How Long Can a Security Deposit Hold Last? (2026 PSP Guide)

A car-rental manager hands over the keys on a Monday. The renter is gone for a week. He returns the car Friday afternoon — but the manager doesn't get around to inspecting it until Tuesday the following week. He opens his payment dashboard to capture €120 for a fuel deduction, and the deposit is gone. Expired. Released by the bank. The renter paid with Visa, the manager was on Stripe's default pricing, and the 7-day window quietly ran out while the car sat on the lot.

This scenario plays out constantly in rentals, hotels, equipment hire, and event venues — anywhere a deposit gets authorized at check-in and captured later. Most operators assume their deposit "holds for a month" because that's what the product setting says. The product setting is *your* timer. The bank's window is the *real* deadline, and it can be much shorter than you think.

This guide breaks down exactly how long an authorization hold actually lasts in 2026 — by payment service provider (Mollie, PayPal, Stripe), by payment method (Visa, Mastercard, Klarna, PayPal balance, and more), and what happens when extended-authorization features are on or off. Read it before you set up a deposit product, not after a hold expired on you.

Key Takeaways

• Mollie windows range from 7 days (Visa, Amex) to 30 days (Mastercard, Cartes Bancaires, Riverty) to 180 days (Vipps) — fully determined by the card brand or method the customer used
• PayPal guarantees 3 days at authorization, then PayRequest auto-reauthorizes every 3 days up to day 29 so you don't have to track it
• Stripe defaults to 7 days, with up to 30 days on Mastercard if your account is on Interchange-Plus pricing with Extended Authorization eligible
• The Hold Duration setting on a deposit product is PayRequest's internal expiry timer — not an instruction to the bank. The bank's window is always the hard ceiling
• Once a hold expires, you cannot re-capture — the funds release and you'd have to invoice the customer separately if you still need payment

What Determines How Long an Authorization Hold Lasts

Three factors decide the actual capture deadline for any deposit. Understanding them up front is the difference between setting realistic expectations and getting burned.

The PSP that processed the authorization sets the rules for the underlying API behavior — including whether you can extend a hold, what data gets surfaced about the deadline, and whether eligibility for longer windows depends on your pricing tier. Mollie, PayPal, and Stripe each handle this differently. In PayRequest you choose a payment provider per deposit product, so the choice matters before the customer even pays.

Within each PSP, the actual hold window depends on the network or method the customer used at checkout. Mastercard authorizations live longer than Visa authorizations on the same Mollie account. Klarna and Billie hold differently than card brands. PayPal balance has its own rules. Because you can't predict what the customer will pick, you have to plan for the *shortest* method you're willing to accept, not the longest.

Some PSPs let you opt into a longer-hold feature — Stripe's Extended Authorization is the prominent example. These usually require specific pricing tiers, eligible card brands, and eligible merchant category codes (MCCs). When you qualify, your default hold ceiling jumps from 7 days to up to 30 on supported brands. When you don't, the standard 7-day window applies.

Quick Reference: Maximum Hold Windows by Provider

The table below shows the hold windows PayRequest actually receives from each provider's API, by method. The "Maximum" column reflects what's possible with extensions enabled where applicable; the "Default" column is what you get out of the box.

PayRequest reads the real `captureBefore` (Mollie), authorization expiry (PayPal), or `capture_before` from the latest charge (Stripe) and surfaces it on the deposit detail page and the customer-facing status page. The countdown you see in the dashboard is the deadline the PSP committed to — not a hardcoded estimate.

Mollie: 7 to 180 Days by Payment Method

Mollie is the most common choice for European deposit-heavy businesses because of its method coverage and predictable windows. Mollie returns a `captureBefore` field on every authorized payment, and PayRequest stores and surfaces it directly.

Mollie's card-brand windows follow the network rules quite literally. Mastercard and Cartes Bancaires both hold for 30 days. Visa and American Express hold for 7 days. There is no way to extend either inside Mollie — what the network gives is what you get.

This matters because card brand is decided at checkout, not at deposit creation. If half your customers pay with Visa and half with Mastercard, you have to plan for the 7-day floor on every deposit. Setting the product Hold Duration to 28 days doesn't help: the Visa authorizations still expire on day 7.

For businesses where Mastercard share is high — much of continental Europe, fleet/corporate cards, premium-tier consumer cards — Mollie + Mastercard is the strongest combination in the deposit market. Cartes Bancaires gives French businesses the same 30-day window with a domestically-routed network.

Klarna (28 days), Billie (28 days), and Riverty (30 days) all support manual capture through Mollie and are particularly useful for B2B-style deposits where the customer is invoiced rather than card-charged. Riverty in particular only supports full captures (you can't capture a partial amount), so it's better for fixed-amount deposits than for damage-dependent captures.

These methods are also good fallbacks when the customer's card would have triggered a 7-day Visa window — Klarna/Billie checkout offers them more time on your end without needing the card brand to cooperate.

For Scandinavian customers, Mollie supports Vipps with a remarkable 180-day window and MobilePay with 14 days. Vipps' six-month hold is the longest in the European market and makes it the obvious choice for long-term equipment rentals, deposit-heavy long stays, and similar use cases — provided your customer base is Norwegian or Swedish, where Vipps adoption is near-universal.

The deposit product's Hold Duration field (1–28 days) is PayRequest's internal expiry timer, not a bank instruction. If you set it shorter than the bank's window, PayRequest auto-releases on your day. If you set it longer, the bank's window wins and the hold expires earlier than your product setting.

Use the product setting to enforce your *internal* timeline — for example, "always release within 7 days even if Mastercard would allow 30." Don't use it to try to extend past what the network supports.

PayPal: 3 Days Guaranteed, 29 Days With Auto-Reauthorization

PayPal works fundamentally differently from cards. Instead of one long authorization, PayPal guarantees the funds for 3 days and then lets you call a reauthorize endpoint to extend the honor period for another 3 days, repeatedly, up to day 29 of the original authorization. After day 29, the authorization is permanently dead and cannot be reauthorized.

Tracking 3-day windows manually would be a nightmare. PayRequest runs a scheduled job (`deposits:reauthorize-paypal`) that wakes up daily and finds any PayPal deposit whose `capture_before` is within the next 24 hours. It calls PayPal's reauthorize endpoint, receives a new authorization ID with a fresh 3-day honor period, and pushes the deposit's `capture_before` forward 72 hours. The cycle repeats until day 29 of the original authorization.

From your perspective in the dashboard, a PayPal deposit looks identical to a Mastercard deposit — a rolling countdown to day 29. The 3-day chunking is invisible. You never need to know it happened.

PayPal can refuse to reauthorize if the customer's card on file was cancelled, their PayPal account is suspended, or other rare issuer-side problems occur. When that happens, PayRequest logs the failure and flags the deposit. The hold is no longer guaranteed at that point — the bank may release the funds early. If you still need the money, capture immediately or contact the customer to set up a new deposit.

This is rare in practice (low single-digit percent across our customer base), but it's the reason PayPal effectively maxes at 29 days rather than offering an indefinite extension.

Stripe: 7 Days Default, 30 Days With Extended Authorization

Stripe is the newest deposit provider in PayRequest and the trickiest to plan around because the available window depends on your pricing tier with Stripe. Two scenarios apply.

For Stripe accounts on standard (blended) pricing, the hold expires 7 days after authorization regardless of card brand. PayRequest reads the real `capture_before` from the latest charge in the `checkout.session.completed` webhook and surfaces it on the dashboard. There is no extension path inside Stripe at this tier — 7 days is the ceiling.

This is the default state for most Stripe accounts unless you explicitly migrated to Interchange-Plus pricing. If you're not sure which you're on, check your Stripe dashboard: blended pricing shows a flat percentage (e.g., 1.5% + €0.25 for European cards), while IC+ shows interchange + a markup component.

PayRequest sends `request_extended_authorization=if_available` on every Checkout Session it creates. When the merchant is on Interchange-Plus pricing *and* the card brand + MCC combination is eligible, Stripe automatically extends the hold to up to 30 days. The actual window depends on the brand:

• Mastercard — typically 30 days
• Visa — typically 7 days (extended-auth eligibility is narrower than Mastercard)
• American Express — typically 7 days

Eligibility also depends on your business's MCC. Rentals, hotels, and event venues are typically eligible; retail and SaaS often aren't. The Stripe Provider Settings tab in your dashboard includes a callout explaining how to opt into IC+ pricing — you contact Stripe support directly, because each connected Standard account owns its own pricing relationship.

Stripe deposits cannot be reauthorized the way PayPal deposits can. Whatever window Stripe sets at authorization time is the hard ceiling, so plan captures with a buffer.

Choosing the Right PSP for Your Hold Length

The right PSP depends on your typical service duration, your customer base, and whether you can secure favorable pricing. Use this matrix as a starting point — most deposit-heavy businesses end up with one primary PSP and a secondary fallback.

For most European deposit-collecting businesses, Mollie is the default because the Mastercard 30-day window is reliable, no special pricing is required, and the method coverage (Klarna, Billie, Riverty, Vipps) gives you long-window fallbacks on non-card flows. Stripe is preferable when you need US-issued card support or when your customers strongly prefer Stripe-native methods.

What Happens When a Hold Expires

A hold expires for one of two reasons: either the bank's window ran out, or PayRequest's internal Hold Duration timer fired first. The dashboard treats both identically.

When the expiration happens, PayRequest receives the expiration webhook (Mollie) or detects expiry on the next status poll (PayPal/Stripe). The deposit status changes to Expired with a red badge, the customer's bank releases the held funds (typically within 1–3 business days, sometimes up to 7), and the deposit detail page disables the Capture action. Only the audit history remains visible.

Once expired, you cannot recover the deposit. If you still need to charge the customer for damages or services rendered, you have to invoice them separately and ask them to pay through normal means — which usually means a smart payment link, a new deposit hold, or an invoice with reminders if the relationship is more formal.

This is the single biggest reason to set realistic Hold Duration values: a hold that expires costs you the entire claim, even if the damage clearly happened during the stay. Always capture or release before the deadline shown in the dashboard.

Setting a Sensible Hold Duration on Your Deposit Product

The Hold Duration field on a deposit product (1–28 days) is PayRequest's internal expiry timer. It's useful for ensuring you don't hold customer funds longer than needed, but it doesn't override the bank's window.

For short stays of 1–3 nights, set 5–7 days — enough buffer to capture damages discovered during turnover without inviting the network's 7-day Visa window to expire first. For weekly rentals, 10–14 days is the right range. For monthly rentals, set the maximum of 28 days. For equipment rental, use the rental period plus 2–3 buffer days to allow inspection.

Always add a small buffer beyond the expected service-end date. If the rental ends Sunday, set a Wednesday Hold Duration — that gives you Monday for the inspection, Tuesday to discuss with the customer, and Wednesday as the latest capture day with a safety margin.

Bottom Line

Authorization-hold windows are not one number — they are a function of the PSP, the customer's payment method, and your pricing tier. The shortest realistic window is 3 days (PayPal direct, before reauthorization); the longest is 180 days (Mollie + Vipps). Most card-deposit scenarios fall between 7 days (Visa, Amex, default Stripe) and 30 days (Mastercard, Cartes Bancaires, extended-auth Stripe).

The single most important thing to remember: the product Hold Duration setting is your timer, not the bank's. The bank's window is the hard ceiling. If you set the product to 28 days but the customer pays with Visa via Mollie, the hold still expires on day 7.

For most European deposit-collecting businesses, the right setup is Mollie as the primary provider with Mastercard preferred at checkout, PayPal as the fallback for PayPal-native customers, and Stripe with IC+ pricing only if your customer base requires it. Read more about the card-network angle for the Visa vs Mastercard breakdown, or jump straight into the security deposits feature to see the full deposit workflow.

Sign up for PayRequest free — every feature on the Free plan, 2% per successful payment capped at €25, no credit card required.