Lesson 12 of 13

Complete reference.

Authorization types, validity windows, statuses, codes, declines, disputes, and monitoring, brand by brand.

By Nagesh Koritala 23 min read Last verified: November 2026

Lesson 1: Improve the checkout
Lesson 2: The checkout flow
Lesson 3: Authorization
Lesson 4: Payment states
Lesson 5: Capture
Lesson 6: Clearing and settlement
Lesson 7: Cash capture
Lesson 8: Returns and refunds
Lesson 9: Disputes
Lesson 10: Tokens and stored credentials
Lesson 11: Transaction types
Lesson 12: Complete reference (this lesson)
Lesson 13: Payments compliance

All 16 pages in this guide

The lessons teach how payments flow. This lesson is the lookup table behind them: every authorization type, every operation, every status a payment, refund, dispute, subscription, or payout can be in, every stored-credential code, and every dispute reason code, brand by brand.

It was compiled from Visa, Mastercard, American Express, Discover, Apple, Google, and Stripe documentation, plus acquirer documentation where the networks do not publish rules openly. Items marked processor come from acquirer or processor documentation rather than the network's own rulebook. Treat those as reliable but confirm them with your provider.

Reference tables

Type	What it is	When to use	Brand notes
Final authorization	The amount is final and will be captured in full.	Most online retail where the price is known.	Mastercard: must match the clearing amount and currency, and be cleared or reversed within 7 days; capturing more needs a new auth, capturing less triggers a fee.
Pre-authorization / estimated authorization	An estimate that may change before capture. The cardholder must be told it is an estimate.	Hotels, car rental, restaurants with tips, fuel, made-to-order goods.	Visa: estimated indicator; 0.02% fee on estimated and incremental auths. Mastercard: pre-auth valid 30 days and priced slightly higher than final processor. Amex: estimated auth with set variances by industry (for example 15% for card-not-present retail).
Undefined authorization	An authorization sent without a pre-auth or final indicator.	None. It is the legacy default.	Mastercard: valid 7 days; penalized with a per-transaction fee in the US from July 2025. Always send an indicator. processor
Initial authorization	A capped amount authorized before the final is known, at unattended terminals.	Automated fuel pumps.	Visa: no incrementals allowed; complete or reverse within 2 hours.
Incremental authorization	Raises an existing estimated authorization.	Hotel stay extended, rental runs long.	Visa: adds to the hold but does not extend validity; linked by the original transaction ID. Mastercard: each increment restarts the 30-day pre-auth window. Amex: needs an estimated auth sent with the indicator, an approval, and a charge not yet submitted.
Reauthorization	A new authorization after the first expired.	Back-orders and split shipments that ship late.	A Visa industry-practice MIT. Mastercard uses partial shipment (M205) instead. Amex: if shipping more than 7 days after order, authorize at order and again at shipment.
Partial authorization (partial approval)	The issuer approves less than requested; the customer pays the rest another way.	Prepaid and debit cards with a low balance.	Visa: merchant signals support; approval comes back as response code `10`; all prepaid issuers must support it; mandated for debit and prepaid in many card-present categories since April 2024. Amex: debit and prepaid only, not cross-border, not recurring.
Account verification ($0 auth)	Checks the card is valid without holding money. Can run address and security-code checks.	Saving a card with no charge due.	Visa: a $1 test auth instead of $0 counts as misuse. Mastercard: called Account Status Inquiry (ASI); a nominal-amount auth approved then reversed draws a fee.
Extended authorization	A longer validity window than standard.	Long fulfillment, travel.	Visa Extended Authorization Service: up to 30 days for card-not-present CITs, for a 0.08% fee processor. Mastercard pre-auth already allows 30 days. Amex travel: duration of stay or rental.
Overcapture	Capturing slightly more than authorized, within network tolerance, without a new auth.	Tips, small final adjustments.	Tolerances vary by brand and category, for example about 15% for Visa by default and 20% to 30% for restaurants. processor
Multicapture	Several partial captures against one authorization, then a final capture.	Split shipments inside the validity window.	Provider support required. Without it, a single partial capture usually releases the rest of the hold. processor
Authorization reversal (full or partial)	Releases all or part of a hold.	Cancelled order, final amount lower than authorized.	Visa: within 24 hours of knowing the sale will not complete, or of completing for less. Mastercard: commonly 24 hours processor; the hard limits are reversal or clearing within 30 days for pre-auths and 7 days for final auths, or a processing integrity fee applies. Amex (international rules): mandatory within 24 hours if you will not submit the charge.

Brand	Situation	Window
Visa since 13 April 2024; one combined authorization-to-clearing window	Card-not-present, customer-initiated	10 days
	All merchant-initiated (recurring, installment, UCOF, advance payment)	5 days
	All other card-present	5 days
	Estimated auth: lodging, cruise, vehicle rental	30 days
	Extended Authorization Service (card-not-present CIT)	30 days
Mastercard	Pre-authorization	30 days
	Final authorization	7 days
	Undefined authorization	7 days
American Express	Standard approval	7 days
American Express	Estimated auth: lodging, car rental, cruise	Duration of stay or rental
Discover processor	Most merchant categories	10 days (Stripe uses 7)
Discover processor	Travel and lodging categories	30 days

Processors often apply shorter defaults than the network maximum (Stripe, for example, uses 7 days for Visa online CITs and about 4 days 18 hours for Visa MITs). Always read the expiry timestamp your provider returns. Clearing after the window is disputable under Visa 11.3 and Mastercard 4808.

Operation	Before capture	After capture, before settlement	After settlement
Authorize	Creates the hold	Not applicable
Sale (auth + capture)	One step; behaves like a captured payment from the start
Capture (full, partial, final)	Collects up to the authorized amount	Done
Increment	Raises an estimated auth	Not possible
Reverse / cancel	Releases the hold, fully or partly	Many providers can void the capture before the batch	Not possible; use a refund
Refund (full, partial, several partials)	Not possible; cancel instead	Some providers process an early refund as a reversal, so no separate credit appears on the statement	A credit linked to the original, to the same card, up to the captured total
Reauthorize	New authorization after the old one expired; flagged as an MIT with the original transaction ID
Resubmit (retry)	Retry after a decline, only for declines that allow it and within network limits (see Declines & retries)
Account verification	$0 check; no money moves

Every provider names statuses differently. The flows below use Stripe's names as a concrete, public example; other providers map closely. Each flow shows the main path first, then the side exits.

Payment (PaymentIntent)

requires_payment_method→requires_confirmation→requires_action→processing→requires_capture→succeeded

Side exits: canceled (you cancel, or an uncaptured hold expires). A decline sends the payment back to requires_payment_method so the customer can try again. requires_action usually means 3-D Secure. requires_capture appears only with manual capture.

Cancellation reasons: duplicate, fraudulent, requested by customer, abandoned; set by the system: expired, automatic, failed or void invoice.

Charge and authorization outcome

pending→succeededorfailed

Outcome types: authorized, manual review, issuer declined, blocked (by fraud screening, never sent to the issuer), invalid.

Network status: approved by network, declined by network, not sent to network, reversed after approval (approved by the bank, then blocked by the merchant side; may briefly show as pending to the customer).

Flags to watch: captured, amount captured, refunded (only true when fully refunded), amount refunded, disputed, partial authorization status, address and security-code check results (pass, fail, unavailable, unchecked).

Saving a card (SetupIntent)

requires_payment_method→requires_confirmation→requires_action→processing→succeededorcanceled

Saves a card without charging it, often running 3-D Secure to set up future MITs. Usage: on session (reuse only while the customer is present) or off session (customer may be absent).

Refund

pending→succeededorfailedorcanceled

Why it is pending: processing, insufficient merchant balance, or the original charge is still pending. requires_action: for payment methods with no native refund, the customer must supply bank details.

Failure reasons: card expired or closed, card lost or stolen, declined, disputed while pending, merchant balance too low for too long, merchant request, unknown. A failed refund returns money to the merchant, which can take up to 30 days.

Timing: usually 5 to 10 business days to appear. The ARN may take up to 7 business days; none exists when the refund was processed as a reversal.

Dispute

warning_needs_response→warning_under_review→warning_closed

needs_response→under_review→wonorlost

The warning_ states are inquiries (retrieval requests), common with American Express and Discover. Also: prevented (stopped by a pre-dispute service such as RDR), and appeal_needs_response / appeal_under_review for later stages.

Case types: inquiry, chargeback, compliance, block (stopped before becoming a chargeback), resolution (refunded before it became one).

Early fraud warning: a TC40 or Mastercard Fraud and Loss Database report. Not a dispute yet, but many become one if left unrefunded.

Subscription

trialingorincomplete→active→past_due→unpaid orcanceled

A subscription starts in trialing or active, or in incomplete if the first payment needs action. Also: incomplete_expired (first payment never completed; Stripe allows 23 hours), paused. Dunning (automatic retries) runs while past due; Stripe's recommended default is 8 tries over 2 weeks, and hard declines are not retried until the card changes.

Invoice

draft→open→paidoruncollectibleorvoid

Only drafts are editable. Void is final. Uncollectible marks bad debt but can still be paid later.

Checkout session

open→completeorexpired

Payment status: paid, unpaid (for delayed methods like bank debits, fulfill only on the later success event), no payment required.

Payout

pending→in_transit→paidorfailedorcanceled

A payout can show paid and then flip to failed within a few business days. Balance funds are either pending or available, with an available-on date.

Saved card and token lifecycle

Account updater results: new card number, new expiry, account closed, contact cardholder (Visa also has an issuer opt-out).

Apple Pay merchant token events: unlink, updated metadata, updated card art, updated merchant token, updated merchant token public key.

Google Pay merchant token notices: token disabled, or new last four digits when the underlying card is replaced (the token stays active).

If the brand changes during an update (say Visa to Mastercard), Stripe says you need a new customer agreement before the next MIT. Check your provider's rule.

Mastercard code	Category	Name	Meaning
C101	CIT	Credential on file (ad hoc)	Customer stores a card, or pays with one already stored
C102	CIT	Standing order	Customer starts a variable-amount, fixed-frequency series
C103	CIT	Subscription	Customer starts a fixed-amount, fixed-frequency series
C104	CIT	Installment	Customer starts an installment plan for one purchase
M101	MIT recurring / installment	Unscheduled credential on file	Charge at an agreed trigger, no fixed schedule
M102	MIT recurring / installment	Standing order	Scheduled charge, variable amount
M103	MIT recurring / installment	Subscription	Scheduled charge, fixed amount
M104	MIT recurring / installment	Installment	Later payments of a single purchase
M205	MIT industry practice	Partial shipment	Charge for each shipment as items ship
M206	MIT industry practice	Related / delayed charge	Extra charge after the service, such as a minibar
M207	MIT industry practice	No-show	Penalty under a disclosed cancellation policy
M208	MIT industry practice	Resubmission	Retry of a decline that allows retries

Mastercard data: the code travels in the authorization message (DE 48, subelement 22, subfield 05). Later transactions carry the original Trace ID. From 23 October 2026, MITs must also carry the new 22-character Transaction Link Identifier (TLID), which follows the payment through its whole life.

Visa types: CIT one-off, CIT initial storage (flagged C for card on file or UCOF, R for recurring, I for installment; if no amount is due, use a $0 account verification), and subsequent CIT using a stored credential. MITs: recurring (fixed intervals, never more than a year apart), installment, unscheduled card on file, and industry practice (incremental, resubmission, delayed charge, reauthorization, no-show). Visa links MITs to the initial CIT using its Transaction ID (up to 15 digits); since April 2025, new MITs must reference the initial CIT's ID. A network token the merchant stores counts as a stored credential under Visa's rules; a wallet token passed through for a single purchase does not.

American Express: consent before storing; MITs carry an MIT indicator and an original transaction identifier; recurring billing needs express, documented consent and a written confirmation within 24 hours of the first charge.

What the customer agreement must say (Visa): last four digits of the card, how the card will be used, when consent expires, how changes will be communicated; and when you will charge without them: cancellation and refund policy, your location, the amount or how it is calculated, any surcharge, the frequency or triggering event, and for installments the total and terms. Keep it for as long as consent lasts.

Subscription rules (Mastercard, since 2022): show price, frequency, and trial terms on the payment screen with active acceptance; send an enrollment confirmation; send a receipt with cancellation instructions after every charge; offer online cancellation; remind customers before a free or low-cost digital trial converts.

Wallet tokens: Visa once planned to block standing-instruction MITs on Apple Pay device tokens (DPANs). The plan was put on hold in February 2025, but MPANs or merchant network tokens remain the best practice for subscriptions.

Visa category	Meaning	Codes	Retry rule
1	Issuer will never approve	04, 07, 12, 14, 15, 41, 43, 46, 57 (formally from 25 Oct 2026), R0, R1, R3	Never retry Any retry draws a fee.
2	Cannot approve at this time	03, 19, 39, 51, 52, 53, 59, 61, 62, 65, 75, 78, 83, 86, 91, 93, 96, 5C, 9G, N3, N4, Z5	Limited Up to 20 retries in 30 days (since May 2025), CIT and MIT counted separately. Code 83 (fraud decline during issuer stand-in, added October 2026) should not be retried automatically.
3	Cannot approve with these details	54, 55, 70, 82, 6P, 1A, N7	Fix first Update the card or authenticate (1A means retry with 3-D Secure).
4	Generic	All others, including 05	Limited Same 20-in-30-day limit.

Visa fees: excessive or forbidden retries cost $0.10 per attempt for US domestic and $0.25 cross-border (from April 2026). Stop-payment codes R0 (stop one payment), R1 (stop all payments to this merchant), and R3 (stop all payments on the card) must never be retried. Partial approval returns code 10.

Mastercard Merchant Advice Codes: 01 new account information available (update, then retry) · 02 try again later · 03 do not try again · 04 token requirements not met · 21 cardholder cancelled the recurring payment (stop charging) · 24 to 30 retry after 1 hour, 24 hours, 2, 4, 6, 8, or 10 days · 40 non-reloadable prepaid · 41 single-use virtual card · 43 multi-use virtual card. Retrying after 03 or 21 within 30 days draws a fee, and Mastercard limits excessive retries on soft declines. processor

Common decline names you will see in provider dashboards: generic decline, insufficient funds, do not honor, authentication required, expired card, incorrect number, incorrect CVC, incorrect postal code, card velocity exceeded, processing error, issuer not available, lost card, stolen card, pickup card, restricted card, duplicate transaction, stop payment order, revocation of authorization. Show sensitive reasons (lost, stolen, fraud) to the shopper as a generic decline.

Visa (VCR)	Name
10 Fraud · allocation flow
10.1	EMV liability shift, counterfeit fraud
10.2	EMV liability shift, non-counterfeit fraud
10.3	Other fraud, card present
10.4	Other fraud, card absent (where Compelling Evidence 3.0 applies)
10.5	Visa Fraud Monitoring Program (now part of VAMP)
11 Authorization · allocation flow
11.1	Card recovery bulletin
11.2	Declined authorization
11.3	No authorization / late presentment (12.1 was folded in here in April 2024)
12 Processing errors · collaboration flow
12.2 to 12.7	Incorrect transaction code · incorrect currency · incorrect account number · incorrect amount · duplicate processing or paid by other means · invalid data
13 Consumer disputes · collaboration flow
13.1 to 13.9	Not received · cancelled recurring · not as described or defective · counterfeit merchandise · misrepresentation · credit not processed · cancelled merchandise or services · original credit not accepted · non-receipt of cash or load value

Mastercard	Name
4808	Authorization-related (absorbed 4807 and 4812)
4834	Point-of-interaction error: duplicates, wrong amount, late presentment, currency (absorbed 4831, 4842, 4846)
4837	No cardholder authorization (fraud)
4849	Questionable merchant activity
4853	Cardholder dispute: not received, not as described, credit not processed, cancelled recurring (absorbed 4841, 4855, 4860)
4870 / 4871	Chip liability shift; chip liability shift for lost, stolen, never-received fraud
4850 / 4854	Installment billing (some countries) / not elsewhere classified (US)

American Express	Codes
Authorization	A01 amount exceeds authorization · A02 no valid authorization · A08 authorization expired
Card member disputes	C02 credit not processed · C04 returned or refused · C05 cancelled · C08 not received · C14 paid by other means · C18 no-show or deposit cancelled · C28 cancelled recurring billing · C31 not as described · C32 damaged or defective
Fraud	F10 missing imprint · F14 multiple records of charge · F24 no card member authorization · F29 card not present · F30 EMV counterfeit · F31 EMV lost, stolen, non-received
Fraud programs	FR2 fraud full recourse · FR4 immediate chargeback · FR6 partial immediate chargeback
Processing	P01 unassigned card number · P03 credit processed as charge · P04 charge processed as credit · P05 incorrect amount · P07 late submission · P08 duplicate · P22 non-matching card number · P23 currency discrepancy
Inquiry outcomes	R03 insufficient reply · R13 no reply · M01 chargeback authorization

Discover processor	Codes
Service	AA does not recognize · AP cancelled recurring · RG not received · RM quality discrepancy · RN2 credit not processed · NF cash not received at ATM
Processing	AW altered amount · CD credit posted as sale · DP duplicate · IN invalid card number · LP late presentment · PM paid by other means
Authorization	AT authorization non-compliance
Fraud	UA01 card present · UA02 card not present · UA05 chip counterfeit · UA06 chip and PIN
Other	05 good faith investigation (issuer asks the merchant to accept; respond within about 20 days)

How the stages differ: Visa uses allocation (fraud and authorization, liability decided from the data) and collaboration (processing and consumer disputes, merchant responds with evidence). Mastercard runs first chargeback, second presentment, pre-arbitration, arbitration. American Express usually sends an inquiry first, and the merchant has 20 days to respond to an inquiry or chargeback. Discover starts with a ticket retrieval request. Arbitration losers pay a filing fee (Visa US: $600 since April 2025).

Program	What it measures	Merchant threshold
Visa VAMP (since April 2025, replaced VDMP and VFMP)	(TC40 fraud reports + disputes) ÷ settled card-not-present transactions, monthly	Excessive in the US at 1.5% (since 1 April 2026; it was 2.2%), with at least 1,500 fraud reports and disputes in the month. $8 per fraud and per dispute when excessive, enforced since October 2025. Disputes resolved by RDR and fraud qualifying for CE 3.0 are excluded from parts of the count.
Mastercard ECM	Chargebacks ÷ previous month's transactions	At least 100 chargebacks and a 1.5% ratio. High ECM: 300 and 3%. Fees escalate monthly. processor
Mastercard EFM	Fraud chargebacks, e-commerce	At least $50,000 in fraud chargebacks, a 0.50% fraud ratio, at least 1,000 e-commerce transactions in the month, and 3-D Secure on 10% or less of volume (the US threshold). processor

Pre-dispute tools that keep you out of these programs: Visa's Verifi Order Insight (share order details with the issuer, including CE 3.0 data), Verifi RDR (rules-based automatic refunds that stop the dispute), CDRN (dispute alerts), Mastercard's Ethoca Alerts and Ethoca Consumer Clarity (order details in the banking app).

Apple Pay request	Use	Token returned	Since
One-time payment	A purchase the customer is making now	DPAN	Baseline
Recurring payment request	Subscriptions, recurring billing, installment repayments; can include a trial	MPAN if network and issuer support it, otherwise DPAN	iOS 16, macOS 13
Automatic reload request	Top up a stored balance when it drops below a threshold	MPAN or DPAN fallback	iOS 16, macOS 13
Deferred payment request	Pay later for a booked service, with a free-cancellation date	MPAN or DPAN fallback	iOS 16.4, macOS 13.3
Multi-merchant payment	One sheet, separate tokens for several merchants (for example, a travel booking)	One token per merchant	iOS 16; cannot combine with recurring, reload, or deferred

Apple Pay details: MPAN supported on American Express, Discover, JCB, Mastercard, and Visa when the issuer participates. Recurring, reload, and deferred requests need a management URL (where the customer manages or cancels) and can set a token notification URL for lifecycle events and a billing agreement shown on the payment sheet. The decrypted payload carries the account number (DPAN or MPAN), expiry, an online cryptogram, and sometimes an ECI that must be passed through unchanged; merchantTokenIdentifier appears only for MPANs. Revoking a pre-authorized payment in Wallet invalidates the MPAN but does not cancel the subscription on your side.

Google Pay requests (merchant-initiated support announced April 2026): exactly one of transactionInfo (one-time), recurringTransactionInfo, deferredTransactionInfo, or automaticReloadTransactionInfo. A merchantTokenId comes back only when you use one of the last three, provide a tokenUpdateUrl for lifecycle notices, and the shopper picks a tokenized card. Google recommends allowing both PAN_ONLY and CRYPTOGRAM_3DS. Desktop browsers and iPhones always return PAN_ONLY; on Android, you get CRYPTOGRAM_3DS when the card is tokenized on the device and PAN_ONLY when it is not. assuranceDetails tells you whether Google already verified the account and authenticated the cardholder.

Card messages and gateway responses are full of short codes. These are the standard ones: the ISO 8583 message types and fields behind most card networks, and the result codes your gateway passes back.

ISO 8583 message	Meaning
0100 / 0110	Authorization request / response (dual-message: authorize now, clear later)
0120 / 0130	Authorization advice (for example, after stand-in processing) / response
0200 / 0210	Financial request / response (single-message: authorize and clear together, typical of PIN debit)
0220 / 0230	Financial advice, such as a completion / response
0400 / 0410	Reversal request / response
0420 / 0430	Reversal advice / response (for example, after a timeout)
0800 / 0810	Network management (sign-on, echo test, key exchange)

Common ISO 8583 field	Holds
DE 2 · DE 4 · DE 49	Card number · amount · currency
DE 11 · DE 37 · DE 38	STAN · retrieval reference number (RRN) · approval code
DE 22	POS entry mode
DE 39	Response code (00 approved, 05 do not honor, 51 insufficient funds…)
DE 41 · DE 42 · DE 43	Terminal ID · card acceptor ID (your merchant ID) · card acceptor name and location (feeds the statement descriptor)

Result codes you will see	Values
AVS (address check, Visa-style)	Y address and ZIP match · A address only · Z ZIP only · N no match · U unavailable · R retry · S not supported · G non-US issuer
CVV2 / CVC2	M match · N no match · P not processed · S should be on card · U issuer not certified
POS entry mode (Visa examples)	01 keyed · 05 chip · 07 contactless chip · 10 stored credential · 90 full magnetic stripe · 91 contactless magstripe
ECI	Visa, Amex, Discover: 05 authenticated · 06 attempted · 07 not authenticated. Mastercard: 02 authenticated · 01 attempted · 00 not authenticated

AVS and CVV letters vary slightly by network and processor. Map them from your gateway's documentation before writing fraud rules.

“RA” has several meanings. On payment and commerce teams it usually means reauthorization (a new hold after the first expired, see lesson 5), return authorization (the RMA that approves a customer return, see lesson 8), or risk assessment (a fraud score or review). In finance it can also mean remittance advice, the detail that accompanies a payment. Ask which one your team means.

Other two-letter collisions: CP usually means card present; CD can mean credit posted as card sale (a Discover dispute code) and appears in CHD, cardholder data; PA can mean partial authorization or the retired PA-DSS standard; DB can mean database.

Sources for this guide

Card network rules change. Time limits, fees, and authorization windows here reflect published rules and provider documentation as of late 2026; confirm details with your processor before you build against them.

Sources

Your progress stays on this device.

Next: Lesson 13

Payments compliance.

PCI DSS, the self-assessment questionnaires, and the US rules and laws that apply to checkout.

Start lesson 13 All lessons

Questions about payments? Email me. I read every note.