What a hotel credit card authorization form must say, and why Visa bans the CVV2 box on it

Visa’s rulebook tells merchants, in one line, to “not request a Card Verification Value 2 (CVV2) from the Cardholder on any written form” [1]. That line sits in the April 2026 edition of the Visa Core Rules and Visa Product and Service Rules, and it rules out the three-digit-code box on a hotel credit card authorization form.

A third-party form is how a small hotel lets a parent, an employer or a group leader pay for someone else’s room. The card never reaches the desk, so the charge is card-absent.

If the real cardholder later tells their bank they never approved it, the bank can open a fraud dispute, Visa condition 10.4, for up to 120 calendar days after the charge is processed [1].

People look this up. Google Keyword Planner shows about 480 searches a month in the US for credit card authorization form hotel and 5,400 for credit card authorization form in our pull on Oct 21, 2026.

Below is what the card rules say the form must and must not contain, what the signed form is worth in a dispute, and what protects you better.

What a hotel credit card authorization form should say

The Visa rules we read hold no hotel form to copy. Their glossary defines an order form as “a document bearing the Cardholder’s signature, either written or electronic” that authorizes the charge, and an email counts [1]. Built from the rest of the rules, a form for a stay someone else pays for needs these lines:

• Who pays and who stays: the cardholder’s name and billing address, and the guest’s name, so anyone reviewing a dispute can link the two.
• The stay: arrival date and time, departure date, and the property’s address. Visa requires the start date and time and the location for a guaranteed reservation [1].
• The money: which charges are approved, either room and tax only or incidentals too, with a dollar cap the front desk will not exceed.
• The cancellation terms: the date and time to cancel without penalty, and the amount charged if the guest neither cancels nor arrives [1].
• The cardholder’s signature and the date, on the same page as the charges they approve.

Send the form and your terms by email or text. For card-absent sales that are not online checkouts, Visa says the policy disclosure goes “through mail, email, or text message” [1].

For every guaranteed reservation, Visa gives the cardholder at least 24 hours after the confirmation arrives to cancel without penalty. A booking taken by phone also needs that written confirmation, with these terms, within 24 hours [1].

Two boxes to delete from your template

The first is the CVV2 box. Visa forbids asking for the code on any written form [1]. The PCI Security Standards Council, which writes the card industry’s data security standard, adds that the code may not be kept once the charge it was collected for is authorized, and that this “applies even if that data is encrypted” [2].

A customer’s permission does not change it. The council says a request or approval to keep the code “has no validity for PCI DSS” [2]. A photo of the card can show the same code, so do not ask for one.

The second is any line like “I agree not to dispute these charges.” Visa says a merchant “must not require a Cardholder to waive the right to dispute a Transaction” [1]. The clause cannot stop the bank from hearing a dispute, and it puts a banned term on a document you may later send to that bank as evidence.

A signed form is evidence, and evidence often loses

Visa lists “a signed order form” as allowable compelling evidence for a mail or phone order in a card-absent fraud dispute [1]. Two other items on the same list fit hotels: proof that a member of the cardholder’s household or family made the transaction, and, for a company’s virtual card, the issuer’s payment instruction sent through Visa Payables Automation [1].

The catch is timing. Visa lets the merchant’s bank submit compelling evidence with a pre-arbitration attempt, which comes after the cardholder’s bank has already filed the dispute [1].

For screening a risky booking before arrival, see our phone verification playbook for chargebacks. If you use its third-party checklist, skip the copy of the back of the card, because the back shows the CVV2.

Disputes also cost money on their own. On the pricing page of Stripe, the payment processor, a dispute costs $15 when it arrives and another $15 if you respond, and the second fee comes back only when you win [3].

The odds are the other catch. Stripe’s Radar Plus predicts how likely each disputed payment is to be won and publishes the win rate for each of its five ranks: 60% for the disputes it rates most winnable and 5% for the least [4].

Stripe’s own summary is blunt: “even in the most favorable cases, it’s very difficult to overturn a disputed payment” [4]. Losing also costs more than the room. For a three-night stay at an assumed $120 a night, a lost fraud dispute on Stripe’s published fees takes back $390:

Your processor’s fees may differ, but the room was already slept in, so the stay and the fees leave together. That is why the next section matters more than the form.

A payment link moves the fraud risk to the card issuer

When the front desk keys the card in from a form, nothing on file proves that the person who signed is the cardholder. A payment link changes that. The hotel sends a payment link, the cardholder opens it on their own device, and their bank can check them with 3-D Secure, which Visa brands as Visa Secure.

Visa’s rules make a card-absent fraud dispute invalid when the bank confirmed the cardholder through Visa Secure with EMV 3-D Secure and the authentication value travelled with the charge [1].

Stripe puts it plainly: when a cardholder disputes a 3DS payment as fraudulent, “the liability typically shifts from you to the card issuer” [5]. It also warns that a successful check “doesn’t guarantee liability shift” [5].

Keying can also cost more. Stripe adds 0.5% to its standard 2.9% plus 30 cents when a card is entered by hand [3]. Ask your processor or PMS whether it can send a payment link with 3-D Secure before your next group booking.

Keep the signed form anyway. It records what the cardholder agreed to pay for, and Stripe’s dispute guide asks for proof that the customer agreed to your terms when a dispute is about cancellations or refunds [4].

What the form cannot let you charge later

If your form has a blanket line for incidentals and damages, Visa’s rules narrow both.

An incidentals hold at check-in is an estimated authorization. Visa says its amount must be “a genuine estimation of what the Cardholder will spend,” the cardholder must be told the amount, and it may not include anything for potential damage, theft, other delayed charges, insurance premiums or tips [1].

A damage charge after check-out is a delayed charge, and lodging is on Visa’s list of merchants allowed to process one [1]. The rules then set a sequence:

• Within 10 business days of check-out, send the cardholder documentation that explains the charge and ties it to the stay [1].
• Say in that notice that paying for the damage with the card is optional [1].
• Charge the actual repair or replacement cost, or the insurance deductible if that is less [1].
• If the guest has not agreed to pay, wait 20 business days from the confirmation you sent before charging. Either way, process the charge within 90 calendar days of check-out [1].

A form signed before arrival does not replace those steps. It only shows the cardholder knew damage could be charged.

We could not confirm how Mastercard, American Express and Discover treat each of these points. Their rulebooks are separate, and this post checks only Visa’s April 2026 edition [1].

Your processor’s merchant agreement decides which rules it enforces with you, so ask it, and treat this post as a reading of the rules, not legal advice. How we checked them is on how we write.

Verdict

Keep a credit card authorization form if you let parents, employers or group leaders pay for guests. Rebuild it today: no CVV2 box, no dispute waiver, stay dates, a charge cap and the cancellation terms on the page the cardholder signs.

Use a payment link with 3-D Secure instead of keying the card whenever your processor offers one, and keep the signed form as the record of what was agreed.

Start with the fix from the top of this post and delete the CVV2 box. It costs nothing, and it takes a banned question off a page you may one day hand to a bank.