Authorisation (Payment Authorisation)

Authorisation is the step in a card transaction where the issuing bank confirms that a cardholder has sufficient funds or credit available and approves the transaction to proceed.

What Is Payment Authorisation?

Authorisation happens in real time, typically within a second or two, whenever a customer attempts to pay. It doesn't move money itself; instead, it confirms the transaction is valid and places a hold on the funds, with the actual transfer of money happening later during clearing and settlement.

How Authorisation Works

When a payment is submitted, the payment gateway forwards the request through the acquiring processor to the relevant card network, which routes it to the card issuer. The issuer checks the account for available funds or credit, runs its own fraud checks, and returns an approval, decline, or a request for further authentication, such as 3D Secure. See the architecture of a payment gateway for the full step-by-step flow.

Benefits of Optimising Authorisation

Authorisation is the single point where most declines happen, making it the main lever for improving approval rates. Understanding decline codes, retry behaviour and how authentication requirements like smart 3D Secure affect approval outcomes helps merchants recover revenue that would otherwise be lost to unnecessary declines.

Authorisation and Pre-Authorisation

Authorisation should not be confused with pre-authorisation, which reserves funds without capturing them, commonly used by hotels and car rental companies. Both rely on the same underlying issuer approval process, but differ in when the funds are actually captured.

Common Authorisation Decline Reasons

Authorisation declines fall broadly into two categories: hard declines, such as a stolen or closed card, which won't succeed no matter how many times they're retried, and soft declines, such as a temporary issuer system error or insufficient funds, which may succeed on a later attempt. Reading and categorising decline codes correctly is essential to handling each type appropriately, since retrying a hard decline wastes processing attempts and can even increase fraud scrutiny, while failing to retry a soft decline leaves recoverable revenue on the table. Many merchants build automated logic that routes soft declines for an intelligent retry, sometimes through an alternative acquirer, while hard declines are surfaced to the customer immediately.