IT lexicon › Web › Authorization code

Authorization code

Web På svenska → Updated: 2026-10-31

The six characters a card issuer sends back when it says yes to a purchase, printed near the bottom of the receipt.

It travels in field 38 of the ISO 8583 response, next to the response code in field 39 that says whether the purchase was approved. The code is the issuer's receipt for that specific hold, and it comes back into play when the merchant submits the transaction for clearing, reverses it or has to fight a dispute. When the answer comes from the network's stand-in rather than the bank, the code is generated there.

Before terminals were online, the cashier phoned the issuer for anything above the floor limit and wrote the code down by hand. Voice authorization survives as a fallback, and with it a classic fraud: the forced post, where a merchant keys in an invented or stale code and hopes nobody checks. The code proves a yes, not a payment.

← Back to the lexicon