How to charge a customer's card after the rental

Done in that order, a charge after the return is a routine payment. Skip a step and it becomes a refund request, a chargeback or, with a consumer, a clause a court sets aside.

Why not keep the card number from the rental form?

• PCI DSS applies to anyone who stores card data. A form in a drawer, a card photo on a staff phone and a number in an email all count; Stripe warns that handling card data directly can mean more than 300 PCI DSS controls.
• The security code cannot be kept at all. The PCI Security Standards Council says it must not be stored after authorization, card-on-file use included, whatever the customer agreed. Visa's rules forbid even asking for it on a written form.
• A number keyed in later is not a stored credential. Visa requires the card-on-file agreement first, then an authorization or account verification before a card is kept for future charges. When the customer tells their bank "I did not authorise this", a photo of their card is all you have.

What works instead: the customer enters the card on your payment provider's hosted page, and you keep only the brand, the last four digits and the expiry date.

When can you charge a card without the customer there?

In the EU, PSD2 (Article 97) makes the customer's bank apply strong customer authentication (SCA) when the customer initiates an online payment: a code, a fingerprint or an approval in the banking app. After the rental the customer is gone, so a charge cannot rely on that.

It does not have to. The European Banking Authority has answered (Q&A 2018_4031) that card payments initiated by the payee alone, under a mandate the payer gave, are not subject to SCA, while setting up that mandate remotely is. The card networks call these merchant-initiated transactions.

Two limits. The mandate covers only what it says: Stripe allows a saved card to be used only as your terms describe, including the customer's permission, the timing and how you set the amount, and Visa's rules say to use a stored credential only as agreed with the cardholder. And the exemption is not a guarantee: the bank can still ask for authentication.

What must the contract and consent wording say?

Visa's rules list what a card-on-file agreement must contain before the card is stored, including how the amount will be determined, how the card will be used and, for unscheduled charges, the event that triggers them. For a rental, the agreement names every charge that can follow the return:

• The rental price and the security deposit, as amounts.
• Each post-return charge and its price. For example: fuel at €2.10 per missing litre plus a €15 refuelling fee, per your fuel policy; €20 per started hour late after a 59-minute grace period, capped at one extra day; €60 cleaning for sand, pet hair or smoke; tolls and fines at the amount on the notice; damage up to the excess, priced from a repair quote; extensions at the daily rate.
• How each amount is evidenced: fuel and odometer readings at pickup and return, photos, receipts, the authority's notice.
• That you tell the customer the amount and reason in writing before charging, and how long they have to reply.
• The signature on the same page as the damage clause, or initials on every page: that is how Visa's rules want consent to damage charges shown.

With consumers, EU unfair-terms law sets the limit. Under Directive 93/13/EEC a standard term is unfair if, contrary to good faith, it creates a significant imbalance to the consumer's detriment (Article 3); terms must be plain and intelligible, doubt goes the consumer's way (Article 5), and an unfair term does not bind them (Article 6). Its annex names traps rental contracts fall into: a disproportionately high sum for a customer who fails to perform, terms they could not read before signing, and letting the business alone decide whether the service matched the contract, as in "any costs the lessor deems appropriate". Each country applies the directive through its own law; business renters fall outside it.

A price list does a second job. Under PSD2 Articles 76 and 77, a customer can ask their bank, within eight weeks, to refund a card payment you initiated if the authorisation did not fix the exact amount and the charge exceeded what they could reasonably have expected given the contract. A fuel charge that matches the price list signed at pickup is hard to call unexpected.

What do the card rules expect after the return?

Visa's public rules set conditions for "delayed charges" after a vehicle, motorcycle or boat rental:

Damage is stricter. The notice explains the charge, includes any accident, police or insurance report, gives at least two repair quotes for a car, states what insurance covers and tells the customer that paying by card is optional. The customer has 10 business days to send their own estimate, and you wait 20 business days from the confirmation you gave them before charging. While the deposit hold is still on the card, capture from it instead (card deposit holds). Damage found after the release, say a cracked bumper spotted at the car wash, goes on the saved card by this route.

How to charge after the return, step by step

1. Get the card saved before pickup

   In Renviq the customer saves a card on a Stripe-hosted page: from a Request card link you email or paste into a chat, from Save a card in their customer portal, or while booking on your booking page. They confirm it with their bank, under this sentence: "By saving this card you authorise [your company] to charge it for the rental price, the security deposit and any post-return charges set out in your rental agreement." Renviq records when consent was given and under which terms version. Those charges belong in your rental agreement.

2. Record the evidence at return

   Fuel and odometer readings, the return time and photos from the same angles as at pickup, in a vehicle inspection. Keep every receipt and the fine notice.

3. Price it from the contract

   Apply the price list the customer signed. No rounding up, no estimates, nothing the contract does not name.

4. Tell the customer first

   One email: the amount, the reason, the clause, the photos or receipt, and the date you will charge. For damage, follow the notice rules above.

5. Charge exactly that amount

   In Renviq, Charge card on the booking: pick the type (Rental balance, Extras charge, Damage charge, Fuel charge, Cleaning charge or Late return charge), enter the amount and optional notes, then Charge €X. The card is charged at once and the customer is not asked to confirm, which is why the email comes first. Renviq never charges on its own; every charge is a staff action. The default card is charged unless you pick another saved card in the dialog.

6. Issue the invoice or receipt

   One per charge, same amount and reason, from your invoicing.

Card payments in Renviq run through your own Stripe account, connected in Settings → Payments: the money lands in your Stripe balance, Stripe's fees apply, and Renviq charges no fee on card payments today. A card attached outside Renviq's pages, or re-issued under another brand since it was saved, is not charged until the customer links it again. There is no card-terminal integration; terminal and cash payments are recorded by hand.

What if the bank declines or asks for authentication?

An off-session charge fails like any other: no funds, a blocked card, or a request for authentication the absent customer cannot give. Stripe's answer is to bring the customer back to complete the payment. Visa adds a rule: when a merchant-initiated charge on a stored card is declined, notify the customer in writing and give them at least 7 calendar days to pay another way.

In Renviq, a declined charge offers a payment link instead: a Stripe Checkout page for the booking's outstanding balance, emailed to the renter or copied into a chat, where the customer pays and authenticates with their bank. It expires after 30 minutes; if they miss it, send a new one from the booking.

How does this hold up in a chargeback?

A charge after the return is a captured payment, so the customer can dispute it. The consent record and signed agreement answer "I did not authorise this", your email answers "I was never told", and the inspection and receipts answer "the amount is wrong". The chargebacks guide covers how to submit them. In Renviq, refunds are made from the booking, disputes are tracked, and your team is emailed when one closes. For a customer who refuses to pay for damage at all, see damage payment disputes.

Common mistakes

• Charging before telling. The customer finds it on their statement and calls their bank, not you.
• Charging the deposit amount "to cover everything". Charge the receipt, not the ceiling.
• Adding fees the contract does not name, such as an admin fee per traffic fine. In August 2026 Spain's consumer authority fined a large rental company €1 million over exactly that fee.
• Hammering a declined card. Send the link and give the customer time.