Charter Credit Card Authorization Form: What It Proves and What It Can't

On this page 7 sections

1. Why Charter Bookings Need Their Own Authorization Form
2. What to Put on a Charter Credit Card Authorization Form
3. Why a Signed Form Alone Won't Win a Fraud Chargeback
4. Verify the Cardholder Through Contacts You Find Yourself
5. Keep Card Numbers Out of Inboxes and Fax Trays
6. Tie the Payment to the Passenger Manifest
7. Build the Dispute File Before Wheels Up

Key takeaways

• A signed form helps most when the cardholder argues about an amount or a cancellation fee. On card-absent fraud claims, 3-D Secure results and Visa CE 3.0 data count for more.
• A card keyed into a virtual terminal during a phone call has no authentication result, so it can't get the 3-D Secure fraud liability shift. Send first-time clients a hosted payment link.
• Repeat clients who pay through a portal build up the IP address and device history that Visa CE 3.0 needs. Keyed sales never capture it.
• PCI DSS bars storing the security code after authorization, so a card photo showing that code breaks the standard once the charge clears. An unprotected card number in an inbox is a separate PCI problem.

A charter credit card authorization form should name the cardholder, the trip by quote number and routing, a maximum dollar amount, the post-flight charge categories, the cancellation terms and the passengers. The cardholder signs it, not the assistant who made the booking. A form built that way settles most arguments about money: the price, the de-icing bill, the late-cancellation fee. It does much less when the cardholder says they never booked the flight. Visa files that complaint under reason code 10.4, and there the issuer cares more about whether the payment was authenticated than about an e-signed PDF. So the way you collect the card matters as much as the form.

Why Charter Bookings Need Their Own Authorization Form

A retailer can usually assume the person paying is the person buying. A charter desk rarely can. The CEO is in a board meeting while an assistant books the trip. A family office moves three relatives on two different cards. A broker books for a client the operator never talks to. Usually the person who knows the itinerary isn't the person whose name is on the card.

That split is normal, and fraudsters rely on it. Charter payments are almost always card-not-present: no chip read, no PIN. If the real cardholder later denies the charge, the issuer files a fraud dispute. On Visa that's 10.4, "Other Fraud: Card-Absent Environment," and unless something shifts the liability, the merchant takes the loss.

Charter fraud has a few familiar patterns. A stolen card books a same-day departure, and the requester pushes you to skip checks because the principal is waiting. A fake assistant writes from a domain one letter off the real company's. Triangulation is harder to spot: a fraudster sells a discounted trip to real travelers and pays you with a stolen card, so the passengers at the FBO are genuine and know nothing. Small test charges before a big booking are a warning sign, especially if you're selling empty leg flights online. Whoever runs the card takes these losses. Decide whether the broker or the operator should charge the client before you redesign the form.

What to Put on a Charter Credit Card Authorization Form

Picture a dispute analyst at the card-issuing bank opening your file months after the flight. The form should tell that person exactly what the cardholder approved, without a phone call to you.

Incidentals cause the most trouble. "Additional charges as incurred" gives an analyst nothing to work with. Name the categories and state that they'll go on the same card after the flight, as our guide to billing catering, de-icing and overnights after the flight explains. Cancellation terms need their own initial or checkbox. If you still charge a flat cancellation fee, look at tiered charter cancellation policies that hold up. When a large trip is split across several cards, list each card with its own amount. Our piece on card limits and authorization holds on large charters explains why splits happen.

Have your charter agreement and authorization form reviewed by an attorney who knows aviation and payment disputes. This article is general information, not legal advice.

Why a Signed Form Alone Won't Win a Fraud Chargeback

In a fraud claim, the cardholder's whole position is that they never signed anything. An e-signature sent to an email address proves only that someone with access to that inbox clicked a button. If the inbox belongs to the fraudster, your audit trail records the fraudster.

The networks' authentication programs are what move fraud liability. With 3-D Secure, branded Visa Secure and Mastercard Identity Check, the card issuer checks the cardholder's identity during checkout. TabaPay's developer documentation of the network rules says a Visa transaction returned as authenticated (ECI 05) or attempted (ECI 06) is protected from 10.4 chargebacks. The exceptions include non-reloadable prepaid cards, merchants in a Visa fraud monitoring program, and certain restricted merchant category codes. Mastercard gives similar protection against its 4837 "No Cardholder Authorization" chargebacks. Disputes that aren't about fraud, such as a weather cancellation, get no protection.

This is the part charter desks miss. 3-D Secure runs only when the cardholder types the card into a checkout page or payment link. When your agent keys the number into a virtual terminal during a phone call, no authentication result is attached, so the charge can't qualify.

Repeat clients have a second route. Visa's Compelling Evidence 3.0 rule took effect in April 2023. It covers 10.4 disputes where the same card has two earlier undisputed transactions with you that settled 120 to 365 days before the dispute. According to Global Payments' merchant guidance, at least two of four data points must match across all three transactions: user ID, shipping address, IP address and device ID.

One of the matches has to be the IP address or the device ID. A family office that pays through your portal from the same office network builds that history without trying. Keyed sales record neither data point. Visa looks for CE 3.0 eligibility only when your dispute response includes the data, so ask your processor whether your gateway records it and sends it.

Worked Example: The Same Stolen Card, Two Payment Files

These numbers are illustrative. A broker sells a one-way midsize jet trip for $48,000, paid in full up front on a Visa card that turns out to be stolen. Six weeks after the flight, the real cardholder disputes the charge under reason code 10.4.

In File A, the "assistant" emailed a photo of the card and e-signed the form, and an agent keyed in the number. The file proves the flight happened. It doesn't prove the cardholder approved it. The likely result is that the broker loses the $48,000 plus the processor's dispute fee and still owes the operator for the aircraft.

In File B, the form went to an email address the broker had confirmed independently, and the payment ran through a 3-D Secure link that came back ECI 05. If no exclusion applies, the issuer can't charge back the $48,000 as card-absent fraud. More often the booking never gets that far, because a fraudster with only stolen card details can fail the issuer's identity check.

The protection applies one transaction at a time. If the deposit went through the link and the balance or incidentals were later charged to the stored card, ask your processor what protection, if any, covers those later charges.

Verify the Cardholder Through Contacts You Find Yourself

A fraudster controls every contact detail they hand you. Useful verification relies on details you found yourself.

Begin with where the form goes. Send it to the cardholder's own address through an e-signature tool that logs the signer's email, IP address and timestamp. Some assistants will offer to sign for the principal. A few really do have that authority, but you can't confirm it from your desk, so take the offer as a reason to pick up the phone.

Call the company's main line from its website, or a number from an earlier booking that settled without a dispute. A mobile number in the requester's email signature proves nothing, because the person who wrote the email chose it. While you're on the company's website, compare its domain with the one the request came from. Lookalikes are often a single character off, such as "rn" in place of an "m," or ".co" where the company uses ".com."

On the first charge, the card itself gives you two signals. Address verification (AVS) checks the billing address on your form against the issuer's records. The security code check confirms that the code entered matches the card. Read both results before you confirm the aircraft, and hold the trip if either fails on a new client's first booking.

A family office on its tenth booking deserves a lighter touch than a stranger. That changes the moment the card, the assistant or the usual routing changes. When any of those is new, run the full set of checks again.

Some requests justify a full stop. Watch for a new client who wants a same-day departure and no checks, or who offers card after card after a decline. If a client swaps cards after signing, get a new signed form for the new card. When the passengers are paying the requester, who then pays you, treat it as triangulation until the cardholder confirms otherwise. Asking for a wire on an urgent first booking is a fair test, and our comparison of wire and card payments for private jet charters covers the trade-offs.

Keep Card Numbers Out of Inboxes and Fax Trays

Card numbers still reach many charter desks by email and fax. Every stored copy adds to your exposure under PCI DSS, the card industry's data security standard. The PCI Security Standards Council says sensitive authentication data, including the security code printed on the card, must not be stored after authorization, even if it's encrypted. So once the charge goes through, a card photo that shows the security code, still sitting in a shared inbox, breaks that rule. A photo without the code still causes trouble. The Council's data storage guidance also requires the card number to be rendered unreadable anywhere it's stored, and a plain image in an email account fails that test before and after authorization.

The fix is to collect the approval and the card number separately. The e-signed form carries the approval and the last four digits. A secure payment gateway such as Authorize.net or NMI collects the full number on a page the gateway hosts. Card-not-present merchants who outsource all card handling this way may qualify for SAQ A, the shortest PCI self-assessment questionnaire, meant for merchants whose own systems never touch card data.

Phone orders are harder. A virtual terminal for keyed charter payments is the next-best option, and it falls under the PCI Council's SAQ C-VT, which has strict conditions. The terminal must be web-based and hosted by a PCI-validated provider. Staff key in one transaction at a time on a computer isolated from your other systems, and no software on that machine may capture or store card data. For post-flight charges, keep the token the gateway returns instead of the card number. Delete any card image a client sends once the charge has cleared. Which questionnaire applies depends on every channel you take cards through, so confirm it with your processor.

Tie the Payment to the Passenger Manifest

A cardholder who disputes a charge has a much harder case when their own approval names the people who boarded. Attach the manifest to the form, or get the cardholder's written approval of it, and record whether the cardholder is flying or approving travel for others. A new lead passenger or a changed routing calls for a short written re-approval. File the FBO and crew records of ID checks at departure with the final manifest. If the people boarding have no visible connection to the cardholder, stop and verify before the aircraft moves.

Build the Dispute File Before Wheels Up

Cardholders generally have 120 days to file a dispute. Chargeback Gurus' summary of network time limits gives merchants about 30 days to respond on Visa and 45 on Mastercard. Your processor sets an earlier internal deadline, and the clock can start before the notice reaches you. Open a file for each trip, named by trip number, when the booking comes in, and complete it when the trip closes. It should hold:

1. The signed authorization form with its audit trail
2. The charter agreement and the separately initialed cancellation terms
3. AVS, security code and 3-D Secure results from the gateway
4. Verification call notes, including the number dialed and where you found it
5. The approved manifest and any written approvals of changes
6. Proof of flight, such as the trip sheet and FBO records
7. The itemized post-flight invoice
8. Messages with the cardholder and the booking agent

None of this guarantees a win, because the issuer makes the decision. Delay disputes follow different logic, covered in charter chargebacks tied to weather, maintenance and missed flights. Treat passport and ID copies as sensitive personal data, and ask a qualified professional how long you may keep them.

Here's a test for Monday. Pull your last five charter files and ask whether each would survive if the cardholder claimed fraud tomorrow. If most of those cards were keyed from emails, the biggest single fix is sending first-time clients a 3-D Secure payment link. MannyPay offers jet and charter payment processing, high-risk merchant accounts, virtual terminals, gateways and 3-D Secure authentication. To review your setup, request a free quote and a MannyPay specialist will respond within one business day.

Sources

1. PCI Data Storage Do's and Don'ts (PCI Security Standards Council)
2. PCI DSS v4.0 SAQ C-VT (PCI Security Standards Council)
3. SAQ C-VT: The Basics You Should Know (SecurityMetrics)
4. PCI DSS Self-Assessment Questionnaire (SAQ): Which Type? (Anecdotes)
5. 3D Secure (3DS) Liability Shift (TabaPay Developer Docs)
6. 3D Secure Liability Shift in the United States: What's Covered and What Isn't (GPayments)
7. Navigating Visa's Compelling Evidence Rule 3.0 for Card-Not-Present Transactions (Global Payments)
8. Visa Chargeback Reason Code 10.4: Other Fraud: Card-Absent Environment (Chargeback.io)
9. A Merchant's Guide to Chargeback Time Limits (Chargeback Gurus)

IC

About the author

Isabella Cruz

Isabella Cruz is Business Growth & Commerce Editor for Beyond the Swipe, writing for small businesses, restaurants, retailers, entertainment venues and e-commerce sellers.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.