Free credit card authorization form template for venues and caterers

A card authorization form to send with your contract. Fill in your business, the event and what the card covers: the deposit, the final balance, and a cap for damage and one for incidentals. The form writes the authorization wording as you type. Download it as Word, print it to PDF, or take the blank form, no signup.

This page never asks for a card number. The card details print as blank lines your client fills in by hand.

Grandview Hall

1200 Grandview Road · (970) 555-0142 · events@grandviewhall.example

Credit card authorization form

Event: Whitfield and Nakamura wedding
Date: October 17, 2026
Where: Garden Room

DepositOn signing	$800.00
Final balance$800 at 90 days and $800 at 14 days before the event	$1,600.00
Damage, up toOnly for damage to the property or its contents, within 14 days after the event, with an itemized list	$500.00
Incidentals, up toOvertime at $250 an hour and extra cleaning, within 14 days after the event, with an itemized list	$750.00
Most this form allows	$3,650.00

Authorization

I authorize Grandview Hall to charge the card below for the event named on this form: only the amounts listed above, and only when each one is due.

Damage and incidental charges are made only within 14 days after the event, never above the amounts listed, and only after Grandview Hall sends me an itemized list of what is being charged and why.

Cancellation charges follow section 5 of the venue rental agreement dated April 6, 2026.

This authorization covers only the charges on this form and ends once they are complete. I confirm that I am the cardholder, or that the cardholder has allowed me to use this card.

Card details

The cardholder fills these in by hand.

Cardholder name, as on the card

Card typeVisaMastercardAmerican ExpressDiscoverOther

Card number

Expiration date (MM/YY)

Security code (CVV)

Billing address

City, state, ZIP

Cardholder phone or email

The venue blacks out the security code as soon as the first charge is authorized and never keeps it on file.

Cardholder signature

Date

Printed name

For the venue: keeping this form

Keep the signed form locked away, where only the people who run payments can reach it.
Black out the security code once the first charge is authorized.
Shred the form once the last charge on it has cleared and your processor’s dispute window has passed.
Don’t scan, photograph, email or type the card details into anything.

This is a starting template, not legal or compliance advice. Check it with your lawyer and your card processor before you use it.

Blank Word form

This is a starting template, not legal or compliance advice. Check it with your lawyer and your card processor before you use it. Free with no account. What you type stays in this browser and is never sent anywhere, and the card details are never typed here at all. The example is a sample venue and wedding.

The short answer

A credit card authorization form is your client’s signed permission to charge their card when they aren’t there to pay: the deposit, the final balance, and up to a set amount for damage or extras after the event. It lists each charge and when it happens, then the card details and the cardholder’s signature. Keep it locked away, black out the security code after the first charge, and shred it when the charges are done.

Credit card authorization form template filled in for a sample wedding venue: an $800 deposit, a $1,600 final balance, up to $500 for damage and $750 for incidentals within 14 days after the event, with the card details and signature left blank — The example form: the venue fills in the charges, and the card details stay blank for the client to write in.

A credit card authorization form for a sample wedding with a deposit, a final balance and caps for damage and incidentals, the card lines blank, beside an $800 deposit invoice paid by card in MyVenueHQ. — Fill in the form free here. In MyVenueHQ the deposit goes out as an invoice the client pays by card, into your own processor.

What each charge on the form is for

The form lists only the charges you fill in. The example is Grandview Hall, a sample venue, with an $800.00 deposit and a $1,600.00 balance, so the most the card can be charged is $3,650.00.

Charge	What it covers	How the form words it
Deposit	Holds the date. Usually charged when the contract is signed.	Deposit of $800.00, charged on signing.
Final balance	What’s left of the fee. Caterers often charge it once the final count is in.	Final balance, charged 14 days before the event.
Damage, up to	Repairs or replacement after the event, in place of a cash security deposit.	Up to $500.00, within 14 days after the event, with an itemized list.
Incidentals, up to	Overtime, extra cleaning, a bar tab that runs past the package.	Up to $750.00 for overtime and extra cleaning, same window.

The caps and the window are what make the form worth signing. “Any charges incurred” reads like a blank cheque to a client, and it’s weak evidence if they dispute a charge later. A fixed ceiling, a deadline and an itemized list you send before charging are what you hand your processor when a client says they never agreed. Put the cancellation terms in your venue rental agreement or catering contract and point to them from the form, so the two never say different things.

A damage hold on a form isn’t a hold on the card

Venues say “damage hold” for two different things. On this form it means permission to charge up to a set amount after the event if something is broken; nothing is reserved on the card in the meantime. A hold through your processor (an authorization it places but doesn’t capture) does reserve the money, but it runs out fast: Stripe’s documentation says an authorization for an online card payment is usually valid for 7 days. That suits a hotel stay. It doesn’t suit a wedding booked a year out.

So a venue or caterer can take the permission on this form, or a refundable security deposit on the invoice, and charge or refund after the walk-through.

Keeping the card details safe

Once a client writes a card number on this form, you’re holding card data, and the card industry’s security standard (PCI DSS, from the PCI Security Standards Council) covers how you keep it. For a paper form that comes down to four habits.

The security code goes after the first charge. The Council’s FAQ on card verification codes says a business may not keep the code once the transaction it was collected for is authorized, even encrypted, even if the client asks you to. Black it out with a marker that day.
Lock it up. A locked drawer or safe that only the people who run payments can open, not a folder on the front desk.
Keep it out of inboxes and phones. Don’t take the filled-in form by email or text, and don’t scan or photograph it. A copy in an inbox or a camera roll is outside your lock and in backups you can’t shred.
Shred it when it’s done, once the last charge has cleared and your processor’s dispute window has passed.

Card numbers on paper bring more of the standard into play than a checkout page your processor hosts. Your processor can tell you which PCI self-assessment applies to you.

A pay link is safer than a card number on paper

In MyVenueHQ the deposit and the balance go out as an invoice with a card checkout, and the client types their card into your own Stripe, Square or PayPal checkout. The number never touches your desk, your inbox or MyVenueHQ, the money lands in your account, and the invoice shows paid. For damage, put a refundable security deposit on the invoice and refund it from your processor after the walk-through.

The form still earns its place for one job a pay link can’t do, charging the card after the event without the client there. If you need that, use the form for damage and incidentals and the pay link for everything else.

Start free See pricing

Credit card authorization questions.

Is a credit card authorization form legal?

Yes. It’s an ordinary business document: a written record that the cardholder agreed to the charges on it. What matters is how you use it: charge only what the form allows, and protect the card details the way PCI DSS requires. A signed form is evidence the cardholder agreed if a charge is disputed, but it doesn’t guarantee you win the dispute; the card issuer decides. This template is a starting point, not legal advice.

Do I need a credit card authorization form?

Only if you’ll charge the client’s card when they aren’t there to pay: a balance you run on its due date, damage you find the morning after, overtime added on the night. If the client pays every invoice themselves from a pay link, you don’t need one. Plenty of venues do both, with pay links for the deposit and balance and this form for damage and incidentals.

How long should I keep a credit card authorization form?

Until the last charge on it has cleared and the time the client has to dispute it has passed. Your processor can tell you how long that is for each card brand. Then shred it. The security code goes much sooner: black it out as soon as the first charge is authorized.

Can I email a credit card authorization form?

Email the blank form, yes. Don’t ask for it back by email with the card details filled in. The number then sits in your inbox, the client’s sent folder and every backup of both, where you can’t lock it away or shred it. Have the client hand it over or post it, or skip the card number altogether and send a pay link.

Should the form ask for the CVV?

It can, for the first charge. The PCI Security Standards Council doesn’t allow a business to keep the security code once the charge it was collected for is authorized, even encrypted and even if the client agrees. So black it out straight after that charge. Later charges under the form go through without it; ask your processor how it treats them.

Should I ask for a photo of the card?

No. A photo of the front and back is the card number and the security code in a file you then have to protect, on a phone that backs itself up. If you want to confirm who signed, check ID in person and note on the form that you did.

Is the form really free?

Yes. Fill it in, print it, download it as Word or take the blank form, with no account. What you type stays in this browser and is never sent to us, and the page never asks for card details.

Sources

PCI Security Standards Council, FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions?: no card verification code may be kept once the transaction it was collected for is authorized, even encrypted or with the customer’s consent.
PCI Security Standards Council: the body that sets PCI DSS, the security standard for businesses that take card payments.
Stripe, Place a hold on a payment method: an authorization for an online card payment is usually valid for 7 days.