Offline credit card processing is the fallback your point-of-sale terminal uses when it loses its connection to the payment processor: the terminal captures the card data locally, holds it in an encrypted queue, and submits it for authorization once the connection returns. No bank has approved the charge at the moment of sale. You’ve handed over the goods on a promise, and if that promise fails after the fact, the loss is almost always yours.
How Store-and-Forward Works
When the terminal can’t reach the processor, store-and-forward takes over. The device records the card number, expiration date, amount, and a local tracking reference, then holds the transaction in a pending state until connectivity returns. No funds move. The cardholder’s bank hasn’t seen the charge, so there’s no way to know whether the card has sufficient funds, has been reported stolen, or is even active.
Storage capacity varies by terminal model. Some devices cap the number of transactions they can hold locally, so an extended outage can fill the queue. Check your terminal’s specifications before you need to rely on offline mode. A busy Saturday afternoon is the wrong time to discover a storage limit.
Why the Floor Limit Is Usually Zero
A floor limit is the maximum dollar amount a terminal will accept for an offline transaction without obtaining real-time authorization. In the magnetic-stripe era, generous floor limits let small sales skip authorization entirely. That’s not how modern chip terminals work in the United States.
Visa’s terminal configuration requirements specify a floor limit of zero, which forces every EMV transaction to attempt online authorization first.1Visa. Visa Minimum US Online Only Terminal Configuration When the host connection isn’t available, the card and terminal fall back to what Visa calls a “Deferred Authorization,” which is store-and-forward under a different name. The transaction gets queued locally not because it fell under a generous threshold, but because the terminal couldn’t reach the processor at all.
You don’t get to decide that purchases under $50 can skip authorization. The terminal tries to go online for every sale and only stores the transaction when the connection fails. Visa’s rules also require merchants to check the Card Recovery Bulletin for any transaction processed below the floor limit, which flags cards reported lost or stolen.2Visa. Visa Core Rules and Visa Product and Service Rules
Voice Authorization as the Backup to the Backup
When a terminal tells you it can’t process a transaction through store-and-forward, you can still complete the sale by calling your processor’s voice authorization line. You dial the number your processor provided, enter your merchant identification number, give the card number, expiration date, and transaction amount, and wait for an approval or decline. If approved, you write the authorization code on the receipt or enter it into the terminal.
That code is the point. It serves as proof the issuing bank approved the charge, which matters if the transaction is later disputed. Without it, you have almost no defense against a chargeback. Voice authorization is slower and more manual than regular processing, but it shifts some of the risk back toward the issuing bank, because the bank has actively chosen to approve. For a high-dollar sale during an outage, the extra few minutes on the phone are worth it.
Deadlines for Uploading Queued Transactions
Offline transactions don’t wait forever. Square, for example, expires pending offline payments 72 hours after the start of the offline session and recommends uploading within 24 hours to reduce declines and chargebacks. Expired payments can’t be retrieved or reprocessed. Other processors set similar windows, some as short as 24 hours.
Restore your connection as fast as you can. Every hour a transaction sits in the queue is another hour the cardholder could cancel their card, overdraw the account, or report the charge as unauthorized. The sooner you upload, the higher the approval rate. Treat offline mode as a short emergency bridge, not a daylong workaround.
What Happens When a Stored Transaction Declines
Once connectivity returns, the terminal transmits queued transactions to your processor. Some systems do this automatically; others require you to trigger a batch upload manually. Each transaction is evaluated individually, and you’ll get an approval or decline response for every record.
Declines are the unavoidable cost of offline processing. Some cards will have been maxed out, canceled, or flagged between the time you accepted the sale and the time the processor tried to authorize it. When a stored transaction is declined, the money doesn’t come to you. The goods are already out the door, so you’re left trying to collect from the customer directly.
Your post-upload report will flag which transactions failed. Contact the customer promptly, explain that the charge didn’t go through, and ask for an alternative payment method. Don’t run the same card repeatedly. If it declines twice, request a different card. Keeping a log of customer contact information for offline sales makes follow-up far easier than digging through receipts.
Who Bears the Loss
When you accept a transaction without real-time authorization, you take on nearly all the financial risk. The cardholder’s bank never approved the charge, so the bank has no obligation to honor it. If the card turns out to be stolen, the account empty, or the cardholder disputes the charge, the loss falls on you.3Federal Reserve. Offline Payments: Implications for Reliability and Resiliency in Digital Payment Systems
American Express makes this explicit: transactions submitted without authorization due to connectivity loss are subject to chargeback, offset, and withholding at American Express’s discretion.4American Express. Merchant Regulations – International The other major networks operate under similar principles. From a liability standpoint, an offline transaction is one of the riskiest card payments a merchant can accept.
Double spending compounds the problem. A fraudster who knows terminals are offline can use the same card at multiple merchants before any of them upload their queued transactions. Each merchant thinks they have a valid sale, but when the batches hit the processor, the account may only cover one. The Federal Reserve identifies double spending as one of the biggest risks in offline payment scenarios and notes that merchants “typically bear the loss.”3Federal Reserve. Offline Payments: Implications for Reliability and Resiliency in Digital Payment Systems
PCI Rules That Still Apply Offline
The Payment Card Industry Data Security Standard requires all stored cardholder data to remain encrypted, and that applies to the offline queue just as much as to your back-office systems. Encryption isn’t optional during an outage. The data sits on a local device longer than usual without passing through a secure processing environment, so the risk is higher, not lower.
One rule catches merchants off guard. You are never allowed to store the three-digit security code from the back of the card (CVV, CVC, or CID) after authorization, even in encrypted form.5PCI Security Standards Council. PCI DSS Quick Reference Guide The same prohibition covers full magnetic stripe data and PIN data. Your offline queue should never retain the security code as part of a stored transaction record. If your system captures it during the card read, it has to be purged before the record enters the queue. The data flows differently in offline mode than in a standard real-time transaction, and the security code can easily end up stored where it shouldn’t be.
How to Keep the Risk Manageable
Offline processing should be a last resort, not a routine operating mode. A few habits keep the exposure contained:
- Set a low internal dollar cap. Even if the terminal technically accepts any amount offline, configure it to reject sales above a figure you can afford to lose. Offline mode works best for smaller tickets where an occasional decline won’t hurt.
- Restore connectivity fast. Switch to a mobile hotspot, tether to a phone, or call your internet provider. Treat the outage as urgent.
- Verify the physical card. Check that it isn’t visibly damaged, that the name matches ID if available, and that the expiration date hasn’t passed. These are checks the terminal would normally handle automatically.
- Log customer contact information on larger offline sales. If the charge later declines, you’ll need a way to reach the buyer.
- Track your queue total. The Federal Reserve recommends declining further offline payments once the cumulative total exceeds a threshold you’ve set in advance. Pick a number you could absorb as a total write-off, and stop accepting offline transactions once you approach it.3Federal Reserve. Offline Payments: Implications for Reliability and Resiliency in Digital Payment Systems
- Use voice authorization for big sales. The extra time on the phone puts the issuing bank on record as approving the charge.
Offline mode exists so you don’t have to turn customers away during a temporary outage. Used cautiously and for short windows, it keeps your business running. Used carelessly or for extended periods, it creates losses no processor or card network is going to cover for you.