# Design a credit card authorization system: system design interview question

> Fast credit decisions across shared accounts, with holds, duplicate requests, late events, and uncertain outcomes after failures.

Source: https://sysround.com/questions/design-credit-card-authorization-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a service that approves or declines card transactions using available credit, card controls, and account status. It must handle holds, reversals, and duplicate requests within strict latency limits."

## What to clarify first

- Scale and traffic
- Account identifiers
- Latency
- Credit and controls
- Consistency
- Hold lifecycle
- Duplicates and message order
- Durability and retention
- Regions and failures
- Scope boundaries

## Scope of a strong answer

Core requirements:

- Approve or decline requests against account credit, card controls, and account status.
- Reserve credit with holds and release credit after reversals or expiry.
- Return the original decision for duplicate requests.
- Apply each full capture at most once.

Usually out of scope:

- Card network protocols and card secrets
- Fraud models
- Payment collection, interest, and fees
- Disputes, refunds, and the full settlement process

## What interviewers probe

### Credit and account controls

Several cards share credit, but each card also has separate controls. Every approval must obey both sets of limits.

### Repeated requests and lost responses

A caller can lose the response after a valid approval. A repeat must recover that decision without a second hold.

### Changes to a hold

Reversals, expiry, and captures change different parts of available credit. Late events must not release credit twice.

### Decision deadlines and failures

The service must decide within 150 milliseconds. A fast response must not compromise the credit records.

## Common mistakes

- Treats available credit as a value that each server can read and update independently.
- Uses a card lock even though several cards share one account.
- Treats a timeout as proof that the transaction failed.
- Saves duplicate results separately from the financial transaction.
- Requires an authorization record to find the account for an early reversal.
- Releases credit twice when a reversal, capture, or expiry repeats.

## The bar by level

- **Senior:** Handles shared credit, daily controls, and freeze races. Defines account routing and identifier scope. Explains uncertain commits, early reversals, late captures, expiry races, and latency budgets.
- **Staff+:** Defines partition boundaries and safe failover rules. Connects durability to response semantics. Plans audit retention, reconciliation, overload control, and high-volume account limits.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=card-authorization


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.