Free hotel credit card authorization form template: what to include before you send it to a guest

Most hotels send a credit card authorization form the same way they always have: a template emailed as a PDF, filled in by the guest or a corporate booker, sent back, and filed against the reservation. It is one of the most routine documents at the front desk. It is also one of the easiest to get wrong, both in what it asks for and in how it is handled after it comes back.

This guide is for operators who want a free hotel credit card authorization form template and, more importantly, want to know what belongs on it before they send it to a guest. It is written for independent hotels and franchise operators, in operational language, not legal boilerplate. It is educational guidance for running a front desk, not legal advice.

The short answer. A hotel credit card authorization form is a written record that the cardholder agrees to a charge. Before you send one, make sure it captures who is authorizing, which card, what the charge covers, the dates and a clear amount or limit, a plain-language consent statement, the cardholder's signature, and an identity check. Make sure it never asks the guest to write the full card number or the security code into an unprotected document that then sits in an inbox or a drawer. The template below gives you that structure; the sections after it explain each field and the handling risks to avoid.

What a hotel credit card authorization form actually is

The form exists to answer one question: did the cardholder agree to be charged. For a third-party booking, a deposit, a long stay, or incidental damages, the property wants written proof that the person who owns the card said yes, and proof of what they agreed to. That is a reasonable thing to want, and a well-built form provides it.

It is worth being precise about what the document is. A credit card authorization is not a charge and it is not a substitute for running the card. It is a record of consent: the cardholder's permission, the scope of that permission, and enough identity context to stand behind it later. The best forms treat it that way.

When hotels use one

Most properties reach for an authorization form in a predictable set of situations:

• Third-party or corporate bookings, where the person paying is not the person staying. A company, a travel agent, a parent, or an event organizer is covering the room.
• Advance deposits, where the property secures part of the stay before arrival.
• Incidentals and damages, where the front desk wants consent on file for charges that may happen during or after the stay.
• Phone and email reservations, where the card is not physically present at booking.
• Extended stays and group blocks, where charges accrue over time against one paying party.

In every one of these, the property is trying to reduce the risk of a disputed charge later. The form is the instrument for that. Whether it actually protects you depends on what it captures.

What to include on the form

A defensible authorization form is specific. Vague forms are the ones that fall apart in a dispute. At a minimum, include:

• Property and reservation details — property name, confirmation or reservation number, and the arrival and departure dates.
• Cardholder name exactly as it appears on the card.
• Billing address associated with the card.
• What is being authorized — be explicit: room and tax, a deposit, incidentals, specific charges, or a third-party booking on behalf of a named guest.
• A clear amount or limit — a specific figure or a stated cap, not an open-ended "any and all charges." Open-ended consent is weak consent.
• The dates the authorization covers — the window the permission applies to.
• A plain-language consent statement — what the cardholder is agreeing to, in words a guest can actually read, including incidentals and damages if those are in scope.
• Cardholder signature and date — the signal that consent was given, tied to a moment in time.
• An identity verification step — confirmation that a photo ID was matched to the cardholder, especially for third-party payers.
• A contact point for questions about the authorization.

Notice what does the work here: scope, limit, consent language, signature, and identity. Those are the elements a property leans on when a charge is questioned. A form that nails them is worth far more than one that simply collects a card number.

What you should never collect or store casually

This is where most paper and PDF forms quietly create risk. There are a few things a hotel should not be collecting onto a document that then lives in a folder or an inbox:

• The full card number written on the form and left on file. A stored full card number is a standing liability the moment the ink dries.
• The security code (the three or four digits on the card). Card rules are explicit: the security code can never be stored once the authorization is done. A form that asks for it and then gets filed is a violation by design.
• Photocopies of the front and back of the physical card kept in a drawer or scanned into a shared folder.
• Card details sitting in an email thread or shared inbox, where they spread to every forwarded copy, the mail server, and synced devices.

A useful test: if a document containing this information were left on the front desk overnight, or forwarded to the wrong address, how bad would it be. If the answer is "very," that information should not be captured the way you are capturing it.

Why email, PDF, and paper workflows get risky and messy

Start with the obvious exposure. A document containing a full card number and security code, sitting in a drawer or an inbox, is readable by anyone with access to the desk or the shared mailbox. It cannot be revoked. It does not expire. Every copy of it is a standing invitation to fraud.

Then there is the part operators feel directly: the chargeback. When a guest disputes a charge, the property has a narrow window to represent the case with evidence. A scanned form with a smudged signature and no timestamp is weak evidence. It does not prove the cardholder was present, that they saw the terms, or who matched the ID. In a dispute, that ambiguity usually defaults to the cardholder, and the property eats the loss plus the fee.

Email and fax make the exposure worse, not better. A card number typed into an email does not sit in one place. It lands in the sender's outbox, the recipient's inbox, every forwarded copy, the mail server, and whatever backups and personal phones have synced along the way. No one can ever fully pull it back out once it has spread. Every emailed or faxed form widens the property's compliance scope and scatters cardholder data across systems that were never built to protect it.

The pattern is always the same: one authorization, handled manually, becomes several copies in several places, each one a separate thing that can leak and none of them strong enough to win a dispute.

How to check your processor, brand, and compliance requirements

Before you adopt any template — including a free one — confirm it against the rules you have already agreed to follow. This is the part operators skip, and it is the part that matters:

• Your payment processor. Confirm the authorization language and the way you capture and store card data meet your processor's rules. Processors have specific requirements, and they are the right first call.
• Brand standards. If you fly a flag, your franchise brand likely has standards for how authorizations are collected and what language is acceptable. Check them.
• PCI DSS. The Payment Card Industry Data Security Standard governs how card data is handled. The security code is never stored after authorization, and a full card number may only be retained under strict encryption and access controls most front offices do not have.
• Legal and compliance. Consumer protection and data rules vary by jurisdiction. Confirm your form and your retention practices with qualified advisors.

None of this is exotic. It is the baseline for accepting cards. A template is a starting point; these reviews are what make it safe to use at your property.

How a digital authorization workflow replaces the manual version

The cleanest fix is to stop treating the authorization as a piece of paper and start treating it as a record. A digital authorization workflow sends the guest or corporate booker a secure link instead of an editable PDF. The cardholder gives consent, signs, and verifies identity in one place. The system captures the moment — consent, signature, ID match, and the terms they accepted — as a timestamped record tied to the reservation, and it does it without the full card number ever landing in an inbox or a drawer.

This is what Hotel Central's digital authorizations are built for. The card is tokenized through Hotel Central Payment Processing (HCPP), so the security code is used once and discarded and the property is never the one holding raw card data on a form. The guest can complete the authorization from their phone before arrival, the same way they would finish a mobile check-in. And because the authorization lands as structured data, it reconciles cleanly against deposits, incidentals, and final charges instead of living as a scanned image no one can search.

The result is the opposite of the folder full of forms: one secure, dispute-ready record per authorization, captured once and stored properly, instead of four copies scattered across email, fax, paper, and a sticky note.

Get the template

If you want a starting point you can adapt, the free template below is structured around the fields above. Use it as a baseline, then run it past your processor, your brand, and your advisors before you put it in front of a guest.