What is payment authorisation?¶

Payment authorisation is the stage at which a bank, card issuer or payment provider decides whether a proposed payment should be approved.

Avoid this assumption: An authorised payment has already been fully completed and settled.

Authorisation usually checks whether the payment can proceed. Depending on the payment type, the provider may assess available funds, account status, card validity, fraud indicators, spending limits and whether the required authentication has been completed.

For a card payment, the merchant or payment processor may send an authorisation request to the card issuer. The issuer may approve it, decline it or request additional authentication. If approved, an authorisation code may be created and funds may be reserved.

For a bank transfer, authorisation may involve the account holder or user approving the instruction through an application, online banking session, security token or another process.

Authorisation does not necessarily mean the recipient has received the money. The transaction may still require processing, clearing, settlement or posting. It may later be reversed, cancelled, refunded or fail for another reason.

The authorisation time may therefore differ from the transaction date shown on a statement. Some records show the moment approval was requested, while others show posting or settlement.

Successful authorisation also does not identify the person who approved it. It shows that the system’s requirements were satisfied. Credentials could have been shared, an account could have been compromised, a victim could have been deceived, or a device could have been remotely controlled.

Preserve authorisation codes, response codes, timestamps, device and session information, authentication records and the related transaction reference.

When interpreting the record, ask what was authorised, by which system, under which account or instrument, and what happened afterward.

Operational takeaway¶

Treat authorisation as approval for a payment to proceed, not proof that it settled or that the named account holder personally approved it.