Online payments at your hotel: methods, booking guarantees, and security

Friday, nine in the evening, the phone rings: “Hold a double for tomorrow—we’ll pay at the desk.” You write the booking into the Planner and hold the room. Saturday comes and goes, the guest never does, and the date won’t be won back: it’s evening, the channels have their updates, and the demand has gone wherever rooms were still showing available.

An unguaranteed booking is a free option the guest takes from the hotel. In a twelve-room property, one no-show in season isn’t a mere inconvenience—it’s a whole night you can’t sell twice.

A small hotel doesn’t need online payments because “everyone has them.” It needs them because they turn a booking from a promise into a secured obligation. Below: what guests actually pay with, how a deposit hold differs from prepayment, how long a hold sits on a card, and why taking a card over the phone is the worst way to take money there is. Written for a property of 9–30 rooms—with no payments department and no legal team.

Three ways to take a guest’s money

Strip away the details and there are three paths, and they differ in exactly one thing: what happens to the money at the moment of booking.

Pay at the property. The guest books without an online payment; the money arrives at check-in—card at the terminal or cash in the drawer, the payment recorded on the booking card. The simplest path, and the riskiest: until check-in the hotel has nothing but a promise. In the Booking Engine, a rate like this runs with no payment step at all—the guest never sees a card page, and the booking confirms right after their details.

Full prepayment. The guest pays the whole amount when booking. By arrival the booking is paid in full, and the hotel holds not a promise but money—along with the duty to give it back if the guest cancels on the rate’s terms.

Deposit hold. Nothing is charged: the amount is held on the guest’s card by pre-authorization. The guest’s money stays where it is; the hotel gets security. If the guest never arrives, the hold can be captured toward the penalty under the cancellation policy; if they do arrive, it’s released without touching the money.

Model	What happens to the money at booking	The hotel’s risk
Pay at the property	Nothing: the money arrives at check-in	A no-show—the date is lost, and there’s nothing to charge a penalty from
Deposit hold	A hold on the card; the money stays with the guest	The hold falls off if the deposit was taken too early
Full prepayment	Charged at once; the money is with the hotel	Cancellation and dispute: the rate’s rules and your evidence decide

In conversation, all three mechanisms blur into one word—“deposit”—and that’s where the confusion starts. Charged up front: prepayment. Card held, nothing charged: a deposit hold. A security deposit for damage is a third mechanism, about broken kettles and missing towels rather than no-shows, and it stays out of this article. Mixing them is expensive: each has its own mechanics, its own deadlines, and its own argument when the guest is unhappy.

Which path the guest sees isn’t decided at the moment of booking—it’s decided by the rate. One rate takes pay at the property, another full prepayment, a third a deposit; the guest sees the condition in advance, in the booking summary, before confirming. A guest paying by rules they have read is half your dispute prevention. How the three modes work in HotelsCalendar and what a rate sets—on the Booking Engine page.

What guests actually pay with

The card remains the core of remote payment, and that’s not a feeling—it’s statistics. In the ECB’s SPACE 2024 survey (40,981 respondents across 18 euro-area countries, data from 2023–2024), cards account for 48% of everyday online payments by count, with another 29% going to wallets and payment apps. In hotels the card is even more visible than the market average: 46% of transactions here are paid by card—one of the highest shares of any payment location; only durable-goods stores run higher, with gas stations level. Cash’s share by value in hotels is 14%, the minimum of any location.

Wallets are the second-biggest class of payment, and they are growing faster than cards. Per the Worldpay Global Payments Report 2026, digital wallets carry 56% of global online purchase value and 33% of offline purchases. And that is exactly how they work: Apple Pay and Google Pay remove card entry where conversion hurts. The takeaway for a hotel is simple—some guests will never reach for the plastic, and on the provider’s payment page the wallet sits next to the card.

Bank transfer lives in a niche: group bookings, corporate invoices, long stays booked months out. As an everyday method it lost—neither the guest nor the hotel wants to wait for the money to land, and confirming a booking “when the funds arrive” is a separate manual chore that’s easy to forget.

It’s too early to bury cash, whatever the headlines say. In that same ECB survey, cash’s share of hotel transactions by count didn’t fall over two years—it grew, from 25% to 33%, and 62% of consumers consider it important that paying cash be possible at all. The other thing is, cash doesn’t work remotely—which is why the whole online-payments conversation comes down to the card, and to how it reaches the hotel.

In short:

Method	Where it fits	What to remember
Card online	The main path: a booking from your site, payment by link	A payment confirmed by the guest’s bank is your defense in a dispute
Wallets	The same payment step, on the guest’s phone	Some guests won’t reach for the plastic
Bank transfer	Groups, corporates, long bookings	Confirming “when the funds arrive” is manual work
Cash at the desk	Check-in, balances, small services	Doesn’t work remotely at all
Card by phone	Nowhere	No authentication, no liability shift—the section below

A rare row—prepaid cards: convenient for the guest, less guarantee for the hotel, because the card may simply not have enough on it to capture. They don’t come up often, but you want to know about them before a rate with a deposit captures zero.

What it costs. Taking cards isn’t free: the payment provider takes an acquiring fee, and that’s a line of its own in the hotel’s expenses. Don’t confuse it with the price of the management system: a HotelsCalendar invoice carries the subscription only—no commission on bookings, no per-module fees. The three expense lines live separately—subscription, acquiring, channel commission—and the first is fixed while the other two move with turnover.

A separate story is the channels. OTAs—online travel agencies—sometimes take the guest’s money at booking and forward it to the hotel minus commission, and sometimes leave payment at the property. How those models work and what they cost a hotel is in the article on OTAs. One thing matters here: on your own site the payment rule is yours to set in the rate; on the channels, the payment model is part of the channel’s offer.

How much and when: policy instead of persuasion

The guarantee amount is a choice among four standard options, each with its own logic.

The first night. Covers exactly the loss a no-show brings: one empty night. Easy for a guest to agree to, and the hotel doesn’t have to explain where the number came from.

A percentage of the booking. The compromise: on short stays the amount sits near the first night, on long ones it stands out more. Works well where the average length of stay jumps around.

The full amount. That’s a non-refundable rate—a separate product with a discount and hard rules, not “a bigger deposit.” How non-refundable rates are built and when they pay off is in the article on room pricing.

A fixed amount. Handy for properties with rooms at different prices: one clear number instead of arithmetic.

The choice is fixed in the rate, not made at the moment of booking—and that’s the section’s main practical takeaway. A policy the receptionist settles “case by case” mid-conversation doesn’t work: half the bookings leave without a guarantee, and the other half with conditions nobody wrote down.

On a live property this looks like a set of two or three rates, not one answer for every case. A twelve-room city hotel on short stays usually runs the pair: pay at the property for the direct guests the receptionist knows by voice, and a rate with a deposit for everyone else. A seaside property booked two or three months out leans toward prepayment—not out of greed, but because a canceled July date a week before arrival has almost no chance of being resold. Apartments with long stays often pick a fixed deposit: one clear number for any length of stay, no recalculating.

The second takeaway is about timing. An online card authorization doesn’t live long: about seven days, and for Visa captures without the card present the window is shorter—about five days (4 days 18 hours, to be exact). Mastercard, Amex, and Discover give the same seven. That’s how long the hotel has to capture the hold; if no capture happens in that time, the block falls off on its own and the money returns to the guest.

Hence the working rule: take the deposit close to the arrival date, not a month out. The scheme “freeze the card today, capture after check-out” can’t be built from a deposit taken early—the authorization will fall off before the guest finishes the drive. For far-out dates, prepayment works, or a cancellation policy with a penalty; the deposit is a close-range tool.

The third is what happens to the hold afterward. From the booking card, a link goes out to the guest: for the deposit, for the payment, or for both amounts at once. The guest enters the card themselves; the hotel sees none of the data. Once the hold exists, it has three fates: capture it toward the payment, release it without touching the money, or refund what was captured. The mechanics and the buttons are a separate topic, unpacked on the PMS page; what matters for this article is that the deposit’s fate is decided by the hotel, not the gateway.

And an honest boundary: the Guest Portal takes no part in this chain. The portal shows the guest the balance due, but there are no payments in it—payment goes by the link from the booking, on the hotel’s site, or at the desk.

The guest doesn’t show: what happens to the money

The no-show is the case the guarantee exists for. From there everything is decided by the cancellation policy written into the rate: what penalty, how many days out, which way it scales. A booking already standing in the Planner carries its conditions fixed with it—the haggling of “can we skip the penalty, I was going to come anyway” belongs before the booking, not after it.

If the booking carries a deposit, the penalty comes out of the hold: a capture toward the payment, with no new requests to the guest. If it’s on full prepayment, the penalty is set by the rate. If the booking had no guarantee—what happens next is the first paragraph of this article.

A subtlety few talk about: charging a penalty to a guest’s card in their absence works only when the card was confirmed by the guest themselves at booking and the guest agreed to such charges in advance. Then it’s an ordinary charge under a rule the guest saw before confirming. If the card number was dictated over the phone, the charge rests on a promise—and won’t survive a dispute. That isn’t a detail; it’s the dividing line of the whole topic, and we come back to it in the section on the phone.

Cancellations that come in before arrival aren’t the guarantee’s enemy—they’re its input data: bookings release their dates in good time, the freed nights show up in booking pace, and whoever looks at future dates weekly has time to resell the night. How to count that on a property without analytics is in the article on OTB.

Security: what a hotel should actually check

Two abbreviations run through providers’ slide decks on this topic, and both matter—just not for what they seem to.

SCA, strong customer authentication, is the rule by which the bank confirms a payment with a second factor: to the guest it looks like an extra step on their bank’s side. For the hotel it isn’t a burden but protection: a payment the guest confirmed themselves is far harder to dispute as fraud—liability for that dispute sits with the issuing bank, not the hotel. How it works technically and what exactly to ask a provider is in the article on the Booking Engine.

PCI DSS is the payment card data security standard. For a hotelier its meaning fits in one sentence: the fewer of the hotel’s systems touch card data, the fewer requirements land on the hotel. If payment runs on the provider’s page, card data never reaches the hotel at all, and the bulk of the requirements is carried by the provider—it’s their certificate that gets checked, not your guesthouse’s. That’s the lightest scheme there is, and it’s the standard one in systems for small properties.

And now the flip side: data security is not dispute protection. A guest can dispute a perfectly legitimate payment—forgetting the booking, skipping the policy, or simply deciding to get the money back through their bank. No provider cancels that, and it’s exactly why the next section is the most practical one in this article.

Card by phone: the worst way to take a payment

The method looks harmless: the guest calls, reads out the card number, the expiry, and the code; the receptionist writes it down and keys it into the payment. The industry has a name for it—MOTO, mail order / telephone order: taking a card without presenting it, when the guest isn’t there and the card can’t go into a terminal. Older hotel-payments guides still pitch it as a normal option “for guests who dislike paying online.”

Here is the main thing to know about MOTO, and it runs opposite to the usual intuition. Remote payments in Europe are protected by strong customer authentication—but precisely cards taken by phone and mail fall outside that rule: details dictated over the phone are out of SCA’s scope. MOTO is the only way to take a card that comes with neither the guest’s bank confirmation nor any liability shift for a dispute. Zero protection—not “less protection.”

From there it unfolds into three specific problems.

First—the charge may not go through. The guest’s bank is entitled to decline a transaction the cardholder never confirmed, and the hotel has no tool to fix that: retrying charges on someone else’s card is an even worse idea.

Second—the dispute. The guest tells the bank “I never gave them that card,” and the story holds up: there was no authentication, and there is nothing to prove the cardholder’s consent. The burden of proof sits with the hotel, and the hotel has a notebook full of digits.

Third—the data. A card number written on a scrap of paper, in an email, or in a spreadsheet is already card data stored in the hotel, with the standard’s full set of requirements, the fines if it leaks, and the question “how will you prove the guest ever approved this.” A notebook lying on the desk isn’t a payment system; it’s the cheapest form of a leak.

The industry is walking away from manual entry, and not out of politeness: card networks are tightening the monitoring of card-not-present transactions, and some acquirers are winding such payments down. Betting on this method in 2026 means deliberately choosing the option where the hotel has the fewest rights.

Dictation has a second side too—the guest’s. “Is it safe to give a hotel my card details?” is one of the most common questions on this topic, and behind it sits a plain worry: where do the sixteen digits live now. A guest asked to read their card out is in an awkward spot: refusing feels rude, agreeing feels scary. The link dissolves the question itself—the guest types the card on the provider’s page, the hotel sees no digits, the bank confirms the payment. Easier for both: for the guest, and for the receptionist who no longer answers for someone else’s card number.

The replacement is simple and depends on where the guest is. Guest in the hotel—card to the terminal: the card is present, everything’s legal. Guest far away—a payment link: they enter the card themselves on the provider’s page, their bank confirms them, the hotel sees no data. And if a guest offers to dictate the number because “it’s faster,” the honest answer is: the link takes a minute and protects us both.

Chargebacks: what a dispute with a guest costs

A chargeback is a dispute escalated to the bank level: the cardholder challenges the payment with their issuer, not with the hotel. The amount is debited from the hotel’s account at once, together with the card network’s fee—before any review. The hotel assembles the evidence: the policy, the correspondence, the booking confirmation. The response is usually due in 7–21 days, and the issuer’s decision takes another 60–75—so the whole cycle runs two to three months.

The window for filing runs to 120 days, and here’s the detail that surprises everyone the first time: for a future service, the clock doesn’t start at the payment—it starts at the event date. A September booking paid in March can be disputed until the end of December—three months after the guest checked out.

The cost. Per Mastercard and Datos Insights, the world saw 261 million card disputes in 2025, and about 74% of them run all the way to a full chargeback. The average dispute amount in travel and hospitality is the highest of any industry: $120 in the US against $84 in retail. The full cost to a merchant, internal labor included, is $128 per dispute by Javelin’s January 2026 estimate. Sift, a vendor, gives the trend: chargebacks in online travel and lodging grew 816% in a year—a figure to take with caution, but the direction it points is right.

There’s pressure from above, too. Since 2025 Visa has merged its monitoring programs into one and counts dispute rates on card-not-present transactions more strictly—regardless of how the dispute ends: a won chargeback doesn’t reset the counter. For a small property the networks’ thresholds are out of reach, but the direction matters: there is less and less patience for cards the guest never confirmed.

And the last, most unpleasant part: guests rarely start with the hotel. By the same Mastercard and Datos data, about 75% of US cardholders go to their bank first, not to the merchant. Defending after that is nearly useless—the work happens before: the payment runs where the guest confirms themselves; the cancellation policy is written and visible before the booking; a deposit dispute is closed with documents the hotel already has on hand.

What exactly to keep. The cancellation policy in the version the guest saw: a booking fixes its conditions along with itself. The correspondence—including messages where the guest confirms the dates and the rules. The voucher that went to the guest, and the bookings export for the period, if the dispute reaches a review. A folder like that costs a few minutes per booking and closes most of the disputes that otherwise turn into a lottery.

The upshot: a checklist

• An unguaranteed booking is a free option for the guest. If the date is valuable, pick a rate with a deposit or prepayment.
• Don’t mix the three mechanisms: charged is prepayment, card held is a deposit hold, a security deposit is about damage.
• Take the deposit close to arrival: an online hold lives about seven days, about five on Visa.
• The payment condition lives in the rate and is visible to the guest before the booking confirms. “Case by case” is not a policy.
• Don’t take cards by phone or in email: no authentication, no liability shift, and the card data ends up in the hotel.
• Remote payment—by link, where the guest enters the card themselves; payment at the hotel—by terminal.
• A dispute is counted from the arrival date, not the payment: keep a booking’s documents at least until the season ends.
• If this whole layer still lives in a notebook and a messenger for you, look at the minimum software set for a small hotel—in a separate article.

Frequently asked questions

How is a deposit different from prepayment?

Money charged at booking is prepayment: the amount left for the hotel immediately. An amount held on the card without charging is a deposit hold: the money stays with the guest while the hotel holds security it can capture, release, or refund. A security deposit is a third mechanism—about damage to the room, not no-shows. How both modes work in HotelsCalendar is on the Booking Engine page.

How long does a deposit hold last on a guest’s card?

An online authorization lives about seven days; for Visa operations without the card present the window is shorter—about five days—while Mastercard, Amex, and Discover give seven. If the hotel doesn’t capture the hold in that time, the block falls off on its own and the money returns to the guest. That’s why deposits are taken close to the arrival date: a hold “until check-out” can’t be built from a deposit taken a month out. How payment works at the booking step is in the article on the Booking Engine.

How do you take payment remotely once the guest has booked?

From the booking card, a link to online payment goes out to the guest—for the balance due, the deposit, or both amounts at once. The guest enters the card themselves on the provider’s page, their bank confirms the payment, and no card data reaches the hotel. No dictation and no digits written down—which is exactly why a dispute over such a payment is defended with documents, not words. Where the booking card lives is on the PMS page.

Can a booking be paid in the Guest Portal?

No. The portal shows the guest their whole booking—per-day prices, extras, taxes, and the balance due—but there are no payments in it: payment goes by the link from the booking, on the hotel’s site, or at the desk. What the guest sees in the portal and how they get in is on the Guest Portal page.

Is it safe to take card details by phone or in an email?

It’s the worst of the methods. Such a transaction runs without the guest’s bank confirmation and without any liability shift for disputes: the bank can decline the charge, and in a dispute it’s the hotel that must prove its case, holding a notebook full of digits. On top of that, a written-down number is card data stored in the hotel, with everything the security standard demands. The right path is the guest entering the card themselves, by link or at the payment step: how it works.

What is a chargeback, and what can it do to a hotel?

A dispute: the guest challenges the payment with their bank, the amount is debited from the hotel at once together with the card network’s fee, and the hotel assembles the evidence—usually within 7–21 days. The filing window runs to 120 days, and for a future service it counts from the arrival date, not the payment date. The average dispute amount in hospitality is the highest of any industry. Prevention: the guest pays where the bank confirms them, and the cancellation policy is visible before the booking. More on payment confirmation is in the article on the Booking Engine.