Credit card authorization form: template and safe handling

A credit card authorization form is a document in which a cardholder gives your business permission to charge their card when they aren't there to pay in person. It names the cardholder and the card, sets the amount or the billing schedule, spells out the terms, and carries the customer's signature or electronic acceptance. Businesses use one for phone deposits, recurring bills, house accounts, and charges that come after the work is done.

The form itself is simple. Handling it is where businesses get into trouble, because a sheet of paper with a full card number on it is cardholder data, and PCI DSS has rules for that. This guide gives you a field-by-field template to copy, explains what to leave off it (the security code, every time), and covers storage, destruction, and what a signed form can and can't do in a chargeback. Rules are current as of October 2026.

What is a credit card authorization form used for?

Use one whenever you'll charge a card without the customer there to tap, dip, or type it in themselves. The usual cases:

• Deposits and balances taken over the phone, when you want the customer's agreement in writing and not just your memory of the call.
• Recurring charges, such as a monthly retainer, a maintenance plan, or a membership.
• Open-ended charges you can't price in advance: extra hours, damage, added guests, or a final balance after a job.
• Business customers who keep a card on file for repeat orders.
• Payments arranged by someone other than the cardholder, like an office manager booking on the owner's card.

What the form gives you is a record of who agreed, to what, and when. It doesn't run the charge. You still key the card into a virtual terminal or save it with your payment provider, and every one of those charges is a card-not-present sale with its own costs and fraud risks, which our guide to card-not-present transactions explains.

Credit card authorization form template

Copy these fields into your own document or online form. Leave out anything that doesn't apply to your business. Notice what isn't there: a box for the three- or four-digit security code. The next section explains why.

Here's a sample authorization statement you can adapt. Swap the bracketed parts for your own details:

Two details in that statement do a lot of work. The last four digits let the signed terms stay useful after you destroy the full card number. And a stated maximum, plus a clear way to cancel, is what you'll point to if a charge is ever questioned.

Should a credit card authorization form ask for the CVV?

No. According to the PCI Security Standards Council, PCI DSS strictly prohibits storing card verification codes after authorization, even if encrypted. A completed form in a filing cabinet is storage. So is a scanned PDF on a shared drive, or an email with the form attached.

The usual objection is that the first charge needs the code. If it does, take it live and let it go: key the card into your virtual terminal while the customer is on the phone, or send a payment link so they type the code in themselves. Later charges don't need it at all. PCI SSC's answer on stored cards is that the code isn't needed for card-on-file or recurring transactions, and storing it for those purposes is prohibited. Our CVV guide covers what the code check proves and what it doesn't.

How should you store a credit card authorization form?

Store as little card data as you can, for as short a time as you can. The safest authorization form is one that never holds a full card number.

If paper is unavoidable, PCI DSS v4.0.1 requirement 9.4.6 says hard-copy materials with cardholder data have to be destroyed when they're no longer needed for business or legal reasons, by cross-cut shredding, incineration, or pulping, so the data can't be reconstructed. Until then, the paper waits in a secure storage container. PCI SSC's guide for small merchants gives the same advice in plainer terms: shred card data you don't need, and if you must keep paper, black out the card data with a thick marker and lock it away.

How long can you keep it? PCI DSS doesn't set a fixed period. The Council's FAQ on retention says you need a data retention and disposal policy that limits storage to what your legal, regulatory, or business needs require. For most small businesses, the honest answer is "until the card is saved with the provider," which is usually minutes.

Here's a routine that works for a small office:

1. Receive the form in person or through your provider's secure page, not by plain email.
2. Save the card with your payment provider, or run the first charge, the same day.
3. Write the last four digits, the provider's customer or token reference, and the date on the form.
4. Black out or cut off the full card number, and cross-cut shred the strip.
5. File the signed terms, now without a card number, with the customer's records.
6. Complete the "destroyed" line in the office-use section.

If customers read their details to you on a recorded phone line, the recording counts too. Under PCI SSC's guidance on telephone payments, any sensitive authentication data a recording picks up has to be deleted. Our guide to payment tokenization explains how a provider-held token replaces the card number in your records.

Does a signed authorization form protect you from chargebacks?

It helps with some disputes and does little for others. Every chargeback carries a reason code, and each code calls for its own evidence, as our guide to chargeback reason codes lays out.

Where the form helps:

• Canceled recurring charges. Visa's dispute management guidelines tell merchants to cancel a recurring charge as soon as the customer asks and not to bill after a cancellation request. Your signed terms, plus proof that no cancellation arrived before the charge, are the core of your answer.
• Disagreements about the amount or the terms. The form shows what the customer agreed to pay, how often, and how to stop it.

Where it's weak: fraud. In a card-absent fraud dispute, the cardholder says they never made the purchase. A form completed by someone holding stolen card details looks just as signed as a real one. The card-absent fraud remedies in Visa's guide rest on data instead: an address verification "Y" match with the same billing and shipping address plus signed proof of delivery, a CVV2 "N" result the issuer approved anyway, authentication through Visa Secure, or Compelling Evidence 3.0 matches with the same customer's earlier undisputed purchases. Mastercard says merchants fighting a card-not-present fraud claim can submit the IP address of the device used for the purchase.

So keep the form, but don't treat it as a shield. Run address and security code checks on the first charge, save order data, and send a receipt every time. When the first charge runs online, Clearo's online payments add fraud screening with AVS, CVV checks, and velocity rules. Our guide to how a chargeback works walks through the whole dispute timeline.

What rules apply when you store a card for recurring charges?

Card network rules apply to every stored card, and federal rules add more for consumer debit cards.

Visa's framework for transactions with stored credentials requires cardholder consent before you store card details for future use, and requires the first storage and the later charges to be identified in the transaction data. Your gateway sets those flags. Your job is to get the consent and keep a record of it, which is exactly what the form does.

For debit cards, the CFPB's Regulation E covers preauthorized transfers from a consumer's account. They have to be authorized in a writing signed or similarly authenticated by the consumer, and electronic signatures count. A business can't satisfy the rule by signing for the customer after a verbal OK. The CFPB's commentary treats asking whether a card is debit or credit as generally a reasonable procedure, which is why the template asks.

Amounts that change need care. Under the same rule, when a recurring debit charge will differ from the previous one or from the authorized amount, the payee or the customer's bank has to send written notice of the amount and date at least 10 days before the transfer, unless the customer was offered and accepted a range of amounts.

Here's how that plays out. Say a landscaping company in Scottsdale signs 80 homeowners to a $145 monthly maintenance plan, or $11,600 a month. In spring, some months include extra cleanup. Writing "between $145 and $260 per month" on the form, and having customers accept that range, means a customer paying by debit card only needs advance notice when a bill falls outside it. Our recurring billing guide covers trials, reminders, and cancellation rules for subscription-style billing.

Paper form, payment link, or card on file: which should you use?

Use the form for the agreement, and keep the card number off it whenever you can. Here's how the three approaches compare:

A good hybrid looks like this. A catering company in Nashville books a wedding: it sends the contract with the authorization terms for e-signature, including a maximum for extra guests counted on the day, and collects the deposit through a payment link. If its provider lets it save the card from that payment with the customer's consent, it charges the final balance after the event and emails a receipt. Nobody in the office ever sees the card number.

If you take most of these payments over the phone, our guide to taking card payments on a phone covers the safest way to key them in.

Common credit card authorization form mistakes

• A box for the security code. Remove it from every version of the form.
• Asking customers to email or text a photo of the completed form or the card. Send a payment link instead.
• "Amount: as needed." Write a number or a maximum.
• Keeping the full card number after the card is saved with your provider.
• No way to cancel, or a cancellation method buried in fine print.
• Charging without sending a receipt, so the charge surprises the customer.
• Skipping address and security code checks on the first charge because the form is signed.
• Using a form for a customer who's standing in front of you. Tap or dip the card instead.

These are card network and PCI rules, so they apply the same way to businesses across the United States. If you also store cards, our explainer on what PCI compliance is shows where your forms fit in your annual self-assessment.

Next step

Clearo's virtual terminal handles phone payments, payment links, invoices, and recurring billing, so the card can go straight into the system instead of onto paper, and we offer PCI compliance support if you're cleaning up old forms. If you already take card-not-present payments, send us a recent statement for a free statement review and we'll show you what those keyed charges cost, or contact us to talk through a safer setup with a rep.