23

Paying by credit card is sometimes a multi-step process. In some of those cases, only the initial authorization is made at the point of sale; the finalized transactions are usually entered as a batch at the end of each business day.

In the United States, for service (as opposed to goods) transactions, the finalized charge in that situation is often different from the initial authorization amount, as it includes any tip that the customer may have left.

In such cases, does the restaurant's credit card system typically store the customer's credit card information after the initial authorization until the charge is finalized? If so, for how long is it typically stored? If not, how is the business able to change the amount charged to the card?

Improve this question
4
  • 17
    @Fattie Providing the correct information is significantly more constructive than just pointing out that something's wrong without providing any hint of why.
    – tparker
    Commented Oct 7, 2019 at 13:08
  • 1
    Sorry new user @tparker, didn't mean to sound abrupt. Quite simply, most (like "999 out of 1000" card transactions are processed instantly. The article (which is hopeless initself) is only referring to a type fraction of a certain type of transaction. Setting that aside, within the catregory under discussion, there's simply no standard. YES in many cases the company holds on to your card number.
    – Fattie
    Commented Oct 7, 2019 at 15:23
  • 1
    I edited your question, simply adding 3 or 4 words that correct the confusing assumption and make it in to a great question. Do note that on this site it's totally OK to unwind edits you don't like - they are just suggestions. Go for it as you wish! Cheers
    – Fattie
    Commented Oct 7, 2019 at 15:25
  • 1
    @Fattie Well, settlement does generally happen well after the transaction, although that's probably not what the OP was referring to. And I think that it's more than .1% that have only an initial authorization. It's standard for gas station purchases, for instance, to do it this way.
    – Acccumulation
    Commented Oct 7, 2019 at 17:17

4 Answers 4

Reset to default
46

I wouldn't regard that article as knowledgeable about credit card processing systems, however:

Does the restaurant's credit card system typically store the customer's credit card information after the initial authorization until the charge is finalized? If so, for how long is it typically stored?

They shouldn't do, unless their business is fully PCI-DSS security compliant.

If not, how is the business able to change the amount charged to the card?

When the restaurant processes the card for the initial hold, they will get an identity/authorisation code back for that particular transaction. They can then submit an additional/amended transaction using that identity/authorisation code, which their card services provider can use to refer back to the initial transaction and re-use the card details as originally processed.

Improve this answer
6
  • 3
    Yeah. They do a reservation first ,then basically transact against the reserved amount. Pretty standard - do you ever stay in hotels? That is what they do there these days. Allows them not to keep the credit card (which is a really big legal issue if data gets out) and still be guaranteed payment.
    – TomTom
    Commented Oct 7, 2019 at 9:45
  • 5
    I'll note that restaurants will need to be PCI compliant, even if they are not storing your card. However, the compliance burden is lower if they are not storing the credit cards.
    – Brian
    Commented Oct 7, 2019 at 14:44
  • 5
    To elaborate on @Brian's comment: PCI compliance for small merchants is largely an honors system: They fill out a form and "attest" that they do/don't engage in specific practices. So it would not all surprise me to find a merchant with an outdated PoS system, which does store card data, but the merchant is not tech-savvy enough to realize it, and the merchant services provider turns the blind eye. Merchant Service Providers, after all, only make money when a card is charged. They are not actively policing merchants to ensure security -- just look at Target.
    – Eric Seastrand
    Commented Oct 7, 2019 at 16:18
  • @EricSeastrand can you link to whatever you’re referring to regards Target? I’ve not heard this before, would like yo read.
    – Tim
    Commented Oct 8, 2019 at 11:44
  • 2
    Anatomy of the Target data breach helps illustrate all the steps along the way where their breach could have been prevented. Although it was a bit more nuanced than just storing credit cards, the point still remains: there was no merchant services provider breathing down anyone's neck to ensure their systems/practices were secure or PCI compliant. If Target is left to their own devices on compliance, it's unreasonable to expect small merchants will be scrutinized at all.
    – Eric Seastrand
    Commented Oct 8, 2019 at 13:39
12

Most payment systems today can utilize a token-based payment system.

The original card information is sent to the payment processor, who generates a token linked to that card information, and sends the token back to the retailer. The retailer can then store this token for future transactions, without having to store the actual card number. This makes for a much more secure system.

In cases like a restaurant, the card can be authorized for a higher amount than the bill (to leave room for a tip), and some payment networks allow for a charge to be made for slightly higher than the authorized amount. One example of this would be where you buy a $200 item but the merchant doesn't charge the shipping fee until later, when they actually ship it. The person who takes your order doesn't know the shipping fee but as long as it is only a small amount, the card processor will take the charge.

Improve this answer
1
  • 1
    When you request an authorization in advance of placing a charge, you are placing a hold on the credit card account equal to the authorization value. This hold counts against the card-holder's credit limit (and fails if that limit cannot be met). Since the restaurant has "reserved" some of the cardholder's credit limit in advance, the restaurant can safely charge the cardholder later (e.g., end of day when entering receipts into their system) without risk of being declined due to insufficient credit. If the payment network allows for higher-than-authorized charges, this guarantee is lost.
    – Brian
    Commented Oct 7, 2019 at 18:05
4

I have done integrations with Vantiv, I'm not an expert but I know more than I did a year ago. With Vantiv express they can give you an authorization token that does not expire, so this is how we "add credit cards" to the system we use. Implied is the consent from the consumer to use those credit cards (we have a web form saying you give us access - part of terms / conditions). Anyway the auth token is PCI compliant. Express is a fully PCI compliant system in that we at never point, ever ever ever see the unmasked credit card info. We don't know your credit card number at all. We have that token and that's it. They enter the credit card number either on a PIN pad or via a IFRAMEd web form that goes directly to Vantiv.

Improve this answer
3

Merchants should ideally not be in possession of customer credit card data. Where merchants have payment terminals provided by a credit card processor (those machines you tap with your card or slide in to read the chip), the merchant doesn't even see the credit card number. Since the merchant receives a transaction identifier, they have the means to amend a transaction without having access to the CC number.

The following may now be obsolete, but one CC system I worked on allowed a mobile (no radio) POS terminal to accept credit cards for purchases. The transactions were batched up on the device until it could be docked and the data uploaded to the credit card processor (perhaps at the end of a day). PCI compliance required the transactions to be encrypted in a fairly specific manner to ensure that the stored data could only be decrypted by the processor. Given the advances in wireless communication since then, I would expect that there is no longer a need to store transactions on the device, and that they are uploaded immediately.

Improve this answer
7
  • Credit card transactions in airplanes might still work as you described.
    – MSalters
    Commented Oct 7, 2019 at 12:29
  • @MSalters: I doubt it. I don't think airlines normally collect payment information mid-flight. Any in-flight purchases would instead be billed to the passengers card on file (with that card probably being stored by the payment processor; the airline would bill against an identifier as described in Owain's Answer).
    – Brian
    Commented Oct 7, 2019 at 14:46
  • @Brian At least one airline I fly with regularly (US domestic) collects payment information mid-flight (My ticket was booked via corporate and I needed to use my personal card to purchase a meal). However, they also offer in-flight WiFi which likely allows them to authorize the txn online without storing data.
    – nanofarad
    Commented Oct 7, 2019 at 15:39
  • @Brian I've seen airlines do chip&pin offline authorisation (which doesn't require storing any sensitive data, just the "signature" of the transaction made by the chip). Using it offline possibly means that the airline has some liability in case of fraud but the practical risks are very low in this scenario.
    – Peteris
    Commented Oct 7, 2019 at 15:51
  • 2
    @Brian: That's probably a US-centric answer. I can't recall ever having bought a ticket by credit card. And the debit card purchase will not have provided the airline with my debit card information, only a single transaction identifier. They can't use that for additional payment.
    – MSalters
    Commented Oct 8, 2019 at 7:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .