The QuickBooks credit card authorization form is generated automatically when you create a recurring sales receipt in QuickBooks Online. You don’t download it as a standalone template. You build the recurring transaction, save it, and QuickBooks produces a form pre-formatted to meet Visa and Mastercard requirements for written cardholder authorization.1Intuit. Set Up a Recurring Sales Receipt From there you print it, fill in the merchant details, and get the customer’s signature before running the first charge.
Visa and Mastercard both require written authorization from the cardholder before you process the first recurring payment.2Intuit. Get Authorization for a Recurring Credit Card Payment Without a signed copy on file, you have little defense if a customer later disputes a charge.
Generating the Form in QuickBooks
The form is tied to the recurring sales receipt feature, so the setup produces both the billing schedule and the authorization document in one flow.
- Step 1: Go to All Apps, then Accounting, then Recurring Transactions.
- Step 2: Select New, choose Sales Receipt as the transaction type, and select OK.
- Step 3: Enter a template name, then choose Scheduled from the Type dropdown.
- Step 4: Select the customer’s name, set the billing interval, enter the start date, and choose when the billing should end.
- Step 5: From the Payment Method dropdown, select the credit card type and enter the customer’s card details.
- Step 6: Enter the product or service line and the amount, then select Save Template.
When you save the template, a link to the authorization form appears. Download and print it.1Intuit. Set Up a Recurring Sales Receipt
Filling In the Merchant Sections
The template already includes the language Visa and Mastercard expect, so you don’t need to add boilerplate. What you do need to complete are the specifics of the arrangement.
Business and Transaction Details
Enter your business name exactly as it will appear on the customer’s credit card statement. A mismatch here is one of the most common triggers for chargebacks: a customer sees an unfamiliar name on their statement, assumes fraud, and files a dispute before contacting you.
For recurring billing, specify the amount per cycle, the billing frequency (weekly, monthly, quarterly), the start date, and whether the agreement runs for a set period or continues until the customer cancels. For a one-time charge, state the exact dollar amount, the processing date, and a brief description of what the charge covers. Vague terms invite disputes. A customer who signed a form authorizing “$150 per month for website hosting beginning March 1” is far less likely to file a chargeback than one who signed a form that just says “recurring charges.”
Cardholder Fields
The customer fills in their full legal name as it appears on the card, the billing address (street and ZIP code at minimum), a phone number or email, the card type, the full card number, and the expiration date. The billing address matters because your payment processor uses it for Address Verification Service checks against what the card-issuing bank has on file.3Authorize.net Support Center. What Is Address Verification Service (AVS) and How To Use and Configure It A mismatch can flag the transaction or cause it to decline.
What the Form Should Not Ask For
The QuickBooks-generated template does not include a CVV field, and you should not add one. PCI DSS Requirement 3.2 prohibits merchants from storing card verification codes (CVV, CVC2, CID) after a transaction has been authorized, and that prohibition applies even if the customer gives you permission to keep it.4PCI Security Standards Council. FAQ – Can Card Verification Codes Be Stored for Card-on-File or Recurring Transactions Encrypting it doesn’t help. The code has to be completely removed from your systems once the transaction is authorized. A signed form with a CVV written on it, sitting in a filing cabinet, is a PCI violation every day it’s there.
PCI DSS Requirement 3.3 also limits how much of the account number you can display or store after authorization: no more than the first six and last four digits.5PCI Security Standards Council. PCI DSS Quick Reference Guide
Getting the Signature
Deliver the completed form to the customer for signature, printed name, and date. The signature is what turns the form from a data-collection sheet into binding authorization.
You don’t have to collect a wet-ink signature on paper. Under the Electronic Signatures in Global and National Commerce Act, a signature or contract can’t be denied legal effect solely because it’s in electronic form.6Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity For the electronic signature to hold up, the customer must show intent to sign, consent to doing business electronically, and have the ability to access and retain the electronic record.7Federal Deposit Insurance Corporation. Electronic Signatures in Global and National Commerce Act
In practice, use a legitimate e-signature platform that logs the signer’s IP address, timestamp, and consent. Typing a name in an email is not enough. QuickBooks integrates with several e-signature services, or you can use a standalone tool and attach the signed PDF to the customer’s profile. Whatever method you choose, the system has to be able to reproduce the signed record accurately if you ever need it for a dispute.
Storing the Signed Form
Intuit’s guidance is to keep the signed form for at least 18 months after the final charge takes place.2Intuit. Get Authorization for a Recurring Credit Card Payment That window aligns with the timeframe card networks allow for certain dispute types. If you process the last recurring charge in January, the form needs to be retrievable through at least the following July. Some businesses keep them longer as a precaution.
Physical copies belong in a locked filing cabinet with access limited to employees who have a legitimate need to handle payment records. Digital copies should be encrypted and password-protected. PCI DSS applies to stored cardholder data in any format, paper or electronic, so leaving signed forms in an open desk drawer or an unprotected shared drive creates a compliance violation. Within QuickBooks, updating the customer’s profile to note that a signed authorization is on file helps your team confirm coverage before processing future charges.
When a Customer Cancels
Visa requires that you provide a simple cancellation procedure. If the customer originally signed up online, you must offer at least an online cancellation method.8Visa. Visa Core Rules and Visa Product and Service Rules Once a customer revokes their authorization, stop billing promptly. Continuing to charge a card after cancellation is one of the fastest ways to trigger chargebacks you will not win.
In QuickBooks, go back to the Recurring Transactions list, open the template, and either delete it or change its status to inactive. Keep the original signed authorization form on file for the full 18-month retention period after the last charge, even after cancellation. You may still need it if the customer disputes one of the earlier charges.
Why the Form Matters if a Dispute Comes
Chargeback fees from your acquiring bank or payment processor typically range from $20 to $100 per dispute, and those fees apply whether you win or lose. A signed authorization form won’t prevent every chargeback, but it gives you the documentation to fight back through the representment process. When you receive a dispute notification, submit a legible copy of the signed form along with any delivery confirmation or correspondence. Visa’s guidelines treat a signed order form as relevant evidence for mail and phone order transactions, and if the cardholder claims they never authorized the charge, a signed form with matching details is among the strongest pieces of compelling evidence you can submit.9Visa. Dispute Management Guidelines for Visa Merchants Without that documentation, disputes often resolve in the customer’s favor by default.
Failing to maintain PCI DSS compliance carries a separate risk. Card networks can impose monthly fines that escalate the longer you remain non-compliant, and repeated violations or a data breach can lead to permanent termination of your merchant account. Using the QuickBooks-generated form, keeping CVV codes off it, and storing signed copies securely handle most of what you need to stay on the right side of those requirements.