A credit card authorization form is a written document in which a cardholder gives a business permission to charge their credit or debit account when the card isn’t physically present. It records who authorized the charge, the amount, and whether the permission covers a single transaction or an ongoing series of them. That written record protects both sides: the merchant has proof of consent, and you have a clear record of exactly what you agreed to pay.
When These Forms Are Used
Authorization forms appear whenever a merchant needs to charge a card they can’t swipe, tap, or insert. Phone orders, mailed payments, and online purchases processed manually rather than through a checkout page are common examples. Hotels and car rental companies use them to place a hold for potential incidentals like minibar purchases or vehicle damage, reserving funds on your card before the final bill is known.
Recurring billing is the other major use. Gyms, subscription services, property managers, and utilities collect authorization forms so they can charge on a set schedule without asking for your card details each month. For ongoing arrangements, the form usually states the billing frequency, the amount or a cap on variable charges, and how long the authorization lasts.
One distinction matters here. When a recurring charge pulls from a bank account rather than a credit card, federal law requires the authorization to be in writing and signed by the account holder.1Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers Credit card recurring charges follow card network rules instead, though most merchants use the same written form regardless of payment type.
What Information the Form Collects
Expect the form to ask for the cardholder’s full name as printed on the card, the card brand, the full account number, and the expiration date. You’ll also provide the three- or four-digit security code, which serves as proof that you have the physical card in hand rather than just a stolen number.
Most forms request your billing address so the merchant can run an Address Verification Service check. AVS compares the numeric portions of the address you enter against what the card-issuing bank has on file. If the street number or zip code doesn’t match, the transaction can be flagged or declined.
The form should clearly say whether the charge is one-time or recurring. One-time charges list a specific dollar amount. Recurring or variable charges should include a stated maximum per billing cycle. The form should also identify the merchant’s name and contact information and describe the goods or services being paid for. If any of these details are missing or vague, ask questions before you sign.
Signing and Returning the Form
Your signature is what turns the form into a binding authorization, and it can be ink on paper or electronic. Under federal law, an electronic signature carries the same legal weight as a handwritten one for any transaction in interstate commerce.2Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity Many businesses use e-signature platforms that log a timestamp and IP address alongside your signature, which adds verification if a dispute comes up later.
How you return the form matters as much as how you fill it out. Sending unencrypted email with your full card number, expiration date, and security code is a serious risk. Anyone who intercepts that message has everything needed to use your card. Encrypted file-sharing services, secure online portals, and fax are safer options. If a business insists on receiving your details through regular email, treat that as a warning about how carefully it will handle your information later.
What Happens After You Submit
The merchant verifies the details against what the card network and issuing bank have on file. If the name, address, and account number check out, the merchant submits the charge through their payment processor. For a straightforward one-time charge, you’ll typically see it on your statement within one to three business days.
Hotels, car rental agencies, and some service providers don’t charge the full amount right away. They place an authorization hold, which temporarily reduces your available credit by a set amount. The hold shows as “pending” and either converts to a final charge or drops off. Hold durations vary by industry and card network, running from a few days for standard retail up to 31 days for hospitality and vehicle rentals.
For recurring billing, the merchant charges your card on the agreed dates without a new form each cycle. The original authorization covers every later charge, which is why the terms on the form matter so much before you sign. If the form says a gym can charge up to $100 per month and the gym starts billing $150, your signed form is evidence that the higher amount wasn’t authorized.
Signing doesn’t strip you of your right to dispute a charge. If a merchant bills you for an amount you didn’t agree to, keeps charging after you cancel, or delivers something that doesn’t match what was described, you can still dispute the transaction through your card issuer. The form proves you authorized a specific charge under specific terms. It doesn’t give the merchant a blank check.
How Merchants Must Handle Your Data
A completed form holds nearly everything a thief would need to commit fraud: your name, card number, expiration date, security code, and billing address. Merchants who accept card payments must follow the Payment Card Industry Data Security Standard, an industry framework for protecting cardholder data.
The Security Code Cannot Be Kept
One of the most important PCI DSS rules is that merchants cannot store your card’s security code after the transaction is authorized. This applies to paper forms as well as digital records. PCI DSS Requirement 3.2 prohibits retaining the CVV, CVC, or CID under any circumstances after authorization, even in encrypted form.3PCI Security Standards Council. FAQ: Can Card Verification Codes Be Stored for Card-on-File or Recurring Transactions For paper forms, the merchant must black out or physically remove the security code before filing the document. Even if you give permission to keep it, the standard still prohibits storage.
Storage and Access
Paper forms with card numbers must be kept in a locked, access-controlled location such as a safe or secured filing cabinet. Digital copies need encryption and restricted access. Card networks can impose substantial fines on merchants and their acquiring banks for PCI DSS violations, and a data breach can also trigger state notification requirements and civil liability.
Disposal
Federal law requires any business that possesses consumer information derived from credit reports to dispose of it properly when it’s no longer needed.4Office of the Law Revision Counsel. 15 USC 1681w – Disposal of Records Under the FTC’s implementing rule, “properly dispose” means taking reasonable measures so the information can’t be read or reconstructed. For paper authorization forms, that means shredding, burning, or pulverizing. For electronic records, it means destroying or erasing the media so the data is unrecoverable.5eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information Tossing an old form in the trash can violate federal law.
Canceling a Recurring Authorization
If you signed up for ongoing charges and want them to stop, your options depend on whether the money comes off a credit card or out of a bank account.
For charges pulled from a checking or savings account, Regulation E gives you a clear right to stop any future transfer by notifying your bank at least three business days before the next scheduled payment. You can do this orally or in writing. If you call the bank to stop the payment, the bank can require written confirmation within 14 days, and a verbal stop-payment order expires if you don’t send it.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers
For credit card recurring charges, no single federal regulation mirrors that stop-payment right. Contact the merchant directly and revoke authorization in writing. If charges keep coming after you cancel, contact your card issuer to dispute them. Most card issuers will also block a specific merchant from billing your account on request, though this is issuer policy rather than a federal requirement. Keep a copy of your cancellation notice. If the merchant later claims you never canceled, that written record is your proof.
Precautions Before You Sign
Authorization forms are routine, but handing over card details on paper or through a file carries more risk than swiping at a terminal. A few habits reduce the exposure:
- Verify the merchant before providing card details. If the form arrived by email, call the company using a number you find independently, not one printed on the form.
- Read the terms. Check the dollar amount, billing frequency, and cancellation policy. A form for variable billing that doesn’t specify a maximum gives the merchant more latitude than you probably intend.
- Don’t send card details over unencrypted email. If the merchant doesn’t offer a secure portal, encrypted file transfer, or fax option, ask for one.
- Keep a copy. Save or photograph the completed form before submitting it. If a billing dispute comes up months later, you’ll need to reference the exact terms.
- Watch your statements. Confirm the amount that posts matches what you authorized. Catching an overcharge early is far easier to resolve than finding one six months later.
Authorization forms exist because card-not-present transactions need a paper trail that a terminal would otherwise create. The form itself isn’t unusual. What matters is whether the terms match what you agreed to, whether the merchant handles your data responsibly, and whether you keep enough documentation to hold them to those terms.