Layer 1 copy

The Authorization and Billing Cycle

When a customer orders a tablet online, a lot of unseen steps occur between clicking "Submit Order" and that merchandise arriving on a doorstep.

In addition to the customer and the merchant, there are a number of other parties involved in any transaction. Here are some of the key players that are essential to every online purchase:

The Players

First, when the customer clicks "Submit Order," the merchant passes the customer's payment information to the payment gateway. A payment gateway, as its name implies, directs a merchant's financial traffic to several different destinations, beginning the validation process and fleshing out that information where appropriate.

A payment processor then receives the information, which relays outbound authorization requests to the card association. The card association communicates with the issuing bank . Some of these players may be one in the same; for instance, it's possible that your arrangement is such that your gateway communicates directly with American Express, acting as its own processor, card association, and issuing bank all at once. However, this consolidation doesn't have an impact on the overall flow of the transaction.


As a merchant, the first thing that you do when your site receives a new order is to submit an authorization request. Merchants can complete authorizations in several different ways: The simplest method is to authorize for the full amount of purchase upfront - if a purchase is $50 after taxes and shipping, the merchant would request an authorization for $50. Other merchants perform a partial authorization for some portion of the purchase - frequently just a single dollar or single cent. Still other merchants perform a zero-dollar authorization, where purchase authorization checks occur, but no money is set aside.

Full Amount
Partial Authorization
Zero Dollar Authorization

Regardless of the authorization amount, once a payment request arrives at the issuing bank (through the players outlined above), the bank sends back several pieces of information. First, they send a status code indicating approval or rejection of the request, as well as reasoning. These codes can vary by bank, and payment gateways are tasked with correctly interpreting these codes. A request might be declined due to insufficient funds, or because the card submitted doesn't exist in the bank's records, or for several other reasons.

The other information that can come back with the authorization status code is dependent on the merchant's preferences, but generally merchants will request a CVV response. This response indicates whether the customer correctly entered a few digits (3 on the back of the card for Visa and MasterCard, 4 on the front for American Express). This acts as a security measure, because in theory only the cardholder should know those digits. Additionally, the merchant may receive an AVS response if they requested it. This response contains a few pieces of information, primarily indicating whether the street address and postal code provided by the customer each match the bank's records.

A merchant can process an order even if the AVS and CVV responses are negative! Many won't, but they're allowed to, although they may not have some fraud protections they might otherwise. The authorization itself, though, is mandatory - if that fails, there's no way to try to bill the customer anyway.

The Difference Between the Authorization Hold and Billing

So once the merchant has successfully obtained an authorization for the amount of the what? What does that mean? Before turning over the purchase funds to the merchant, the bank sets aside the customer's money (seen online as a pending change) so those funds are unavailable to the customer. While you have authorization to bill for that amount, you cannot bill until you actually ship the order! This rule applies to all online merchants as part of accepting orders online.

Although you may be authorized to bill a customer, you cannot legally do so until the order is shipped out!

What if something happens to cancel a customer's order after authorization but before shipment? Authorization holds are generally valid for five to 30 days, depending on the processor and card association. Until the authorization hold falls off, the money remains on hold. For this reason, merchants must be careful about authorization to keep their customers happy!

Once the merchant ships the goods, they can use a valid authorization to bill the customer. You send a message out through the gateway requesting that a certain amount be billed against the authorization, whether zero, partial, or the full amount. This step can fail as well; for instance, if the authorization is not valid for the amount the merchant tries to bill against it, billing will not go through. If it succeeds, though, the issuing bank transfers the money to the merchant's acquiring bank, which then transfers the money into the merchant's own bank account.

Issuing BankMerchant's acquiring bank

Once the product has been shipped and the authorization succeeds, the customer's issuing bank will start transferring money over.

What if the customer needs that money back, though?

There are two ways that the money could go back out from the merchant's account to the customer's account at the issuing bank: a refund or a chargeback.

In the case of a refund, the merchant sends out a request that's identical to the billing request, but with a negative amount and no need for the authorization to still be valid. The merchant is able to refund up to the amount originally billed.

Chargebacks are more complicated, but we've done our best to explain them in their own article.

That's it!

That covers the basics of authorization, billing refunds and chargebacks! The particulars can change, and merchants can have a big impact on customer experience depending on how they arrange these steps and communicate them to customers. If you have questions about anything here, feel free to drop us a line!