Any business that charges a card without the cardholder present, for a phone order, a membership, a security deposit, or a payment plan, is exposed to one word: chargeback. When a cardholder disputes a charge, the card networks put the burden on the merchant to prove authorization. A signed credit card authorization form is that proof, and for recurring billing it is also what keeps the relationship honest: amount, schedule, and a written way to cancel.
This form covers both patterns, one-time charges and recurring billing, and takes card security seriously: it identifies the card by last four digits only, because full card numbers belong in a PCI-compliant payment system, not on a paper form in a filing cabinet.
What the form protects, on both sides
For the business, the form is chargeback evidence: a signature, an amount, a date, and a description of what was bought, exactly the elements card networks ask for when a dispute lands. It matters most for card-not-present charges and for recurring billing, where disputes months later are common. For the cardholder, the form is the contract that limits what the business may do: a one-time authorization is spent once, and a recurring one states the amount, the frequency, and the cancellation route. Neither side benefits from vague verbal permission, which is unprovable for the merchant and unlimited-feeling for the customer.
- Typical one-time uses: phone and mail orders, deposits, final invoices, a third party paying someone else's bill (a parent paying a student's rent).
- Typical recurring uses: memberships, subscriptions, installment plans, property management fees, ongoing professional services.
Card data and PCI: why this form omits the full number
The card industry's security standard, PCI DSS, applies to any business that stores, processes, or transmits card data, and paper is not exempt: a drawer of forms bearing full card numbers is stored cardholder data, with all the compliance burden and breach risk that implies. The security code (CVV) may never be stored after authorization, on any medium. The practical pattern for small businesses is simple: take the signed authorization with the last four digits for identification, and collect the full number through the payment processor's secure channel, a payment link, a card-on-file vault, or keyed entry directly into the terminal, so the sensitive data lives only inside PCI-compliant systems.
Never collect card numbers by email
Email is neither encrypted end to end nor access-controlled, and a mailbox full of card numbers is a breach waiting to be discovered. If a customer emails you a full card number unprompted, delete it after processing and invite them to use a secure link next time.
Recurring charges: cancellation and network rules
Recurring billing is regulated from several directions. Card network rules require merchants to obtain the cardholder's consent to a recurring plan, disclose the amount and frequency, and provide a simple cancellation method; several networks also require advance notice before charging after a free trial or when the amount changes. For debits from bank accounts, the federal EFTA adds its own written-authorization requirement. State auto-renewal laws increasingly require clear disclosure and easy online cancellation for consumer subscriptions. The common thread: a signed authorization with a stated amount, schedule, end condition, and cancellation contact, which is precisely what this form documents, protects the business in a dispute and keeps the billing lawful.
Authorization is not immunity
A signed form defeats an 'unauthorized charge' dispute, but not disputes about undelivered or defective goods and services, billing errors, or charges outside the authorized amount and schedule. Charge exactly what the form says, keep the signed original, and honor cancellations promptly.
Frequently asked questions
Should the form include the full card number?
No. A paper or PDF form is not a secure storage medium, and full card numbers on filed forms create PCI DSS scope and breach liability. Identify the card by type and last four digits on the form, and collect full details through the payment processor's secure channel. The security code may never be stored after authorization.
Does a signed authorization prevent chargebacks?
It defeats the most common dispute reason, 'transaction not authorized', by proving consent with a signature, amount, and description. It does not block disputes about non-delivery, quality, or amounts different from what was authorized, so accurate billing and good records remain essential.
How does the cardholder cancel a recurring authorization?
By written notice to the business contact stated on the form. Under this template, cancellation takes effect no later than the next billing cycle after receipt and does not erase amounts already owed. Card networks also let cardholders instruct their issuing bank to stop recurring charges, so businesses should honor cancellations quickly.
Can someone authorize charges on another person's behalf?
Only the cardholder (or an authorized user of the account) can authorize charges to a card. A parent paying a student's rent signs this form for their own card; what is being authorized is a charge on the signer's card for someone else's benefit, which is perfectly normal.
How long should the business keep the signed form?
At least as long as the chargeback window plus a safety margin: dispute rights typically run for months after a charge, and recurring plans generate disputes long after signup. Keeping the form for the life of the relationship plus two years is a common, prudent practice; store it without any full card number on it.