Hotel credit card authorization form, free and printable

What a hotel credit card authorization form is

It is the cardholder's signed permission for a hotel to charge their card for a stay: the room, a deposit, a hold for incidentals, or a no-show charge. The common case is a third-party booking, where a parent, an employer or a friend pays for a guest who arrives on their own. The form says who the guest is, which nights, which charges the card covers, and what happens if nobody turns up.

Not a hotel? The general credit card authorization form covers one-time and recurring charges for any business. This page reuses its printed form, so both carry the same blank card block and the same missing security code box.

How to use this generator

1. 01Pick who is paying: the guest at the desk, or someone else paying for the guest.
2. 02Fill in your property, the booking and your cancellation and no-show terms. Leave a date or an amount blank to write it in per booking.
3. 03For a third-party booking, tick what the card covers and choose how the card reaches you. A payment link keeps the number off paper and out of email.
4. 04Print it, or choose Save as PDF in the print dialog. Copy as text pastes it into Word or Google Docs.
5. 05The cardholder fills in the card fields and signs. Enter the card with your processor, cut off the card strip and cross-cut shred it.

Front desk or a booking sent in: how the card should reach you

The form is the same paper in both cases. What changes is where the card number travels. At the desk the card is in front of you; for a booking sent in, it can arrive by phone, by email, as a photo or on paper, and each route lands differently under PCI DSS. Pick how the card is reaching you.

Why an emailed form with a card number is a problem

Third-party forms usually go out by email, and that part is fine: a blank PDF holds no card data. The trouble starts when the filled-in form comes back the same way. Two rules meet in that reply.

• Req. 4.2.2 “PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies.” Its note also covers card numbers that arrive unasked, over a channel never meant for them.
• Req. 3.5.1 “PAN is rendered unreadable anywhere it is stored.” An attachment sitting in a mailbox or a download folder is the number stored, in plain view.

The Council's guidance for phone payments says it outright: “Never send CHD over an unencrypted, end-user messaging medium such as chat, social media, SMS (short message service)/text, or e-mail”. A printed copy of that email is then paper with card data too, under Requirement 9.

Safer routes for a third-party booking

• A payment link from your processor. The cardholder enters the card on the processor's page; you get the payment and the signed terms, never the number. Pick “Payment link” in the generator and the form prints with no card fields.
• A phone call keyed straight in. Take the card on the phone and type it into your processor's virtual terminal without writing it down. The phone payment options compare ways to take cards by phone without hearing them.
• The paper form, posted or handed in. Enter the card, then shred the cut-off strip.

Why there is no security code box

Where a security code box might sit, this form prints a warning instead. The card verification code is “the three- or four-digit value printed on the front or back of a payment card”, and PCI DSS says “The card verification code is not stored upon completion of the authorization process.” A signed form you keep on file would store it.

Visa goes further for paper. Among its rules for using card details, a merchant must “Not request a Card Verification Value 2 (CVV2) from the Cardholder on any written form”. And holding a card for later charges does not change the answer: the Council says codes “are not needed for card-on-file or recurring transactions”, and bars keeping them for concierge-style services, “for example, for making restaurant reservations or purchasing theatre tickets.”

Reservations, deposits and holds: what Visa's rules ask

Visa calls a booking secured with a card but no payment a guaranteed reservation. For one, the hotel must disclose:

• the date and time the stay begins, and where
• the date and time by which the cardholder must cancel to avoid a penalty
• the amount the cardholder pays if the reservation is not cancelled in time and not claimed

The receipt above the form checks your terms against that list. Visa's clocks for the same booking, from its rules for guaranteed reservations and its dispute rules:

That last line is why the generator's no-show term reads one night's room rate plus tax. A cardholder can dispute a no-show charge “for more than one day's accommodation or rental and applicable taxes”.

Deposits. Before taking an advance payment, Visa asks for the cardholder's agreement to terms that include the description, the total purchase price, and the cancellation and refund policies, “including the date that any cancellation privileges expire without Advance Payment forfeiture”. If you take a deposit, put the stay total in your other terms.

Incidentals holds. When the final amount is not known, Visa lets a merchant send an estimated authorization, and a hold for incidentals at check-in is one. The amount must be “a genuine estimation of what the Cardholder will spend”, the hotel tells the cardholder the amount and that further authorizations may follow, and the estimate leaves out “potential damage, theft, other delayed charges, insurance premiums, or tips.”

Worked example: an employer pays for a visiting consultant

The generator opens on this case. A company books two nights for a consultant and pays for the room only. The consultant settles anything else at check-out. Here is who writes what.

With the defaults the receipt above the form shows the hotel's location and the no-show charge as stated, and the arrival date and cancel-by time as blank lines, to fill in per booking. Tick incidentals and the hold appears, with a line asking for its amount. Switch the card to “Payment link” and the card fields disappear from the paper altogether.

Where the rules say so