Ran into this on a rental deposit flow: authorize at booking, capture at checkout, sometimes 10-12 days later.
Visa releases an authorization hold after 7 days for most MCCs (30 for hotels/car rental if flagged correctly). Mastercard varies by issuer but often defaults to shorter windows unless the merchant category signals otherwise. Nobody puts this in a response code. The auth just quietly stops being valid on the issuer's side while your system still shows it as "approved, pending capture."
What actually happens when you try to capture past expiry depends on the processor: some return a generic decline, some auto-convert it into a new sale (re-authorizing at capture time, which can fail if the card was replaced), some just settle it anyway and let the acquirer eat the risk until a dispute surfaces.
We had zero visibility into which of those three would happen for a given transaction until it happened. Ended up building a nightly job that flags any pending capture older than 5 days and forces a fresh authorization check before the actual charge.
Curious how others handle this — do you track hold expiry per-card-network in your own ledger, or just let the processor's capture response tell you after the fact?
