Authorization Reversals and the 24 Hour Rule

If you authorize a card and then don't complete the sale, or complete it for less than you authorized, you have to submit an authorization reversal within 24 hours. It isn't optional and it isn't a courtesy. It's the rule, with a deadline attached.

This is the answer to the support ticket that starts "why is there still a pending charge on my card." Usually the answer is that nobody reversed the authorization, and the hold is sitting there until the issuer drops it on its own schedule.

The rule, in two cases#

A merchant must submit an authorization reversal in two situations, and the amount differs.

The sale completed for less than you authorized. Reverse the difference between the final transaction amount and the sum of the authorized amounts. Due within 24 hours of transaction completion.

The sale didn't complete at all. Reverse the authorized amount or amounts. Due within 24 hours of the earlier of two events: when the transaction was cancelled or the cardholder decided to pay another way, or the end of the approval response validity period.

That second clock is the one people miss. If a customer abandons a checkout, you don't get to wait for the approval to expire on its own. The 24 hours start when they walked away.

How long an approval stays valid#

The outer bound matters because it's the backstop on that second case. The rules set maximum processing timeframes by transaction type:

• Card-absent, cardholder-initiated, with an extended authorization indicator: 30 calendar days
• Card-absent, cardholder-initiated: 10 calendar days
• Estimated authorization for cruise line, lodging or vehicle rental merchants: 30 calendar days
• Estimated authorization for other rental categories, including aircraft, boat, equipment, furniture, motorcycle and motor home rental, and trailer parks: 10 calendar days
• All other card-present transactions: 5 calendar days

So a typical ecommerce authorization is good for 10 calendar days. If the order never ships and nothing else triggers the clock, you have 24 hours from the end of that window to reverse. Waiting the full 10 days and then doing nothing is a rule breach, not just poor service.

The 15 second timeout floor#

There's a separate rule that catches automated checkouts. An acquirer or a merchant must not time out a POS transaction in less than 15 seconds. It doesn't apply in the Europe Region (ID# 0030580).

And the part that follows from it: if you receive an approval response after you've already timed out, you must submit an authorization reversal.

That pairs badly with aggressive gateway timeouts. A checkout configured to give up at 8 seconds will sometimes abandon a transaction the issuer then approves, and every one of those becomes a hold on a customer's card for an order you never took. The rule requires you to clean it up, and the 15 second floor exists to stop you creating the situation in the first place.

Incremental authorizations reverse as one, conditionally#

If you've stacked incremental authorizations on a single sale, you can reverse multiple authorized amounts with a single authorization reversal. There's one condition: you must use the same transaction identifier across all the authorization requests and the reversal.

Different identifiers mean separate reversals. Worth checking how your gateway handles that before you rely on one call to release everything.

You cannot resubmit a transaction that came back#

A different rule, related in spirit. A merchant must not submit a transaction to the acquirer that was previously disputed and subsequently returned to the merchant (ID# 0003022).

You may still pursue payment from the customer outside the Visa system. Invoice them, use a different method, send it to collections if that's your process. What you can't do is push the same transaction back through the card rails after it came back to you as a chargeback.

That's worth knowing because retry logic built for soft declines will happily re-run anything, and a returned disputed transaction is exactly the thing it must not touch.

What to check in your own stack#

Four things, all answerable by your processor or your own logs.

• Do you reverse on abandoned checkouts? Most systems reverse on refund and on partial capture. Far fewer reverse when a customer simply leaves, which is the case the rules name explicitly.
• What is your gateway timeout set to? If it's under 15 seconds, it's below the floor, and it's generating post-timeout approvals you're then obliged to reverse.
• Do post-timeout approvals get reversed automatically? This is the failure that produces mystery holds, because the order doesn't exist in your system at all.
• Does your retry logic exclude previously disputed transactions? A dispute that came back to you is out of scope for resubmission.

Reversals are also the mirror image of refund timing. A refund returns money already taken. A reversal releases money never taken, and it's faster, cheaper and less visible to the customer if you do it inside the window.

Source: Visa Core Rules and Visa Product and Service Rules, 18 April 2026.