Authorization Holds Expire Silently, Catching Merchants Off Guard at Capture

Payment authorization holds have network-specific expiry windows — typically 7 days for Visa and shorter for many Mastercard issuers — but these expirations are not communicated via response codes, leaving merchant systems showing stale holds as valid. A developer discovered this flaw while building a rental deposit flow where booking authorization and checkout capture were separated by up to 12 days. When a capture is attempted on an expired hold, processor behavior varies widely: some return a generic decline, some silently re-authorize, and some settle the transaction and defer risk to the acquirer. With no built-in visibility into which outcome would occur, the team built a nightly job to flag any pending capture older than five days and trigger a fresh authorization check. The issue highlights a broader gap in payment infrastructure transparency, prompting discussion on whether merchants should track hold expiry per card network in their own systems.