Skip to content
SwipeSeal
Menu

Free credit card authorization form template

Fill in your business and your terms, then print the form for your customer. The card fields print blank, and there is no box for the security code, because PCI DSS does not let you keep it once a charge is authorized. Choose a one-time charge or recurring charges; the recurring form states each item Visa asks a card-on-file agreement to cover.

Your side of the form

Pre-filled with an example business: change any field and the form below follows. The card fields print blank, and nothing here asks for card details.

What the customer is authorizing
Your business, printed at the top
The charge

Leave it blank to write the amount in by hand.

Blank prints a line to fill in.

Your terms

What prints

FormOne-time authorization

Card fieldsBlank, for the customer

Card detailsOn a cut-off strip

Visa does not count a card kept to complete one purchase as a stored credential, so its consent list for cards on file does not apply. Switch to recurring if you will charge the card again.

Security code boxNone

Your form

Northgate Pilates Studio

18 Mill Road, Springfield

(555) 014-2290

frontdesk@northgate-pilates.example

Credit Card Authorization Form

I authorize Northgate Pilates Studio to charge the card below once, for the amount and purpose shown.

The charge

Charge forClass membership
Amount
Date of charge

Cardholder

Cardholder name
Phone
Email
Card ending in (last 4 digits)

Terms

  • This authorization covers the one charge above. Northgate Pilates Studio will ask again before any other charge.
  • I confirm that I am the cardholder or that I am authorized to use this card.

Cardholder signature

Date

We will enter these card details with our payment processor, then cross-cut shred this strip.

Card details (filled in by the cardholder)

Name on card
Card brand
Card number
Expiration date (MM/YY)
Billing ZIP code
Billing address

Do not write the card's security code (the 3- or 4-digit code on the front or back of the card) anywhere on this form.

Dithered print of a blank paper form on a clipboard with a pen

Key figures

Security code boxNone

What a credit card authorization form is

It is the customer's written permission to charge their card when they are not standing at your terminal: once, for a phone or mail order or a deposit, or on a schedule, for a membership or a service plan. It records who agreed, to what amount, how often, and how to stop it. The customer fills in the card fields; you never type card details into this page, and it never asks for them.

Charging a hotel guest for a deposit and incidentals? Use the hotel credit card authorization form. Pulling from a bank account instead of a card? That is an ACH authorization form, a separate template.

How to use this generator

  1. 01Pick a one-time charge or recurring charges.
  2. 02Fill in your business, what the charge is for and your terms. Leave the amount blank if it changes per customer.
  3. 03Print it, or choose Save as PDF in the print dialog. Copy as text pastes the form into Word or Google Docs.
  4. 04The customer fills in the card fields and the cardholder lines, then signs and dates it.
  5. 05Enter the card with your payment processor, cut off the card strip and cross-cut shred it. File the signed terms.

Why the form has no security code box

We left the field out and printed a warning in its place, so a customer does not write the code in the margin either. The card verification code is “the three- or four-digit value printed on the front or back of a payment card”, and PCI DSS puts it in sensitive authentication data. The requirements settle it:

  • Req. 3.3.1 “SAD is not stored after authorization, even if encrypted.”
  • Req. 3.3.1.2 “The card verification code is not stored upon completion of the authorization process.”

A signed authorization form is something you keep after the charge, so a code written on it is a code stored after authorization. For recurring charges the Council is blunter: card verification codes “are not needed for card-on-file or recurring transactions”, and a customer's written permission to keep the code “has no validity for PCI DSS.”

If your processor asks for the code on a single phone order, collecting it for that charge is allowed; keeping it is not. Take it on the call and key it in, never on paper. The full set of keep-or-delete rules for card data is in how to store credit card information under PCI rules.

Worked example: a monthly membership

The example business in the generator, switched to recurring charges with the price filled in. Here is who writes what on the printed sheet.

Who fills in each field of a recurring credit card authorization form
FieldFilled in byOn the printed form
Business name, address, phone, emailYouNorthgate Pilates Studio, 18 Mill Road, Springfield
Charge forYouClass membership
Amount each chargeYouYour monthly price, or how it is worked out
How often, first charge, endYouMonthly, a start date, “When I cancel”
Cancelling, refunds, changesYouOne line each
Cardholder name, phone, email, card ending inCustomerBlank lines
Card number, expiry, billing ZIP and addressCustomerBlank lines on the cut-off strip
Security codeNobodyNo box; a printed warning
Signature and dateCustomerBlank lines

With the price entered and the term lines kept, the receipt above the form counts every item on Visa's consent list as stated. Clear the refunds line and that item turns to “Add it”.

Recurring charges: what Visa asks the agreement to say

A card you keep to charge again is what Visa calls a stored credential. A card kept for one purchase is not: Visa gives the example of a hotel, where a card on a guest's membership profile is stored but a card that covers one reservation is not. Before storing a card for future charges, Visa's guide says the merchant “must establish an agreement with the cardholder” that states:

  • the last four digits of the card
  • how the card will be used
  • the amount, or how it will be calculated
  • how often the charge runs
  • when the agreement expires, if it does
  • your cancellation and refund policies
  • how you will tell the cardholder about changes
  • where your business is

The recurring form carries a line for each, and the receipt above it shows which ones your terms still miss. Visa also lists items this generator does not print, because they apply only sometimes: a convenience fee or surcharge “if permitted and applicable”, and for instalments the total price and the dates and amounts of each payment. Visa's guide also says to keep the agreement for as long as the consent runs, provide it to the issuer on request, and stop charging once the cardholder cancels, the agreed term ends or a charge is declined.

After it is signed: keeping and shredding the paper

Paper is not outside PCI DSS. The Council's answer to whether the standard applies to paper records is “Yes”, with Requirement 9 covering “the safeguarding of physical media, including paper records”. The same goes for a number scribbled during a call. Pick a piece of a completed form to see what to do with it.

Pick a piece of a completed form

The signed termsKeep it, locked away

For a recurring form, Visa asks you to keep the agreement for as long as the consent runs and to give it to the card issuer on request. If the sheet still shows a card number, PCI DSS treats it as media with cardholder data, so it stays physically secured.

RuleVisa stored-credential guide, p. 13; PCI DSS Req. 9.4.1; PCI SSC FAQ 1069

The cut-off strip is what makes this simple: the card number lives on paper only until it is entered with your processor, while the signed terms, showing only the last four digits, stay on file. A drawer of filled-in forms, by contrast, puts that paper and the routines around it under Requirement 9. To charge the same card again without keeping its number yourself, read how payment tokenization works. To see which questionnaire your channels point to, run the SAQ type finder.

Where the rules say so

  • Req. 3.3.1No sensitive authentication data after authorization
  • Req. 3.3.1.2No card verification code after authorization
  • FAQ 1280No code kept for recurring or card-on-file charges
  • Req. 3.2.1Account data kept to a minimum under a retention and disposal policy
  • Req. 9.4.1Media with cardholder data is physically secured
  • Req. 9.4.6Paper destroyed when no longer needed; secure containers until then
  • Phone suppl. 2.3.1A card number written down on a call is storage
  • Visa guide p. 13What a card-on-file agreement states

PCI DSS v4.0.1 wording from the Council's Prioritized Approach Tool; read on 2026-10-22. Full list under Sources.

More card-handling tools and guides sit under Payments & Card Data.

Sources

  1. PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (requirement text for 3.2.1, 3.3.1, 3.3.1.2, 3.5.1, 9.4.1, 9.4.6) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
  2. PCI SSC FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions? (pcisecuritystandards.org), read on 2026-10-22
  3. PCI SSC FAQ 1069: Does PCI DSS apply to paper with cardholder data? (pcisecuritystandards.org), read on 2026-10-22
  4. PCI SSC Information Supplement: Protecting Telephone-Based Payment Card Data, v3.0 (November 2018) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
  5. PCI SSC Glossary (card verification code, sensitive authentication data) (pcisecuritystandards.org), read on 2026-10-22
  6. PCI SSC: SAQ Instructions and Guidelines, PCI DSS v4.0.1 r1 (SAQ A eligibility) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
  7. Visa: Improving Authorization Management for Transactions with Stored Credentials (2017) (usa.visa.com), read on 2026-10-22

Related