Looking for a credit card authorization form? Here's what replaced it.
You're probably here for a template — a guest is checking in, a client is onboarding, the billing run is tomorrow, and everyone says you need "a card authorization form on file." Before you print one: the paper form is a workaround for a problem that has already been solved. What you actually need is the customer's card, safely stored, with their consent attached — and there's a fully digital workflow for that which involves no PDF, no printer, no binder, and no card number in anyone's inbox.
What the form was ever actually for
Strip away the letterhead and an authorization form does exactly one job: it documents that the cardholder agreed to be charged — what for, how much, how often, and for how long. Card networks require that agreement for stored-credential billing, and it's the record you produce when a charge is questioned. Notice what's not on that list: paper. The form was never the requirement. The consent was. Paper was just how consent traveled in 1995 — and it picked up some dangerous passengers along the way.
How the paper workflow keeps failing
The emailed PDF. The modern version of the paper form is a fillable PDF sent to the customer, who types in their full card number — usually the security code too — and emails it back. PCI DSS requirement 4.2.2 prohibits card numbers over email, and the returned form now lives in their sent folder, your inbox, your mail server, and every backup of all three. Indefinitely.
The CVV box. Most templates circulating online include a security-code field. Every signed copy in the drawer is stored sensitive authentication data, which may not be retained after authorization in any form — and which card-on-file billing never needed anyway.
The binder. Completed forms carry full card numbers, so the drawer is now stored cardholder data: in PCI scope, un-auditable, unfindable eighteen months later when a charge is actually disputed, and one break-in away from being a breach with a paper trail in the most literal sense.
The digital workflow that replaces it
A modern capture flow does everything the form did — identity, card, terms, consent, record-keeping — in one motion, with the card going directly from your customer into a PCI-compliant vault. Depending on how your business runs, it takes one of four shapes:
Card request links (no code, no website needed). From the console, send the customer a secure link by email or SMS. They open a vault-hosted page, see your terms, enter their card, and authorize the charges. You get back a vaulted credential with consent attached and the last four digits to recognize it by. This is the direct, one-for-one replacement for "fill out this form and send it back" — same interaction, none of the paper.
A hosted capture form. The same vault-hosted page, but standing: link it from your invoices, your welcome email, or a QR code at the front desk. Customers put themselves on file whenever it suits them.
Embedded fields (iframe or JS fields). If you have a website or customer portal, the card inputs live inside your pages, styled to match — but each field is isolated so the card data posts straight to the vault, never touching your servers. Your onboarding flow captures the card and the consent as one seamless step, and your PCI scope stays where it was: nowhere.
The API. For software-driven operations, your systems drive vaulting, verification, and charging by token end to end — card requests issued automatically on account creation, renewals charged on schedule, expiring cards refreshed by a new link, no human in the loop at all.
Every one of these ends identically: card in the vault, consent on record with it, a token in your systems — and when a charge is ever questioned, the authorization is attached to the very credential that was charged, retrievable in seconds instead of buried in a filing cabinet.
Retiring the binder you already have
The migration is the same one-way motion: send every existing customer a card request link, let fresh consent get captured with each card, and shred paper that carries more than the last four digits as the tokens come back. The binder shrinks a form at a time until it's gone — and from that day forward, "get a card on file" means sending a link, not printing a page.
Frequently asked questions
Do I still need a paper authorization form?
No. The consent is the requirement, not the paper — and consent is captured digitally in the same flow where the customer enters their card, stored with the credential itself.
What was wrong with our emailed PDF form?
Card numbers over email violate PCI DSS 4.2.2, and every returned form leaves copies in sent folders, inboxes, and backups. If it had a CVV box, each signed copy was also prohibited stored data.
How is consent captured without a signature on paper?
On the capture page: the customer sees what will be charged, how often, and how to cancel, and authorizes it as they submit the card. The record lives with the vaulted credential, ready whenever a charge is questioned.
What if my customer only has a phone, or isn't tech-savvy?
The link travels by SMS as easily as email and opens a plain web page — no account, no app, no attachment. If they can receive a text, they can complete it.
What do we do with the old signed forms?
Re-collect each card by secure link with fresh digital consent, then shred paper carrying more than the last four digits. Old forms with full card numbers are stored cardholder data.
Send a link. Get the card and the consent.
Card Vault replaces the form workflow end to end: card request links by email or SMS, hosted and embedded capture, consent stored with the credential, and a virtual terminal or API to charge when it's time. Free for your first five cards.