Security Deposits for 30+ Day Rentals: Why Your Credit Card Hold Expires Before the Stay Ends
A corporate housing operator in Amsterdam rented a serviced apartment to a consulting firm for 90 days. It took a €1,500 damage deposit as a card hold on the first day, which is standard practice and was carried out professionally. On day 29 the hold expired automatically. Neither party was notified, and nothing changed in the operator's dashboard. On day 78 the guest caused €2,400 of damage. There was no enforceable hold, no captured deposit and no practical recourse; small claims court would have cost more than the damage was worth, and the operator absorbed the entire loss.
The failure was not unusual. Credit card holds expire after about 28 days, a limit set not by Stripe, Airbnb or any software vendor but by the card networks themselves, and it applies to everyone who takes deposits by card hold, everywhere. For the whole mid-term rental category, defined as stays of 30 days or longer, the deposit protection runs out before the tenancy does, silently and without notice to either side. The fact decides whether a furnished rental business is protected or exposed, and it almost never comes up in the marketing for property management software.
What a hold is, and what it is not
The terms are often used interchangeably, but they mean different things. A pre-authorization, or hold, asks the tenant's bank to set money aside without taking it. The tenant sees a reduced available balance, but no money moves and nothing lands in the operator's account. A capture, or charge, actually takes the money, which arrives in the operator's account to be held there. A refund returns captured money to the tenant.
Most furnished rental operators use holds, because a hold feels lighter to the tenant and does not tie up the tenant's cash for good. That instinct is right for a weekend booking. It stops being right on day 29.
How long a hold lasts
| Card network | Maximum hold length |
|---|---|
| Visa | 28 days |
| Mastercard | About 30 days |
| American Express | About 30 days |
| Discover | About 30 days |
When the window closes, the hold releases automatically and the tenant's money is freed. The operator's dashboard does not change, no email goes out, and in most systems nothing on the booking record shows that the protection has quietly ended. Because Visa has the shortest window and is extremely common, 28 days is the number worth planning around.
The uncovered weeks
The arithmetic on a standard corporate housing booking is stark. The average corporate stay runs 90 days. A hold placed on day zero releases on day 28, leaving 62 days of the stay with no deposit protection at all. That is 69 percent of the tenancy running uncovered, and it is the wrong 69 percent.
Risk in a furnished rental does not stay flat across a stay; it climbs. Wear accumulates faster in furnished units than in empty ones, because the tenant is using the operator's sofa, mattress and kitchen equipment rather than their own. Unauthorized extra occupants tend to appear in weeks five through eight, when a corporate tenant's partner moves in. Disputes over condition get harder to settle the longer a stay runs, because damage could plausibly have happened at any point across several weeks. Utility overages and noise complaints surface late. The deposit is meant to cover all of that, and the card network covers 28 days of it.
This is not an edge case. It is a routine failure in an industry where most operators do not know the limit exists.
Three methods that work past day 28
There are essentially three ways to secure a deposit across a long stay, and they suit different situations.
The first is rolling re-authorization. The operator places a €1,500 hold on day zero, places a fresh €1,500 hold on day 25 and releases the first, and repeats the cycle every 25 days for the length of the stay. It works cleanly on two conditions. The tenant needs enough available credit to cover a short overlap when both holds exist, and the operator needs a system that schedules the re-authorizations automatically, because doing it by hand across a portfolio guarantees that someone eventually forgets. Most platforms lack that scheduling.
The second is capture and refund: charging the deposit on day zero and refunding it at the end of the stay, minus any deductions. This is the default in bank-transfer markets such as the Netherlands, Germany and Belgium, where payment systems like SEPA, the European bank transfer network, and iDEAL, the Dutch bank payment method, are used instead of card holds. It is also the norm for corporate clients generally, who are used to paying invoices rather than presenting a card. Its accounting requirements are strict, as described below.
The third is a formal deposit invoice, delivered through a customer portal that shows its refund status. For operators serving corporate clients and relocation companies it is the cleanest option, and it doubles as a paper trail if part of the deposit is later withheld, because every step is timestamped and visible to both sides.
| Rolling re-authorisation | Capture and refund | Deposit invoice | |
|---|---|---|---|
| Money actually moves | No | Yes | Yes |
| Best for | Card-based consumer markets | Bank-transfer markets and corporates | Corporate and relocation clients |
| Tenant needs available credit | Yes, including an overlap | No | No |
| Main requirement | Automated re-auth scheduling | Correct liability accounting | Portal and invoicing |
The platforms do not solve this. Airbnb's hold model works correctly for stays under 30 days and fails silently beyond that line. Furnished Finder has no platform-managed deposit handling at all, so rent moves by bank transfer and the deposit is entirely the operator's problem.
The accounting rule that catches operators
A captured deposit sits in the operator's bank account, but it does not belong to the operator. It is held on the tenant's behalf and will most likely be returned. In accounting terms it is a liability, something owed, usually recorded under a heading such as "Tenant Deposits Payable." It is not income and must not be recorded as rent received.
The distinction matters more than it sounds. Operators whose books record captured deposits as income end up paying tax on money they are going to refund, and receive notices from their state revenue department about tax collected on deposits.
A deposit passes through four distinct states, and most systems handle only two of them properly. While it is held as a pre-authorization, it does not appear on the books at all; the tenant's bank has reserved the funds, and the ledger correctly shows nothing, because the position is contingent rather than an asset. Once captured, it is a liability, not income. Once refunded, it returns to zero with no effect on profit or loss. When part of it is applied to damage, that portion becomes income or offsets an expense and is taxable, and the rest is refunded.
DoorLoop and AppFolio both have trust accounting modules that handle bank-held deposits competently. Trust accounting is simply the discipline of keeping money that belongs to someone else separate from one's own. Very few systems handle the specific path of capturing a card deposit and later applying part of it to damage, with the correct treatment at each step.
For operators working across borders, the problem doubles. European operators typically capture and refund by bank transfer, while American operators typically use card holds. An American operator serving European corporate relocations is effectively running two incompatible deposit systems at once, usually without software that understands the difference.
What operators can do
Operators who take deposits by card for stays of 30 days or more have three practical options, in rising order of effort. They can track it manually, setting a reminder on day 25 of every stay to re-authorize; that works at five units and fails at 20. They can switch to capture and refund for long stays, making sure the bookkeeping records the captured deposit as a liability rather than income. Or they can use a system that models the full life cycle of a deposit, so re-authorization is scheduled automatically and each accounting state is tracked as a distinct event.
The one approach that is not viable is the one most operators run today: placing a hold on day zero and assuming it is still there on day 78.
RentOS, the company that publishes this blog, builds software for stays of 30 days and longer, with deposits modeled through all four states, automatic scheduling of re-authorizations and captured deposits treated as liabilities rather than income. Book a demo at rrentos.com.
Frequently asked questions
Why do credit card holds expire after 28 days? It is a limit set by the card networks, not by any individual platform or payment processor. Visa releases pre-authorization holds after 28 days, and Mastercard, American Express and Discover after about 30. The hold releases automatically regardless of the length of the booking, which means every stay in the mid-term category outlasts its own deposit protection.
How can I secure a deposit on a stay longer than 28 days? Three approaches work: re-authorizing on roughly a 25-day cycle with a brief overlap, capturing the deposit as a real charge and refunding it at checkout with correct liability accounting, or issuing a formal deposit invoice through a portal with a documented refund trail. The right choice depends on the market. Capture and refund is standard in European bank-transfer markets and for corporate clients, while rolling re-authorization suits card-based consumer markets.
Is a captured security deposit income? No. A captured deposit is a liability, normally recorded as something like "Tenant Deposits Payable," and must not be booked as rental income. If part of it is later applied to damages, that part becomes income or offsets an expense and is taxable, while the remainder is refunded with no effect on profit or loss. Systems that record captured deposits as income can trigger tax notices from state revenue departments.
Does Airbnb handle deposits correctly on long stays? Airbnb's hold model works as intended for stays under 30 days. Beyond that it fails silently, because the underlying card hold expires on the network's schedule regardless of the length of the booking. Furnished Finder provides no platform-managed deposit handling at all, so the deposit is entirely the operator's responsibility.
Will I be told when a hold expires? Generally not, and that is the heart of the problem. The release happens at the card network, neither the operator nor the tenant receives a notification, and most property management dashboards show no change on the booking record. Unless the operator's system tracks the expiration date itself, the first sign that the hold is gone comes when the operator tries to claim against it.