How is it possible that a preauth sticks to a credit card for 30 days, even though the goods have already been delivered?
It is barely possible that this is Citi's fault, but it sounds more like it is on the Costco end.   The way that this is supposed to work is that they preauthorize your card for the necessary amount.  That reserves the payment, removing the money from your credit line.  On delivery, they are supposed to capture the preauthorization.  That causes the money to transfer to them.  Until that point, they've reserved your payment but not actually received it.  If you cancel, then they don't have to pay processing fees.   The capture should allow for a larger sale so as to provide for tips, upsells, and unanticipated taxes and fees.   In this case, instead of capturing the preauthorization, they seem to have simply generated a new transaction.  Citi could be doing something wrong and processing the capture incorrectly.  Or Costco could be doing a purchase when they should be doing a capture.  From outside, we can't really say.   The thirty days would seem to be how long Costco can schedule in advance.  So the preauthorization can last that long for them.   Costco should also have the ability to cancel a preauthorization.  However, they may not know how to trigger that.  With smaller merchants, they usually have an interface where they can view preauthorizations and capture or cancel them.  Costco may have those messages sent automatically from their system.   Note that a common use for this pattern is with things like gasoline or delivery purchases.  If this has been Citi/Costco both times, I'd try ordering a pizza or some other delivery food and see if they do it correctly.  If it was Citi both times and a different merchant the other time, then it's probably a Citi problem rather than a merchant problem. "This is not a normal occurrence, and you have every right to be annoyed, but the technical way it usually happens goes like this: What can happen is when the merchant incorrectly completes the transaction without referencing the pre-authorization transaction. The bank effectively doesn't ""know"" this is the same transaction, so they process it the same way they process any other purchase, and it has no effect on the pre-authorization and related held/pending transaction. As far as the bank knows, you purchased a second set of blinds in the store for $200 and are still waiting on the first order to come in, they have no idea the store screwed up. The reason this is possible is the purpose of the pre-auth in the first place is that it is a contractual agreement between the bank (credit card) and the merchant that the funds are available, will be available except under rare special circumstances, and thus they can go ahead and process the order. This lets the merchant be secure in the knowledge that they can collect their payment, but you aren't paying interest or monthly payments on something you haven't even gotten yet! This system works reasonably well for everyone - right up until someone screws up and fails to properly release a hold, makes a second transaction instead of properly referencing the first one, or the bank screws up their system and fails to correctly match referenced pre-authorization codes to purchases. The problem is that this should not be a normal occurrence, and the people you are speaking with to try to sort out the issue often do not have the authority or knowledge necessary to properly fix the issue, or its such a hassle for them that they hope you just go away and time fixes the issue on its own. The only sure-fire solution to this is: make sure you have so much extra credit line that this doesn't effect you and you can safely let it time out on its own, or stop doing business with this combination of merchant/payment that creates the problem. Back when my credit limits were being pushed, I would never pay at gas pumps because their hold polices were so weird and unpredictable, and I would only pre-pay inside or with cash to avoid the holds." The answer to your question is very simple: The preauth and the shipment of the goods have no connection within the credit card system. It is possible to process a payment that does not cancel a preauthorization. This is needed for the case where you place two orders and the one you placed second ships first. A preauth can remain active for some time unless it is captured or cancelled. So in your case a preauth was placed and remained active. That you were shipped and billed for some goods had no effect on the preauth because one side or the other failed to attach them. Open a dispute for the preauth. It is effectively a double charge, since you have already paid for the item. You can provide evidence of the other transaction. This forces them to go through some hassle and waste some time on the issue.
"The only way to prevent it is to not use PayPal. The terms of usage are draconian, and by using the service you agree to them. I'm sure that when the case gets to a court of law, they will find where it is authorized. Paypal is not a bank, and the money there is basically ""entrusted"" with the company and is not insured by anyone. They don't need or have to be subject to the regulations on the banking industry, and they're no different than your neighbour carrying money for you to the grocery store when you're sick. Other options are wire transfer, services like Western Union or Moneygram, checks (better certified/cashier's checks), money orders or even cash. You can also charge via credit card, but you can get similar problems there (although it is still safer than PayPal because with credit card - the card owner must initiate the charge back, it doesn't appear on its own because they feel like it)." "When processing credit/debit cards there is a choice made by the company on how they want to go about doing it.  The options are Authorization/Capture and Sale. For online transactions that require the delivery of goods, companies are supposed to start by initially Authorizing the transaction.  This signals your bank to mark the funds but it does not actually transfer them.  Once the company is actually shipping the goods, they will send a Capture command that tells the bank to go ahead and transfer the funds.  There can be a time delay between the two actions.  3 days is fairly common, but longer can certainly be seen.  It normally takes a week for a gas station local to me to clear their transactions. The second one, a Sale is normally used for online transactions in which a service is immediately delivered or a Point of Sale transaction (buying something in person at a store).  This action wraps up both an Authorization and Capture into a single step. Now, not all systems have the same requirements.  It is actually fairly common for people who play online games to ""accidentally"" authorize funds to be transferred from their bank.  Processing those refunds can be fairly expensive.  However, if the company simply performs an Authorization and never issues a capture then it's as if the transaction never occurred and the costs involved to the company are much smaller (close to zero) I'd suspect they have a high degree of parents claiming their kids were never authorized to perform transactions or that fraud was involved.  If this is the case then it would be in the company's interest to authorize the transaction, apply the credits to your account then wait a few days before actually capturing the funds from the bank.   Depending upon the amount of time for the wait your bank might have silently rolled back the authorization.  When it came time for the company to capture, then they'd just reissue it as a sale. I hope that makes sense.  The point is, this is actually fairly common.  Not just for games but for a whole host of areas in which fraud might exist (like getting gas)." Thanks it is problem for class and I don't want to give the problem I just want to understand how to actually do it and the book hasn't been much help. Only additional information I can provide is   In Inventory – 15 days Accounts Receivable outstanding – 35 days Vendor credit – 40 days Operating Cycle – 50 days There are different ways of credit card purchase authorizations. if some choose less secure method it's their problem. Merchants are charged back if a stolen card is used. Most merchants (also in Europe) are reasonable, and typically are willing to work with you. credit card companies ask if you tried to work with the merchant first, so although they do not enforce it, it should be the first try. I recommend to give it a try and contact them first. If it doesn't work, you can always go to the credit card company and have the charge reversed. None of this has any effect on your credit score (except if you do nothing and then don't pay your credit card bill). For the future: when a transaction supposedly 'doesn't go through', have them write this on the receipt and give it to you. Only then pay cash. I am travelling 100+ days a year in Europe, using my US credit cards all the time, and there were never any issues - this is not a common problem. You have paid the vendor (school?), etc, $75.75 too much, for whatever reason. They can send you back this money, or it can apply against a future bill.  This is common when I pay my credit card in full, but also have a store return. The bill can show a credit, but it will quickly get used up by new purchases. If Apple uses the customer's bank's prefix, then the bank gets the charge sent directly to themselves and Apple is not a payment intermediary Yes as part of adding a Card to Apple Pay, the details are sent over to issuing Bank along with device details and other info. Based on verification, the Bank sends a DAN[Device Account Number] and other codes. After you show your phone at Point of Sale, DAN gets transmitted. This is similar as Card Number getting transmitted, there is additional info encoded. Visa then sends this back to Issuing Bank and based on DAN the actual card is charged. So yes Apple doesn't know your Card Number once it gets the DAN. it's entirely possible that organized-criminals could devise even harder-to-find NFC skimmers Right now criminals have found the easy step ... as part of set-up Apple Pay sends info the Issuing Bank to Verify. If you are frequent user of iTunes and have used the same card for years, etc, its auto approved. Else they use alternative method, i.e. call the customer, etc. It is easy here to spawn. I get card details, no need to spend time in duplicating stuff [mag or chip]. Just try registering on Apply Pay, some one less experienced from Customer Service calls up and I am approved. Use this for few places and then just delete this card and add a new one. As Apply Pay doesn't store my card, they don't know new from old ... Is there a point after which they legally unable to charge me? No. If you gave a check, then the bank may bounce it as stale after 6 months, but doesn't have to. With debit/credit transactions, they post as they're processed, and some merchants may not sync their terminals or deposit their manual slips often. As the world becomes more and more connected this becomes extremely rare, but still happens. Technically your promise to pay is a contract which never expires, and they can come after you years later to collect. Are you sure the payment has actually posted and isn't sitting in a pre-auth status?  If it is, it'll fall off in a few days and they're probably telling the truth. If not, and it has fully posted to your account, I agree with the others.  It's very appropriate to initiate a chargeback.  You can provide documentation showing they confirmed a cancellation, further, you can show proof that they had no intent of charging you. Good luck! "Having worked in the financial industry, I can say 9:10 times a card is blocked, it is not actually the financial industry, but a credit/credit card monitoring service like ""Falcon"" for VISA. If you have not added travel notes or similar, they will decline large, our of country purchases as a way to protect you, from what is most likely fraud. Imagine if you were living in Sweden and making regular steady purchases, then all of a sudden, without warning your card was used in Spain. This would look suspicious on paper, even it was obvious to you.  This is less to do with your financial institution, and more to do with increased fraud prevention. Call your bank. They will help you." Your bank will convert it (taking a fee for that, of course). It might be delayed some days so it can clear (2-3 days). Your credit card company will send you funds, probably a paper check, if you have a negative balance.  So this situation will not last long.  I'd guess 3-6 months at most, depending on the company's procedures. So, my questions: Are payment cards provide sufficient security now? Yes. If so, how is that achieved? Depending on your country's laws, of course. In most places (The US and EU, notably), there's a statutory limit on liability for fraudulent charges. For transactions when the card is not present, proving that the charge is not fraudulent is merchants' task. Why do online services ask for all those CVV codes and expiration date   information, if, whenever you poke the card out of your wallet, all of   its information becomes visible to everyone in the close area? What   can I do to secure myself? Is it? Try to copy someones credit card info next time you're in the line at the local grocery store. BTW, some of my friends tend to rub off the CVV code from the cards   they get immediately after receiving; nevertheless, it could have   already been written down by some unfair bank employee. Rubbish. They should not be able to tell the difference between a regular card and a secured card. The issue for a vendor is can they put a lock on the account equal to the transaction you are about to do. For a rental car company they don't have an exact idea of what your charges will be: it is based on many options some of which you don't decide until the day you return the car.   Because a secured card generally is on the small end (max measured in hundreds or at most $1,000) they might not be able to put a lock of sufficient size on the card. "It's anonymous/automated. They don't know who you are, just that customer x1a bought y. If your name isnt given to employees ""your"" privacy isnt being volated because the dont know its ""you.""  I imagine the government justifies their intrusions on our digital privacy the same way."