Refund Authorization: Why a Credit Stalls and What Visa Requires

Refund authorization is a thing that exists, and most merchants have never thought about it. A credit carries an authorization request the same way a sale does. The issuer has to answer it, and Visa publishes what a good answer looks like.

The useful part is the numbers. Visa sets a minimum approval rate for credits at 99 percent, and it requires the cardholder to see the pending credit on the same clock as a purchase. Both are in Section 4.1.1.3 of the 18 April 2026 rules, and both give you something concrete to point at when a customer says the refund never arrived.

What the issuer has to do with a credit#

Section 4.1.1.3 (ID# 0029557) lists three obligations on the issuer for credit authorizations on returned purchases:

The second one is the answer to the most common refund complaint you will ever field. If a purchase appears in the banking app within seconds, the pending credit is supposed to appear on that same timeframe. It is not a courtesy and it is not best practice. It is a published requirement.

The third is a hard floor. A 99 percent minimum approval rate means a declined credit is meant to be rare, not routine. If you are seeing refund declines in any volume against one issuer, that is a reportable pattern rather than something to absorb.

One carve-out: the rule is optional for non-reloadable prepaid cards. So a gift card refund sits outside all three obligations, which is one more way prepaid authorization behaves differently from a credit or debit card.

From 1 April 2026 Visa can answer for the issuer#

This is the change worth knowing. The rule now ends with a line saying it does not apply if the issuer participates in the Merchant Return Authorization on Behalf of Stand-in Processing Service (ID# 0031199).

Stand-in processing, usually written STIP, is Visa answering an authorization when the issuer's own systems do not. Under this service Visa handles return authorizations on the issuer's behalf, and an issuer that signs up is excused from the three requirements above because Visa is doing the work.

For a merchant the practical effect runs the right way. An issuer whose authorization system is down or slow no longer leaves your credit hanging, because something still answers. What you lose is the ability to hold that issuer to the 99 percent floor, since the rule stops applying to it once Visa stands in.

You do not need the CVV2 to authorize a refund#

A small, genuinely useful detail that sits in a different chapter. Card-absent merchants normally have to capture the CVV2 and include it in the authorization request. That requirement carries a long exemption list, and "a Merchant Credit Transaction Authorization Request" is on it (ID# 0000675).

So a refund authorization does not require the security code. If your gateway or returns workflow asks a customer for a CVV2 before processing a return, that is your software's choice and not a rule, and it is friction you can remove. Our note on what you may and may not ask for covers the surrounding limits.

Where a declined credit leaves you#

If the credit authorization to the original payment credential comes back declined, the rules give you a defined route rather than a dead end. You may credit a secondary payment credential, or refund by other means entirely.

Those paths and their conditions are the subject of their own rule, and we covered the full ladder in refund timeframes and credit receipts. What matters here is the connection most people miss: your permission to refund another way is triggered by a declined authorization. The attempt is what unlocks the alternative, so skipping it leaves you without the condition the rule asks for.

Faster Refund is a separate thing#

The rules also mention Faster Refund as a way to deliver a credit transaction. It is not covered by the credit authorization rule above. A merchant choosing it must comply with the Visa Direct for Card Processing Guide instead, which is a separate document and a separate set of requirements.

Worth naming only so you do not assume the 99 percent floor and the same-timeframe visibility rule travel with it. They sit in the issuance rule, not in Visa Direct.

What to do with this#

Three things, and none of them require a project:

1. When a customer says a refund has not arrived, check whether it was authorized and approved before you check anything else. An approved credit should already be visible to them.
2. If one issuer declines credits repeatedly, raise it with your acquirer against the 99 percent floor rather than treating it as normal.
3. Strip any CVV2 prompt out of your returns flow. It is not required for a credit and it costs you completed refunds.