can revoke authorization at any time by notifying the merchant in writing. For a one-time charge that has already posted, revocation is moot. For a recurring arrangement, the written cancellation should identify which charges are being stopped and request written confirmation that billing has ended. Keep copies of everything.
If the merchant keeps charging after receiving cancellation, there are two paths. First, dispute the charges with the card issuer as unauthorized under the FCBA billing-error procedures; the 60-day clock starts when the statement carrying the unauthorized charge is sent.4Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Second, ask the issuer to block future charges from that merchant. Debit cards get a formal three-business-day stop-payment right for preauthorized transfers under Regulation E,9eCFR. 12 CFR 1005.10 – Preauthorized Transfers but credit card stop-payment is handled through the card network and issuer rather than by federal regulation. Most issuers will accommodate the request; the specific process varies.
The Merchant’s Obligations After the Form Is Signed
The signed form is the merchant’s basic defense against a chargeback. Without it, there’s almost no way to prove the cardholder agreed. With a completed form showing signature, specific amounts, and the named beneficiary, the merchant has real evidence in the dispute process.
Retention rules set how long that evidence has to stick around. Mastercard requires acquirers to keep transaction records at least 13 months, longer if applicable law demands it.10Mastercard. Transaction Processing Rules Visa requires acquirers and payment facilitators to hold merchant records, including investigation documents, for at least two years after the merchant agreement ends.11Visa. Visa Core Rules and Visa Product and Service Rules Businesses accepting credit cards also have to retain gross-receipts documentation for tax purposes as long as it may be relevant to a return.12Internal Revenue Service. What Kind of Records Should I Keep
During the retention period, forms have to be secured. PCI DSS Requirement 3 covers protection of stored cardholder data: locked filing cabinets with restricted access for paper, encrypted storage with access controls and audit logs for digital.13PCI Security Standards Council. PCI Data Storage Dos and Donts When forms are no longer needed, PCI DSS Requirement 9.4.6 says hard-copy materials with cardholder data must be cross-cut shredded, incinerated, or pulped so the data can’t be reconstructed. Until destruction, they belong in secure containers that block unauthorized physical access. Dropping a form with a full card number into an office recycling bin is the kind of lapse that produces a breach.
Fraud Red Flags on a Third-Party Form
Because the cardholder isn’t in the room, third-party forms attract fraud. Warning signs worth checking against:
- The billing address on the form doesn’t match what AVS returns, or the shipping address sits in a completely different region from the billing address.
- The person submitting the form pushes hard for immediate processing or expedited service.
- Several different card numbers arrive on successive forms for the same transaction.
- The supposed cardholder resists sending a photo ID, or sends one that doesn’t match the card details.
- The form arrives from a disposable or recently created email address.
Any single item can have an innocent explanation. Two or three together are a reason to slow the transaction down and verify directly with the cardholder before the charge goes through.