Vacation Rental Security Deposit: Hold, Charge or Waiver

On Airbnb and Vrbo, the platform supplies the damage mechanism. A reservation taken on your own website arrives with none, and the host has to pick one before the guest does: a hold on the card, a deposit that is charged and refunded, or a non-refundable damage waiver.

The timing is not abstract. Vrbo moves hosts to a 12% commission on October 29, 2026, holiday weeks are being booked now, and each stay that shifts to a direct channel lands on the host's own payment processor.

Most guidance treats the deposit as a policy choice. It is closer to a payments problem: a card hold expires on a clock the card networks set, a refunded charge costs money every time, and a waiver makes the host an insurer unless a third party stands behind it.

Key facts

• Airbnb says "most hosts are not allowed to charge security deposits, either through our Resolution Center or outside the Airbnb platform" (Airbnb Help Center, article 140, read October 4, 2026).
• Vrbo's guest-paid Property Damage Protection costs $59 for $1,500 of cover, $89 for $3,000 and $119 for $5,000 (Vrbo Help, read October 4, 2026).
• An online card authorization is valid for 7 days on a customer-initiated Visa, Mastercard, American Express or Discover payment, and for 4 days and 18 hours on a merchant-initiated Visa payment (Stripe documentation, read October 4, 2026).
• Stripe does not return its processing fee when a payment is refunded (Stripe Support, read October 4, 2026). At 2.9% plus $0.30, a $500 deposit that is charged and refunded costs the host $14.80.
• A partial capture releases the rest of the hold, and the difference cannot be captured later (Stripe documentation).

What Airbnb and Vrbo do, and what disappears on a direct booking

Airbnb replaced the deposit with a claims process

Most Airbnb hosts cannot charge a security deposit on or off the platform, with limited exceptions for select software-connected hosts and for hotels. A separate article adds that hosts "aren't permitted to collect any fees related to Airbnb reservations outside of our platform, unless expressly authorized by us." Damage runs through a reimbursement request instead, a process covered in our analysis of Airbnb's April 2026 damage claim rules.

Vrbo's menu: three waiver tiers, a card on file and a 14 day clock

Vrbo still offers both instruments. A host can enable Property Damage Protection, which the guest buys at one of three price points, or set a damage deposit. A deposit of $5,000 or less is kept as a card on file; anything larger is charged as a refundable deposit at booking. Vrbo tells guests that a card on file carries "no pre-authorization hold" and is charged only if the host files a claim.

The deadline matters more than the amount. A Vrbo host has 14 days after checkout to assess the property and submit a claim.

What a direct booking does not inherit

None of that follows the guest to your own checkout. There is no stored card held by a third party, no claims desk, and no 14 day window unless your rental agreement creates one.

The platforms never covered everything, either. Vrbo's host page states that its "$1M Liability Insurance does not cover damage caused by a guest to your property." Expedia Group announced a broader program, Host with Confidence, on September 1, 2026, describing it as "currently in beta" and aimed at property damage, chargebacks and income lost to cancellations caused by guest damage. No limits, prices or terms had been published as of October 4, 2026.

Option 1: the card hold, and the clock most hosts miss

A hold, formally an authorization, reserves an amount on the guest's card without moving the money. It is the gentlest option, provided it is still alive when you need it.

How long an authorization lasts

Stripe's documentation, which reflects card network rules, lists the windows for online payments. A customer-initiated transaction (one where the cardholder takes part in the payment, such as entering card details at checkout) holds for 7 days on Visa, Mastercard, American Express and Discover. A merchant-initiated transaction (a saved card charged without the guest present) holds for 7 days on three of those networks but only 5 on Visa, and Stripe notes that "the exact authorization window is 4 days and 18 hours."

When the window closes before capture, "the funds are released and the payment status changes to canceled."

The Thanksgiving week example

Take a 7 night stay with check-in at 4:00 p.m. on Sunday, November 22, 2026 and checkout at 10:00 a.m. on Sunday, November 29.

Booking software places a deposit hold on the guest's saved Visa at check-in. That is a merchant-initiated hold: 4 days takes it to 4:00 p.m. on Thursday, November 26, and 18 more hours ends it at 10:00 a.m. on Friday, November 27. The hold dies two full days before the guest leaves.

Work backward instead. For the same hold to survive until the 10:00 a.m. checkout, it can be placed no earlier than 4:00 p.m. on Tuesday, November 24, which is two days into the stay and still leaves no time to inspect. A customer-initiated hold placed at 4:00 p.m. on arrival day runs 7 days and expires at 4:00 p.m. on November 29, six hours after checkout.

A hold taken when the guest books three weeks out protects nothing at all.

Stripe adds that the networks classify a payment from "signals of cardholder participation, not solely on API parameters." The reliable check is the expiry time your processor reports for each hold.

The partial capture trap

Suppose the hold is $1,000 and the cleaner finds a broken lamp worth $200. Capture $200 and Stripe automatically releases the remaining $800; a second capture for the difference is not possible on most payments. Finish the inspection, total the loss, then capture once.

Extended authorization: 30 days, with conditions

Longer holds exist. Stripe's extended authorization reaches 30 days for lodging merchants on Visa (exactly 29 days and 18 hours), Mastercard, American Express and Discover. Three conditions narrow it. Stripe offers the feature to accounts on interchange-plus pricing, while accounts on its standard blended pricing must ask support for access. American Express requires capture "no later than the end of your customer's stay." And Stripe warns that for many networks, extended windows apply only when the final amount is unknown at authorization. Ask your booking software's support team whether it requests extended holds at all.

Option 2: charge and refund, and what it costs every time

Charging the deposit as a real payment and refunding it after inspection removes the expiry problem. It introduces a cost.

Stripe's published US rate, checked October 4, 2026, is 2.9% plus $0.30 per successful domestic card transaction, and Stripe keeps that fee when the payment is refunded. On a $500 deposit: $500 × 2.9% = $14.50, plus $0.30, equals $14.80. A host with 40 direct bookings a year spends 40 × $14.80 = $592 to hold money that was always going back. Measured against the deposit itself, that is $14.80 ÷ $500 = 2.96% per booking. Rerun the numbers with your own processor's rate.

Guests feel it too. The money leaves their account, and even Vrbo warns its guests that after a deposit is released, a bank "may take five to seven working days" to return it. A guest who did not expect a $500 charge is a dispute risk, which is where chargebacks in short term rentals enter the picture.

Option 3: the non-refundable damage waiver

A waiver replaces the refundable deposit with a small fee the guest does not get back. In exchange, accidental damage up to a stated limit is forgiven.

The price guests already see

Vrbo's tiers give a public benchmark. Divide each price by its limit:

• $59 ÷ $1,500 = 3.93%
• $89 ÷ $3,000 = 2.97%
• $119 ÷ $5,000 = 2.38%

A direct booking waiver priced at $59 that forgives less than $1,500 is worse value than the one a Vrbo guest already knows.

Who is the insurer

Forty bookings at $59 collect 40 × $59 = $2,360 a year. Compare that with the $592 a charge-and-refund deposit would have cost over the same bookings: the waiver turns an expense into income. The catch is on the other side of the ledger. Unless a third-party product pays the claims, every forgiven loss comes out of that $2,360, and a single $3,000 incident erases more than a year of fees.

Two rules keep a waiver honest. Write down what it excludes (intentional damage, rule violations, losses above the limit) before the guest pays. And if the fee is mandatory, it belongs in the advertised total: the FTC's fee rule, in effect since May 12, 2025, covers short-term and vacation rentals and requires the displayed price to include charges a guest cannot reasonably avoid.

How much should a deposit be?

Size it against what guests plausibly break, not against a round number. A $500 deposit set against a $2,000 loss recovers $500 ÷ $2,000 = 25% of it.

Read that way, a deposit works like a deductible. It handles the lamp and the missing linens; a kitchen fire belongs to the insurance gap most hosts carry without knowing.

What to set up before the next direct arrival

1. Pick one mechanism per property and state it on the listing page and in the rental agreement, with the amount, the trigger and the timeline for release.
2. For saved-card charges, get written consent. Stripe's guidance on merchant-initiated transactions says your terms should cover the customer's agreement to the charge, the anticipated timing and how the amount is determined, and that you should keep a record of each agreement.
3. If you use holds, find out when your software places them and read the expiry time on a live one. Stays longer than about five nights need a later hold, a second hold or a different mechanism.
4. Set your own claim window in the agreement. Vrbo's 14 days is a reasonable reference point.
5. Photograph the property at every turnover with timestamps, so that any capture is backed by a before and an after.
6. Run a test transaction on your own card and watch what the guest sees, including the statement descriptor.

What to watch next

Vrbo's Host with Confidence has no published terms yet. Authorization windows also change: Stripe notes that network rules "can change without prior notice".

Hosts who would rather not act as their own insurer can use a third-party damage protection product. Haven, which builds branded direct booking websites, makes guest screening and damage protection available through Truvi.

FAQ

Can Airbnb hosts charge a security deposit?

Mostly no. Airbnb's help center says most hosts are not allowed to charge security deposits, either through its Resolution Center or outside the platform, with limited exceptions for select software-connected hosts and hotels.

How long can I hold a guest's credit card for a damage deposit?

According to Stripe's documentation as of October 4, 2026, a standard online authorization lasts 7 days when the guest initiates the payment, and 4 days and 18 hours on Visa when the host charges a saved card without the guest present. Extended authorizations of up to 30 days exist for lodging merchants, subject to pricing plan and card network conditions.

Is a damage waiver better than a refundable security deposit?

It depends on who pays claims. A waiver produces fee income and avoids refund costs, but the host absorbs every covered loss unless a third-party product backs it. A refundable deposit costs about $14.80 per $500 on Stripe's standard US rate when charged and refunded, and recovers only up to its own amount.

What happens if the damage costs more than the deposit?

The deposit covers only its own amount. Anything beyond it has to come from the guest voluntarily, from a damage protection product, or from the host's insurance policy.