A corporate-housing operator in Amsterdam rents a serviced apartment to a consulting firm for a 90-day assignment. The contract includes a €1,500 damage deposit, standard practice for the industry. The operator tries to collect it the same way a short-stay host would — a credit-card pre-authorization hold. Twenty-eight days in, the hold expires automatically, the guest never notices, and now the operator has no protection for the remaining two months of the stay.
The same story plays out in every extended-stay segment: corporate relocations, traveling nurses, aparthotels, digital-nomad rentals, month-to-month serviced apartments. The tools that work perfectly for weekend bookings fall apart the moment a stay crosses the 28-day card-network limit.
Extended-stay security deposits are solvable, but they need a different playbook. This guide explains the three strategies that actually work for stays longer than 28 days, when to use each one, and how to set them up without juggling four different tools.
Key Takeaways
- Credit-card pre-authorization holds expire after 28 days — a hard limit set by Visa and Mastercard, not a platform limitation
- Three strategies work for extended stays: rolling re-authorization, captured-and-refunded deposits, and the hybrid invoice model
- Rolling re-authorization fits stays up to ~90 days where the customer has a single, well-limited credit card
- Captured-and-refunded deposits are the default for stays over 90 days or when cards aren't practical (SEPA markets, corporate clients)
- The hybrid invoice model combines a formal deposit invoice with a customer portal for refund visibility — the cleanest option for B2B extended-stay operators
- PayRequest supports all three patterns through a single dashboard, so you pick per booking rather than per platform
What Makes Extended-Stay Deposits Different
A short-stay security deposit has a simple lifecycle: authorize on check-in, release or capture on check-out, all within a week. The 28-day card-network hold limit is irrelevant because the whole rental ends well before it matters. If you're new to deposit workflows, start with our pillar guide on how to collect a security deposit online before continuing.
Extended stays break this model. Once a booking crosses 28 days, you're no longer protected by the original authorization — it has expired or will expire before you've inspected the property. Corporate housing, aparthotels, and relocation rentals routinely run 30 to 180 days or longer. Serviced apartments often bill monthly with an open-ended tenancy. You need a deposit workflow that matches the booking duration, not one designed for weekend visits.
This limit exists because of how the card networks settle authorizations. When you pre-authorize a card, the issuing bank reserves the amount for a fixed window — 28 days for Visa and most Mastercard categories, slightly longer for specific merchant categories like lodging. After the window, the reservation releases automatically, regardless of whether you captured it. You cannot extend a single authorization past the limit — the networks explicitly prohibit it.
Operators sometimes discover this the hard way when they try to capture on day 45 of a two-month rental and the capture fails silently. By then the funds have been available to the guest for two weeks, and recovering damages means chasing a bank transfer the same way you would without any deposit at all.
Beyond the technical limit, extended stays introduce risk patterns that short stays don't have. Wear and tear accumulates. Unauthorized subletting happens. Property-condition disputes are harder to resolve because damage could have occurred at any point over weeks or months. Utility overages and noise complaints materialize late in the stay. Your deposit strategy needs to anticipate these patterns, not just protect against an end-of-stay inspection.
Three Strategies That Work for Extended Stays
There is no single right answer. The best strategy depends on stay length, customer type (B2B vs individual), preferred payment methods in your market, and how much operational overhead you can absorb. Here are the three patterns that actually work in practice.
For stays up to about three months, the cleanest approach is to rotate through multiple 28-day pre-authorizations. You authorize €1,500 on check-in, and around 25 days later you authorize a new €1,500 hold on the same card and release the first one. Repeat until the stay ends.
This works when the customer has a single credit card with enough available credit to support the overlap window (roughly three days where both holds are active). It requires no conversation with the guest at each renewal — the re-authorization happens silently on the card, exactly like the initial one. At the end of the stay, you capture from the most recent active authorization.
The operational overhead is minimal if your deposit platform supports automated re-authorization workflows. PayRequest's security deposit feature includes re-auth scheduling so you don't have to manually trigger the rollover. The main failure mode is a card that gets cancelled, reissued, or hits its credit limit mid-stay. For that, keep a second payment method on file or fall back to Strategy 2.
For stays longer than three months, or in markets where guests prefer SEPA, iDEAL, or Bancontact over credit cards, the cleanest option is to charge the deposit upfront as a regular payment and refund it after check-out. The money sits in your account during the stay — exactly like a traditional cash deposit — and you refund what's left.
This approach is legally robust, works with any payment method, and has no time limit. The trade-off is cash-flow and accounting friction: the deposit appears as revenue on your books until refunded, you have to manage the refund workflow explicitly, and some tax jurisdictions treat held deposits differently from pre-authorizations for VAT purposes. Consult your accountant before committing to this model at scale.
For operators in the Netherlands, Belgium, and Germany — where iDEAL and SEPA dominate — captured deposits are often the only practical option for extended stays. They're also the norm for corporate clients who prefer bank transfers and don't want to tie up credit-card lines for months.
The third option — and the one most corporate-housing and aparthotel operators converge on — is to collect the deposit as part of a formal invoice alongside the first month's rent. The deposit appears as a separate line item, the invoice is paid as a single transaction, and the refund is issued via credit note at the end of the tenancy.
This model is B2B-friendly: finance departments can reconcile the deposit against the invoice, the deposit has a clear tax treatment (usually VAT-exempt as a refundable security), and the customer portal shows both the original invoice and the final credit note. For operators running multiple simultaneous extended-stay bookings, the invoice model also aggregates cleanly into monthly reporting.
PayRequest's invoicing feature supports deposit line items with automatic credit-note generation on refund. Combined with the customer portal, the guest or corporate client can see the deposit status, download the invoice, and view the refund projection at any time — without emailing you to ask.
Choosing the Right Strategy by Scenario
Match the strategy to the customer's payment context, not your operational preference. B2B customers want invoices. Individual guests in SEPA markets want iDEAL or Bancontact. US and UK guests are comfortable with card pre-authorizations. Your deposit workflow should adapt per booking.
| Scenario | Typical Length | Best Strategy |
|---|---|---|
| Aparthotel monthly guest | 30–60 days | Rolling re-authorization |
| Corporate housing (consulting assignment) | 60–180 days | Hybrid invoice model |
| Traveling nurse (13-week contract) | ~90 days | Rolling re-auth or invoice |
| Relocation rental | 30–90 days | Hybrid invoice model |
| Long-term vacation rental | 30–90 days | Captured and refunded |
| Serviced apartment (month-to-month) | Open-ended | Hybrid invoice model |
| Digital-nomad rental | 30–180 days | Rolling re-auth or captured |
If the booking is B2B and an invoice is expected, default to Strategy 3. If the guest is paying personally and comfortable with a credit card, default to Strategy 1. If neither fits — usually because of payment-method preference — fall back to Strategy 2.
Legal and Disclosure Considerations
Extended-stay deposits sit in a different regulatory bucket than short-stay deposits in many jurisdictions. In the Netherlands, residential rental deposits are capped at two months' rent for contracts longer than six months, and held deposits must be placed in a separate account. Several US states — California, New York, and Massachusetts among them — require landlords to hold deposits in interest-bearing escrow accounts for long-term tenancies. Germany's Mietkaution rules prescribe how and where deposits must be held for residential contracts.
For commercial or corporate-housing arrangements, the rules are typically looser, but disclosure is still critical. Your rental agreement should specify the deposit amount, the capture conditions, the refund timeline, and the interest treatment if applicable. PayRequest's deposit pages show the capture terms before the customer authorizes, which satisfies the disclosure requirement in most jurisdictions — but check your local rules with a lawyer before treating this as sufficient.
One often-missed point: if your extended-stay operation crosses the line from "accommodation" into "residential rental" under local law (typically stays over 30, 60, or 90 days depending on jurisdiction), tenant-protection laws may kick in. That can affect both the maximum deposit you're allowed to hold and the permissible reasons for capture. Don't assume your short-stay deposit workflow maps cleanly onto long-term tenancies.
How to Set It Up in PayRequest
All three strategies work inside a single PayRequest dashboard, so you don't need separate tooling for short-stay and long-stay bookings.
For rolling re-authorization, create a standard security deposit link with the re-authorization schedule enabled. PayRequest handles the 28-day rollover and emails you if the rollover fails so you can contact the guest before coverage lapses.
For captured-and-refunded deposits, create a regular payment link for the deposit amount and enable SEPA, iDEAL, Bancontact, or card payments depending on your market. Tag the payment as "Deposit - [guest name]" so it's easy to find when you issue the refund. At check-out, trigger a refund from the dashboard — or automate it via the customer portal if the guest signals check-out.
For the hybrid invoice model, create an invoice with two line items: first month's rent (or the relevant period) and a refundable deposit. Use invoicing with recurring billing attached via subscriptions for the rent portion while keeping the deposit as a one-off. At end of tenancy, issue a credit note for the deposit portion, and the customer portal reflects both the original invoice and the credit note.
Frequently Asked Questions
No. The 28-day window is a hard network rule, not a platform limit. The best you can do is re-authorize a new hold before the old one expires. For stays longer than 90 days, the operational overhead of repeated re-authorizations usually makes the captured-and-refunded or invoice model more practical.
The original authorization remains intact until its 28-day expiry, but you won't be able to re-authorize the replacement card without the guest actively providing the new details. Build a check-in on day 25 of the rolling re-auth cycle into your operations — a short "is this still your card?" email — so you catch replacements before the current hold lapses.
It depends on your jurisdiction and accounting treatment. In most EU countries, a refundable deposit held in trust is not treated as revenue — it's a liability. Once you capture all or part of it for damages, the captured portion becomes taxable income. Check with your accountant, especially if you're running at scale. The rules differ sharply between short-stay and residential tenancy contexts.
Document on check-in and check-out with dated photos at minimum. For corporate-housing operations, many operators run a mid-stay inspection (typically month 1 or month 2) with the guest's consent. The mid-stay inspection also serves as a natural re-authorization moment if you're on Strategy 1. Keep all photos, inspection notes, and guest communications in one place — PayRequest's activity log on each booking gives you a single timeline to reference in a dispute.
Yes, and this is how most serviced-apartment and aparthotel operators run their books. The monthly rent bills through recurring subscriptions; the deposit sits as a separate one-time authorization or invoice line item. Both appear in the same customer portal, and both are managed from the same dashboard. At end of tenancy, the subscription cancels and the deposit refunds or captures independently.
Ready to Collect Extended-Stay Deposits That Actually Work?
Extended-stay rentals deserve a deposit workflow built for them — not a short-stay workaround that leaves you exposed after day 29. Whether you're running corporate housing, an aparthotel, a serviced-apartment portfolio, or a long-term vacation rental, PayRequest supports all three deposit strategies in one place.
Start your billing portal — €20/month includes security deposits with re-authorization, invoicing with credit notes, subscription billing, and the customer portal. One tool for every booking length, short or long.