How does the rental company charge an empty debit/credit card with €0 credit limit? (Transferwise)

Question

Can anyone help me to figure out which way a rental company uses to bypass the credit/debit card limits up to several thousand of euros.

It happened the first time around 5 days after returning a rental car. The credit card has a set credit limit of €0 and disabled overdraft protection. A transaction of almost €3500 went through. I called the credit card company and they told me the rental company used an "old forgotten" unsual way to charge the credit card and they admitted that their security checks should have prevented the transaction and I can charge back the credit card debit payment from my bank account. The reason for the high amount was, that they have made a mistake in the driven kilometers. Around 6 weeks later they have refunded the amount back to me.

After renting another 15-20 cars and around 6 months later now it happened a second time, it's the same company and this time with a transferwise debit card (after they have charged me on their own mistake around €3500 first, I thought I was clever enough to change my card details to a pure debit card).

As you can see on the picture they have tried to charge the card multiple times first without success.

All the failed transactions look like this. The location was online and authorised via manual entry.

One of the transaction has succeeded. The location was now a place and no longer online and the authorisation method changed to unknown AND the transaction went through. My transferwise debit card went to a negative balance.

Can anyone explain to me what this "unknown" authorisation could be and why the location had to change to a place from online? I never visited this place. It looks like a offline pos terminal payment with a signature or pin code.

Answer 1

This was most likely a "force post", similar to the force authorization (also called voice authorization) which ceejayoz mentioned in a comment, but with even less checking for approval.

In a normal credit or debit card transaction, the merchant sends the card data to their bank electronically, who then sends it to the cardholding bank to say "Is this covered?" If the response is "yes", there will be a six-digit authorization code included along with - you can usually find this printed on a receipt.
In a voice authorization, the merchant calls either their bank (which processes it electronically from there) or the cardholder's bank directly and gets that six-digit code over the phone. Either way, when it comes time to settle the transaction (and actually move the money to the merchant), that six-digit code is provided, as proof that the bank originally said "yes".

A force post skips all that. The merchant simply includes the transaction in their daily settlement, without an authorization code (or occasionally with a made-up one like 123456). Because of the way the settlement system works, by the time the cardholder bank actually looks at this transaction, the money has already been moved. (Of note: there's no technological distinction between how this works and how a voice authorization works, only the difference of whether or not the cardholder's bank was actually contacted or not.)

Back when credit cards were first being issued, before any kind of electronic authorization, this was considered perfectly acceptable, although riskier than actually calling the bank to confirm. But for a long time now, the card brands have discouraged this in various ways. The most relevant way is that you are almost guaranteed to win any chargeback against such a "not authorized" transaction - the merchant took the full risk of the transaction on themselves, so if they don't end up with any money, that's their own problem. Many banks don't allow it any more, or only under special circumstances, but it does still exist.