Rental Marketplace Security Deposits: When Card Holds Run Out

A card hold for a rental marketplace security deposit can lapse in 10 days on Visa. Learn when to re-authorize and when to store the card for damage claims.

Isabella CruzBusiness Growth & Commerce Editor

October 30, 2026 · Updated October 27, 2026 · 11 min read

Photographer in a green cap and blue t-shirt shooting with a camera on a tripod in front of a blurred stone building

Photo: Pixabay

On this page 7 sections

How Long a Card Hold Lasts Under Visa and Mastercard Rules
Worked Example: One 21-Day Camper Van Rental Across Networks
Choosing a Rental Marketplace Security Deposit Model
Stored Credential Consent for Post-Rental Damage Charges
Damage Claim Payments That Survive a Dispute
Paying Owners From a Deposit or Claim
Ask Your Processor for Its Windows Before You Build

Key takeaways

On Visa, an incremental authorization doesn't extend the deadline. If a rental runs past the window, you have to reverse the old hold and place a new one.
On Mastercard, a $0 preauthorization linked to the original extends a 30-day preauthorization's protection period, so one hold can cover a long rental.
Visa's public documents don't settle whether a reauthorization gets the 10-day rental window or the 5-day merchant-initiated window. Plan around the shorter one until your processor confirms. That can push a 21-day rental to five Visa authorizations.
If your typical rental needs more than two authorizations, a stored card plus a documented claim process usually works better than rolling holds.

A card hold only works as a rental marketplace security deposit when the whole rental fits inside the card network's authorization window. That includes the days an owner needs afterward to inspect the item. Under Visa's rules, the window is 10 calendar days for most online bookings and for estimated authorizations in rental categories such as equipment or motor home rental. Mastercard allows 30 days for a preauthorization. When a booking runs longer, you have two options. You can re-authorize before the hold lapses, or you can store the card with the renter's consent and later charge any documented damage claim as its own transaction.

Peer-to-peer platforms for camper vans and camera kits promise owners they'll be made whole if something breaks. A hold is the cheapest way to keep that promise, and timing is where it fails.

This is general information, not legal or tax advice. Card network rules change, so confirm current requirements with your processor and a qualified professional.

How Long a Card Hold Lasts Under Visa and Mastercard Rules

An authorization hold reserves part of the renter's credit line or bank balance without moving any money. Later you capture some or all of it, or you release it. On April 13, 2024, Visa replaced its separate validity and clearing periods with a single authorization-to-clearing time frame, according to its acquirer notice on the authorization framework. The clock starts on the day of approval.

Network and Transaction Type	Deadline to Capture
Visa: cardholder-initiated online or in-app sale	10 calendar days
Visa: cardholder-initiated online sale with an extended authorization indicator	30 calendar days
Visa: estimated authorization at lodging, vehicle rental or cruise line merchants	30 calendar days
Visa: estimated authorization at other rental merchants (aircraft, boat, bicycle and e-scooter, equipment and tool, furniture, motor home, motorcycle, clothing and costume)	10 calendar days
Visa: other card-present sales	5 calendar days
Visa: merchant-initiated transactions, including unscheduled credential-on-file	5 calendar days
Visa: reauthorization when a rental outlasts the original window	Confirm with your processor (see below)
Mastercard: preauthorization (estimated amount, or a sale that may not complete)	30 calendar days
Mastercard: final authorization (captured amount must equal the authorized amount)	7 calendar days

Sources: Visa's authorization and reversal best practices for merchants, Mastercard's Transaction Processing Rules, and summaries from PayKings and Chargebacks911 for the extended-indicator and merchant-initiated rows.

Two details matter more than the table. First, on Visa an incremental authorization does not restart the clock. Visa's merchant guide says that when a rental outlasts the original window, you have to reverse that authorization and request a new one. Mastercard works the other way. An additional preauthorization linked to the same transaction extends the protection period, even if it's for $0. Second, Mastercard retired its old "undefined" authorization, which had a 7-day window, in the U.S. on June 16, 2025. Any gateway documentation that still describes it is out of date.

Visa's public documents leave one window unsettled: the reauthorization itself. The merchant guide says a reauthorization can be sent as an estimated authorization, which points toward the rental window. Visa's stored credential rules, though, classify reauthorization as a merchant-initiated transaction, and merchant-initiated transactions get 5 days. Ask your processor which window it applies. The worked example below shows how much the answer matters.

American Express and Discover publish their own windows. Stripe's documentation shows how one processor handles them. It lists 7 days for standard online authorizations on both brands. It offers 30-day extended holds on American Express only for lodging and vehicle rental, and on Discover only for travel, car rental and lodging categories. Your processor's numbers may differ.

Capturing on an expired hold is costly. On Visa, a late capture is disputed under condition 11.3. Visa's dispute management guidelines for merchants title it "No Authorization/Late Presentment" for transactions completed on or after April 13, 2024. Before that date, late presentment was a separate condition, 12.1, in the Processing Errors group. That's why older chargeback guides list two codes. On Mastercard, late capture falls under reason code 4808. Mastercard also charges fees on preauthorizations that are neither captured nor reversed. A renter can win the dispute on timing alone, before anyone looks at photos of the bent trailer hitch.

Your MCC sets your window. Don't shop for one. The merchant category code your processor assigns decides whether Visa gives your estimated authorizations 30 days, as it does for vehicle rental, or 10, as it does for equipment and boat rental. Choosing an MCC that doesn't describe your business just to get a longer hold violates network rules. It can get your account terminated and put your business on the MATCH list. Describe your platform accurately and let your processor decide which rules apply.

Worked Example: One 21-Day Camper Van Rental Across Networks

These numbers are illustrative. The assumptions:

The renter books in your app, so the sale is card-not-present.
The deposit is $1,500.
Your terms give the owner three days after return to report damage, so you need a live authorization through day 24.
Your processor has assigned an MCC in Visa's "other rental" group, which gives estimated authorizations 10 days.
Your gateway supports reauthorization flags.
Each new hold goes on one day before the old one lapses.

On a Visa card, the hold placed at pickup on day 0 is good through day 10. What happens next depends on the window your processor applies to reauthorizations. If each one gets the 10-day rental window, you re-authorize on day 9 (good through day 19) and again on day 18 (good through day 28). That's three authorizations. If each one gets Visa's 5-day merchant-initiated window, you re-authorize on days 9, 13, 17 and 21, and the last hold runs through day 26. That's five. Every authorization after the first can be declined in the middle of the trip.

On a Mastercard, one $1,500 preauthorization on day 0 is good through day 30. If the renter extends by a week, a $0 preauthorization linked to the original extends protection without adding to the hold.

On an American Express card, at a processor using a 7-day window, you would need authorizations on days 0, 6, 12 and 18 to reach day 24.

So the same booking takes one authorization on Mastercard and as many as five on Visa. Each re-authorization also forces a choice: approve the new hold first, or reverse the old one first.

Approving first protects you. For a short time, though, the renter's available balance drops by $3,000 instead of $1,500, and on a debit card that money comes out of their checking account. Mastercard requires issuers to release a hold within 60 minutes of matching a reversal. On other networks, release timing depends on the network and the issuer. Reversing first avoids the double hold, but if the new request is declined you have no coverage at all. For a $1,500 deposit on a debit card, the double hold is the likelier source of complaints. For a $12,000 boat, the coverage gap is the bigger risk. Either way, tell the renter before the new hold appears.

That gives you a simple decision rule. Count the authorizations your typical rental needs, using the shorter Visa window until your processor tells you otherwise. If the count is more than two, rolling holds will cost you declines and support tickets, and a stored card plus a claim process usually works better. Every extra request is also a chance for a false decline, so the fixes in how to improve authorization rates and cut false declines apply here too.

Choosing a Rental Marketplace Security Deposit Model

Most platforms use one of four models or a mix.

Model	How It Works	Fits Best	Main Risk
Hold at pickup	Authorize at the start, capture or release at return	Rentals that end, with inspection, inside the window	Lapses on long rentals; ties up renter funds
Rolling re-authorization	New hold before the old one expires, then reverse the old one	Medium-length rentals of valuable items	Mid-rental declines; overlapping holds
Collected deposit	Charge the deposit as a sale, refund after return	High-value items where certainty matters most	Renter pushback; you may not recover the processing fee on the refund; fund-holding questions
Stored card plus claim	Store the card with consent, charge only for a valid claim	Long rentals and lower-risk categories	The charge can be declined or disputed weeks later

A common hybrid picks the model by rental length and item value. A weekend rental gets a full hold, released promptly after a clean return. Longer bookings get a small verification at booking plus a stored card, and damage goes through the claim process. Pro camera bodies and other high-value categories can require a collected deposit, disclosed before checkout.

With a collected deposit, your platform is holding other people's money. Depending on how the funds flow, that can raise state licensing questions. Before you build it, read up on money transmitter licenses and agent-of-payee rules for marketplaces and the trade-offs of escrow-style payments that hold funds until buyers confirm.

A damage charge after return is a merchant-initiated transaction, meaning you charge a card the renter isn't presenting. Whether that charge is legitimate depends on what happened at booking.

Some of the requirements are network rules. Visa's Stored Credential Transaction Framework is part of the Visa Rules. It requires merchants and payment facilitators that store cards to explain how the card will be used and to get the cardholder's consent first. They must also notify cardholders when those terms change. You also have to tell the issuer the card is now on file, either through the first payment or through a $0 account verification. Later transactions must carry the right indicators, and each one links back to the original through Visa's Network Transaction ID or Mastercard's Trace ID.

You also need to use the right type of merchant-initiated transaction. Visa's developer documentation has a "delayed charge" type for extra charges after the service is complete. It's limited to vehicle rental, lodging, cruise lines and other rentals. If your MCC falls outside those segments, your processor may run damage charges as unscheduled credential-on-file transactions instead, so ask which applies. Visa gives merchant-initiated transactions 5 days to clear, so authorize the damage charge only when you're ready to capture it.

The rest is our recommendation, not a network requirement. Put consent in its own checkbox instead of burying it in the terms, and make sure it covers:

which charges can follow (damage, cleaning, late return, missing accessories, fuel, tolls)
how amounts are set, whether by repair invoice, replacement cost or a published fee schedule
that the renter gets notice and evidence before any charge, and how to contest it
how long the card stays on file

For each consent, log the terms version, the timestamp, the account and the device. Store cards as tokens, never as raw card numbers, to keep your PCI DSS scope small. A tokenizing payment gateway for online and in-app transactions does this for you. Running 3D Secure authentication at booking can cut stolen-card fraud. But liability shift only covers fraud disputes, not a renter who disagrees about a scratch. Prepaid cards carry their own risk, because the balance may be gone by the time a claim comes in. If your model depends on later charges, disclose any card-type limits at checkout.

Damage Claim Payments That Survive a Dispute

A renter charged two weeks after returning a kayak may dispute the charge as unauthorized or say they never agreed to the amount. Your claim process is your evidence.

Capture timestamped photos or video from both parties at pickup and return, inside your app rather than by text.
Require owners to report damage within a window stated in your terms.
Require an itemized claim with photos and a repair invoice or replacement receipt.
Send the claim and evidence to the renter with a deadline to accept or contest it.
Review claims at the platform level instead of approving whatever owners submit. Marketplace seller fraud: fake shops, triangulation and collusion covers inflated claims and colluding accounts.
Run the damage charge as its own transaction with a descriptor the renter will recognize, and email an itemized receipt right away.

Keep one evidence packet per charge. It should hold:

the consent record and its terms version
the booking and authorization records
both sets of condition photos
the claim notice, the renter's response and your decision
the repair invoice
the on-platform message history

If the renter says the charge was unauthorized, the consent record and the original authorization do most of the work. If they dispute the amount, the photos and invoice carry the case.

Decide in your terms who absorbs a lost dispute before the first claim comes in. Marketplace chargebacks: who pays, the platform or the seller lays out the options.

Paying Owners From a Deposit or Claim

Owners want their money fast, but the platform doesn't want to pay out funds a renter can claw back. Keep rental proceeds on your normal payout schedule and handle claim proceeds separately, with a holding period or a reserve against disputes. Your owner terms should say whether the owner or the platform takes the loss when the renter's card is declined or the renter wins the dispute. If you'd rather cover owners with a damage protection product, get legal advice first, because some states may regulate it as insurance.

You'll also need a way to recover money when a claim is reversed after payout. Refunds after the seller was paid and fixing negative balances covers this. Damage reimbursements that flow through owner payouts can affect information reporting, so review 1099-K obligations for marketplace operators with a tax professional.

Ask Your Processor for Its Windows Before You Build

Before anyone writes deposit code, get two answers from your processor in writing. The first is your assigned MCC. The second is which authorization indicators your integration supports: estimated, extended, reauthorization and delayed charge. Then ask for the capture window on every card brand you accept, including American Express and Discover. Make sure to ask which window it applies to a Visa reauthorization on a rental.

Plug those numbers and your median rental length into the worked example above. The number of authorizations you need tells you which deposit model to build.

MannyPay provides merchant accounts for low- and high-risk businesses, including payment processing for leasing and rental businesses and online payment processing for platforms and e-commerce. To discuss processing for your rental platform, request a free quote from MannyPay. A MannyPay specialist responds within one business day.

Sources

About the author

Isabella Cruz

Isabella Cruz is Business Growth & Commerce Editor for Beyond the Swipe, writing for small businesses, restaurants, retailers, entertainment venues and e-commerce sellers.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.