Credit card
authorization
forms.

01 / The distinction that matters

What is a credit card authorization form?

A credit card authorization form records a cardholder’s permission for a business to charge an identified payment method under stated terms. It connects the customer, the purchase, the amount and the timing. For recurring payments, it also describes the agreed schedule and how the customer can cancel future payment permission.

The useful question is not simply, “Did someone sign?” It is, “Can our team explain exactly what this customer agreed to, and does the payment we are about to run match that agreement?” A clear form makes that answer easier to find.

Customer permission, issuer authorization and capture are different

Authorization holds have validity windows. The payment provider’s workflow must handle capture or release appropriately; keeping a signed PDF does not keep a bank authorization alive. [10]

02 / Build a useful record

What should a credit card authorization form include?

Use a form that someone outside the original conversation can understand. Replace vague wording such as “all charges owed” with a description that lets the customer and your staff identify the payment.

• The business receiving payment. Include the merchant name, business address and a working contact method.
• The person giving permission. Record the cardholder’s name and contact information needed to administer this arrangement.
• The purchase. Identify the goods or services and a useful invoice, order or agreement reference.
• The amount and currency. State an exact total for a one-time payment or an exact amount per payment for this fixed recurring template.
• The timing. Define the charge date or agreed trigger. For recurring payments, include the first payment date, frequency and end condition.
• A safe payment reference. Use the last four digits and a non-secret internal record reference to connect the permission to the correct provider-held credential.
• The applicable policies. Make cancellation, refund and change-notice terms available before consent. Identify the version the customer received.
• The consent record. Preserve the completed terms, signature or approved electronic acceptance evidence, and date.

Visa’s stored-credential rules call for informed agreement covering the transaction, merchant details and intended future use. Requirements depend on the arrangement; an unscheduled charge is not the same as a monthly subscription. [1]

What we deliberately leave out

These templates do not request the full card number, security code, expiration date or a photograph of the card. They reference a payment method collected separately. A reference must not be a secret, access credential or reusable payment token that would let its holder initiate a charge.

Keep the permission record focused. It does not need a Social Security number, bank login, unrelated identification documents or a detailed medical history. Collecting more information does not automatically make permission clearer.

03 / From download to daily workflow

How to use the templates without creating a pile of card data

1. Choose the arrangement before editing the form

Use the one-time PDF or editable Word document for one specified payment. Use the fixed recurring version for the same amount on an agreed schedule. If the price changes with usage, covers unknown incidentals or follows a trial, start with your provider’s tailored flow instead.

2. Complete the merchant terms before requesting consent

Add your business details, the purchase description and the payment terms. Resolve blanks rather than leaving staff to fill them later. Have your processor and appropriate adviser review the finished version for your business model, location and customer base. A downloadable template is a starting point, not a universal agreement.

3. Collect the card through the payment provider

Use a provider-supported hosted payment or setup page, approved terminal or other suitable secure collection method. Let that system handle the credential. Then associate its non-secret record reference with the completed permission document. Do not turn an ordinary contact form, shared spreadsheet or inbox into a card vault.

4. Give the customer the terms they actually accepted

Keep a completed copy and provide one to the customer through your approved communication process. Name the service clearly. A monthly website maintenance payment should say that, rather than “professional services.” Clear wording helps the customer recognize the charge later.

5. Match the payment setup to the agreement

A customer actively approving a payment and a merchant initiating a later agreed charge are different payment situations. Ask your provider to configure saved-card and recurring processing correctly. A signature on a PDF does not set the appropriate transaction indicators. Stripe’s documentation, for example, distinguishes permission for future checkout use from permission for payments when the customer is absent. [9]

6. Make cancellation and changes operational

Assign a person or queue to cancellation requests. Record when a request arrives, confirm its effective date and update the billing system. Do not rely on someone remembering to remove a customer from a spreadsheet. Changes to the arrangement should be reviewed and communicated through the applicable consent and notice process.

04 / Match permission to the payment

One-time vs. recurring credit card authorization

A one-time permission is not a standing instruction to charge the card whenever another invoice appears. Likewise, a fixed monthly amount does not silently authorize additional purchases, price increases or damage charges.

For a recurring arrangement, write down when billing starts and how it ends. “$149 monthly” leaves unanswered questions: which day, for which service, for how long and through which cancellation method? Those are customer-experience decisions as well as payment-operations decisions.

Mastercard’s subscription standards address prominent price and frequency disclosures, affirmative acceptance, confirmation and accessible cancellation information, with defined applicability and exceptions. Trial offers and certain billing schedules add further requirements. Confirm the rules for your program instead of treating a generic form as the complete subscription system. [2]

For businesses building that system, our subscription payment processing guide connects the billing model to the merchant account and operational requirements.

05 / Where the details change

Examples for service businesses, hotels and medical offices

Professional services and invoice payments

A design studio could identify one approved invoice and its exact amount. The permission record can link that invoice to a provider-held card reference. Future project work needs its own payment authority; it should not be added to the earlier amount merely because a card remains on file. This example illustrates document design, not an actual NUMUS client result.

Hotels and third-party reservations

The guest and the cardholder may be different people. A useful workflow distinguishes room and tax, a prepaid reservation, a deposit, incidentals and cancellation or no-show terms. Our basic download is not a blanket hotel authorization for unknown future charges. Ask the provider for a lodging-specific arrangement, then review hotel credit card processing for the broader payment journey.

Medical and dental offices

Patient, responsible party and cardholder can also differ. Keep payment permission separate from clinical consent and avoid placing diagnosis or treatment details in a general payment record. A balance after insurance is not automatically a fixed recurring amount. See our guides to medical office payment processing and dental merchant services when choosing the underlying workflow.

Memberships and retainers

A defined monthly service is a stronger fit for the fixed recurring template. Specify what is included, the billing date and the end condition. If a customer purchases an extra service, document that additional payment separately rather than assuming the standing permission covers it.

06 / Keep permission. Minimize exposure.

Card data security: what merchants need to get right

Never retain the security code after authorization

PCI SSC states that CVV, CVC and equivalent card verification codes must not be stored after authorization, even if encrypted or the customer agrees. They are not needed for recurring or card-on-file transactions. Secure collection before a particular authorization is a different issue; these downloadable records omit the field entirely. [3]

Do not invite full card numbers into ordinary email

PCI DSS prohibits sending unprotected primary account numbers through email, SMS, chat and similar messaging. [4] That is not a blanket statement that every protected messaging channel is forbidden. A channel used for cardholder data must meet applicable requirements, and the related systems can come into PCI scope. [5]

If someone unexpectedly emails card details, follow your approved incident-handling procedure promptly. Avoid forwarding the message or replying with the sensitive content quoted below. PCI SSC advises preventing further exposure and either securely removing the data or protecting the channel within the cardholder-data environment. [11]

Give records an owner and a retention policy

Restrict access to the people who need the permission record. Maintain a usable history of versions and cancellation actions. PCI DSS does not specify one universal retention period for cardholder data: storage must be limited to justified legal, regulatory or business needs, with secure disposal when no longer required. Set document retention with your acquirer and advisers, including any applicable dispute or recordkeeping obligations. [6]

Using a hosted payment provider can reduce the data your team handles. It does not remove your responsibility to assess the provider, understand shared responsibilities and meet your applicable PCI validation obligations. A PDF template cannot certify that an entire business is PCI compliant. [7]

07 / Build a record you can explain

Does an authorization form prevent chargebacks?

No. A completed form can help show what was agreed, but it does not prove that every disputed transaction was valid. The relevant evidence depends on the dispute: permission, delivery, service quality, cancellation and duplicate billing are different questions.

For each payment, make it possible to retrieve the agreed terms, the corresponding invoice, the processor transaction reference and the relevant fulfillment or communication records. Keep this evidence accurate and limited to what is relevant. A signature does not establish that goods arrived or that a subscription was stopped on time.

Visa’s dispute guidance emphasizes matching evidence to the specific claim. For cancelled recurring transactions, it calls for clear cancellation records, written confirmation of the effective date and stopping billing after that date. [8]

Do not add a sweeping “no chargebacks allowed” sentence and assume it removes cardholder rights. When a balance remains after payment permission is withdrawn, resolve the balance through the appropriate contractual and payment process with your adviser or acquirer.

Review patterns as well as individual cases. Our chargeback ratio and provider questions guide can help frame that conversation without treating one document as the answer to every dispute.

08 / Practical answers

Credit card authorization form FAQs

Are the NUMUS credit card authorization templates free?

Yes. The download section includes one-time and fixed recurring PDFs, with editable Word versions. Customize the business terms and have the completed documents reviewed for your use case. They are designed to record permission for a payment method collected separately.

Can I charge a card using this form alone?

No. These forms contain no full card number or security code. You need an approved payment-processing account and a provider-supported way to collect the credential and submit the transaction. See our merchant accounts guide for how those pieces fit together.

Should a credit card authorization form include CVV?

Not as a retained permission record. PCI SSC prohibits keeping that code after authorization. The NUMUS templates exclude it. If your provider requests it securely for a particular transaction, follow that payment flow without copying the code into the document. [3]

Does a signature guarantee payment or win a dispute?

No. The issuer can decline the payment, and a cardholder can raise a dispute. A form supports the record of agreement; it does not establish every fact about identity, delivery, cancellation or the transaction itself. Respond using evidence relevant to the actual claim. [8]

Can I use the recurring template for changing monthly amounts?

No. This particular download is for a fixed amount and schedule. Usage-based billing, unknown balances and other variable arrangements need tailored disclosures and a suitable provider workflow. Do not change the template’s amount field to “any amount owed” and treat that as sufficient consent.

Is a typed name the same as a verified digital signature?

No. Entering a name in a PDF does not by itself verify who entered it or create an identity-checked audit trail. Use the consent or signing process accepted by your provider and suitable for your business. Ask qualified counsel about enforceability where needed; the download makes no universal legal claim.

How long should I keep completed authorization forms?

Use a documented retention schedule informed by your acquirer, applicable recordkeeping obligations and genuine business needs. PCI DSS does not supply a universal number of months or years for cardholder-data storage. Protect retained records and dispose of them securely when the justified period ends. [6]

Is the NMS application where my customers authorize card charges?

No. NMS.io/app is the merchant processing application for your business. It is not a cardholder checkout or authorization collection page. Apply there to discuss your processing needs; use your approved payment provider’s flow for customers’ card details.