How to Take Deposits for Bike Hire: Amounts, Card Holds, Release and Claims

01Three payments, one word: what “deposit” means

Shops use “deposit” for at least three different payments, and one word covers different legal positions. Settle which one you mean before you set an amount.

Two things sit beside these and are not deposits:

• ID left as security. Some hire shops keep a driving licence, passport or ID card for the hire. We did not research the law on holding an original document, and we would not rely on it. If you copy or photograph ID, you take on data-protection duties (section 7). A card hold does the same job without a document in a drawer.
• A non-refundable booking fee. A fee you keep whatever happens, on top of the hire price, is a mandatory charge and belongs in the headline price (CMA209 paragraph 4.4 lists “booking or processing fees”). It is not a deposit.

A deposit and a damage waiver can sit together: the customer pays a waiver price, and the security hold becomes smaller or goes away. That is a pricing choice for your rate card, not a legal requirement.

In Portugal the English word hides a legal difference between a sinal (a down payment, which the law treats in a particular way) and a caução (a security). If you trade there, read the box in section 7 before you write “deposit” into Portuguese terms.

02How much to hold

What shops publish

We read the terms-of-hire and price pages of 25 hire businesses, councils, non-profits and bike-share schemes that state a deposit, hold or pre-authorisation amount, and about 20 more that give policy wording but no sum. The sums are per bike, in their own currency with no conversion, except one council centre’s £20, which covers a hire of up to nine bikes and is left out of the chart:

What stands out

• The sums rise with the class of bike. Where a page gives two classes, the e-bike figure is higher: a UK park authority’s hire centres give £50 and £100 a bike, and one mountain bike operator £250 against £1,000 for an e-mountain bike.
• Overnight and high-value hires can go much higher. One UK mountain bike operator’s conditions page says £1,500 a bike is pre-authorised for overnight hire, and £3,500 for an e-bike. A rental centre in Spain says a deposit “up to the item’s value”, and a US bike shop says a hold “up to $2,500 per bike”. Two EU pages state sums above the chart’s range: €300 for other types of bike (a non-profit) and €400 for a third class (a resort).
• Most are per bike. One park authority caps its hold at £200 a transaction. We found no operator publishing a flat group deposit.
• The mechanism is mixed. Cash, card holds, card charges and “ID left with us” all appear, and sometimes the same operator’s pages disagree: one park authority’s FAQ says deposits must be paid in cash while its price page says the card company “holds the pre-authorised amount”. If your pages disagree, customers will not know which to trust, and may hold you to the friendlier one.
• Many publish no deposit. Several pages ask for a card, ID or a damage waiver and state no sum. In the US, many pages we read rely on a priced waiver of about $5 to $25 a day, or a stated replacement-price list, instead.
• Percent-of-value is not a rule. Four examples we worked out, setting published sums against the retail prices we read, ran from about 12% to 48% of the bike’s price, above the 3.6% to 4.4% in the example in our older pricing guide, though that example used much dearer bikes, so the two are not like for like. Do not copy a percentage from us or anyone else.

What a bad day costs

A hold needs to be sized against what goes wrong. Published workshop labour in six UK shops runs from about £25 to £80 an hour, with fixed fees of about £5 to £35 for small jobs such as fitting pedals, a chain, a tube or a gear cable. Parts on retail pages we read on 14 October 2026 are cheap next to the labour: a derailleur hanger from about £10 to £37, a chain from about £9 to £37, an inner tube about £4 to £7, a rear derailleur from about £13 to £99 for common groups. The big items are the e-bike battery (about £380 to £760 on the listed prices, with list prices up to about £820) and the bike itself: hybrids on the pages we read are about £350 to £650, e-bikes about £1,000 to £4,400, full-suspension mountain bikes about £2,000 to £4,500. Operator schedules we read put a lost bike at £300 (a city scheme’s maximum), £600 (a UK university), and €400 to €1,950 for standard and electric bikes, or €3,900 for a cargo bike (two Dutch and Belgian price lists). One UK schedule lists an e-bike motor at £700.

Our worked example turns those ranges into a list of ordinary bills for a hybrid bike worth about £500 (example prices and costs):

A £100 hold covers five of the eight example incidents on this bike (the wheel, at £110, is just over it). Only losing the bike runs well past a hold of a few hundred pounds.

The shape of the problem

The next chart asks a different question: for a given hold, how much of the whole year’s claim value does it cover? Each line uses an example list of incidents with example costs and example frequencies. The frequencies are placeholders, because we found no published rate for bike hire.

The pattern, not the numbers, is the point:

• On a cheap bike, a modest hold covers most things. The rare total loss is where a hold falls short, and on a £500 bike, covering the total loss means holding the bike’s whole value.
• On an expensive bike, no sensible hold covers the tail. Even £1,000 covers only about 70% of the e-bike’s example claim value. The exposure is the battery, the motor, the frame and theft. Your levers are a hold sized to value for the few high-value bikes (as some operators do), a damage waiver or insurance, tighter ID and return checks, and a claim against the customer afterwards (section 6).
• A bigger hold has a cost too. It puts more of the customer’s available money out of reach, a card may not support it, and some customers will book elsewhere. We found no data on how deposit size changes bookings, so test it.

How to size a hold for your fleet

1. 1List the realistic bad outcomes for each class of bike, with a cost from your own workshop. Use your own labour rate and your supplier’s parts prices, not ours. Include the things that go missing: lock, key, charger, helmet.
2. 2Pick the hold that covers the ordinary bad day, the three or four things that happen most, and decide separately how you will handle the rare big ones.
3. 3Ask what makes a customer treat the bike with care, and what starts to lose bookings. Enough to matter, not enough to feel like buying it.
4. 4Set it per bike, by class, and decide what happens with groups. Ten e-bikes at £250 is £2,500 on one card, which some cards’ limits will not allow. Let a group split across cards, or lower the hold for large bookings, and write that down.
5. 5Write down whether the hold is a limit on what you can claim. It is not unless you say it is. A Dutch shop’s terms say the deposit is no limit on the customer’s liability, and a UK mountain bike operator says the customer pays in full for loss above the deposit; a German tourist office and a French tourist office instead cap what the renter pays for ordinary damage (€120 and €250 in the terms we read). Pick one and state it.

03When to take it

There are two moments, and they are different payments.

The booking deposit is taken at booking. It is part of the price, so it behaves like any other part-payment: it goes in the booking, it carries VAT if you are registered (section 7), and your cancellation terms decide what happens to it. We cover cancellation and no-show terms in section 8 of the pricing guide. For scale, one UK hire business takes a 10% booking deposit online, and a Dutch tour and rental firm takes 30% of the total travel sum. We found no authority that sets a percentage; the CMA’s only wording is that you may keep a deposit in full if it is “no more than a small percentage of the price” and you make clear when it becomes non-refundable.

The security deposit is taken at pickup. The reason is the clock on a card hold.

How long a hold lasts

A hold does not last for ever. If it expires before you capture the money, Stripe says the funds are released and the payment is cancelled, and you cannot capture it afterwards. The length depends on the card network, whether the customer is present, and your merchant category and account:

What we read, and where it disagrees:

• Stripe’s standard windows. Online, customer-initiated card payments hold for 7 days. Visa payments the merchant initiates, without the customer taking part, hold for 4 days and 18 hours, and Stripe’s table shows other networks at 7 days. In person, Visa is 4 days and 18 hours and Mastercard, Amex and Discover are 2 days. Our older pricing guide said in-person holds last “about 2 days”; that is true only for three of the four networks.
• Visa’s own notice. A Visa notice for the US region (effective 13 April 2024) gives customer-initiated card-not-present transactions 10 calendar days, merchant-initiated transactions 5, and, for transactions carrying an estimated-authorisation indicator, puts “Bicycle rental, including electric scooters” in a group of rental types at 10 calendar days, against 30 for lodging, vehicle rental and cruise lines (Visa notice, PDF). Stripe’s Terminal page repeats it for extended authorisations you request on a Terminal payment: Visa bicycle rental at 10 days (exactly 9 days and 18 hours), against a default in-person window of 2 days, or 5 for Visa (exactly 4 days and 18 hours, as above).
• Extended holds up to 30 days exist, with conditions. On Stripe’s online page, extended authorisation is offered to users on Interchange Plus pricing, and a business on blended Stripe pricing has to contact Stripe. Visa lists “all other merchant categories” at 30 days, with an extra 0.08% fee per transaction charged by Stripe and only for customer-initiated payments. Mastercard lists all categories at 30 days. American Express lists only lodging and vehicle rental and requires you to capture by the end of the rental. Discover removed equipment, furniture and appliance rental, boat rental, recreational services and several other categories in September 2023. Bicycle hire is not named on that online page, and Stripe warns that many networks allow the longer window only where you do not know the final amount.
• One payment company’s bulletin says 30 days. An acquirer’s merchant bulletin summarising the same Visa change says Visa allows up to 30 days for e-commerce if you use an estimated authorisation, and lists bicycle rentals among the eligible types (bulletin). Visa’s own table says 10 days. We treat Visa’s document as the primary one.
• Banks show their own clock. First Direct says a UK authorisation expires after 15 days; Nationwide says it stops reserving the money after 7 days if the company has not taken it; Chase UK says a pending transaction usually takes up to 7 days, but can be up to 30 days for things like hotel bills or car hire. A bank’s display rule is not the card network’s rule, and either can drop a hold from the customer’s screen before yours expires.
• Nothing in a Portuguese source. We found no Banco de Portugal, SIBS or Multibanco page that states how long a hold lasts.

So we would plan on 7 days online and 2 to about 5 days in person, treat 10 days on Visa as the upper end for bicycle rental until your provider confirms it for your account, and never write a hold length into your terms as a fact.

Test your own account. On Stripe, the Charge carries a capture_before field with the real expiry. Place a test hold, read it, and read it again on a live payment, because Stripe says these rules “can change without prior notice”. Ask your provider which merchant category code your account carries; we found no dedicated code for bicycle rental in the lists we read, and the category decides which window applies.

What that means for hires of different lengths

• A day or a weekend fits most standard windows. In-person Mastercard, Amex and Discover (2 days) cover a weekend only just. A hire of 3 to 4 days fits online and Visa in person but not those three networks in person, and 5 to 7 days fits only the online window. Place the hold at pickup and cancel it at return.
• A week or more reaches or passes the standard windows (chart above): 7 days online, 2 days in person on Mastercard, Amex and Discover, 4 days 18 hours on Visa in person. Someone has to place a new hold before the old one lapses, or you accept that the last days are unsecured. A fresh hold placed while the customer is away is the harder case described in step 4 (we found no primary statement that it counts as a merchant-initiated transaction), so ask your provider first, or have the customer approve a payment link or call in. Your terms should say you may place a fresh hold and that the customer agrees to it.
• A very long hire (a fortnight or a season) is better handled by a different structure: a charge-and-refund deposit (section 4), a damage waiver, or a monthly rental with its own agreement.
• Incremental authorisations do not extend a hold. They raise the amount before capture. Stripe says they do not extend the validity period (one payment company’s merchant documentation says each Mastercard increment extends the clearing window by 30 days and a Visa one does not, so test), and they are an Interchange Plus feature too.
• Do not place the security hold at booking for a hire that starts more than a few days later. It would lapse before the customer arrives.

If a hold expires while the bike is out and the bike comes back damaged, you cannot capture. A late claim is a new transaction that needs a new authorisation or the customer’s agreement. Amex has dispute reasons for charges made after an authorisation expired (A02 ‘No Valid Authorization’ and A08 ‘Authorization Approval Expired’ on Stripe’s reason-code list), and Visa’s No Authorization condition (11.3) is the likely equivalent.

04Hold or charge and refund

A hold reserves the money and takes nothing. A charge takes it, and a refund sends it back later. They cost different amounts and feel different to the customer.

What the fee difference is worth

Stripe’s UK pricing says online payments on standard UK cards cost 1.5% + 20p, premium UK cards 2.8% + 20p, EEA cards 2.5% + 20p and international cards 3.15% + 20p (the last two plus 2% if currency conversion is required) (in-person Terminal payments have separate rates on the same page, 1.4% + 10p for EEA cards and 2.9% + 10p for non-EEA cards, so check which apply to a counter reader), and that for a refund “the payment processing ... fees from the original transaction are not returned” (pricing; refunds). On a £200 deposit that is £3.20 on a standard UK card, £5.80 on a premium one, £5.20 on an EEA card and £6.50 on an international card, lost whenever the deposit goes back as an ordinary refund. Stripe’s own refund page says that if you process many refunds close to the time of the transaction, it recommends manual authorisation and capture to reduce refund costs. (Stripe’s refunds page also says a refund issued shortly after the charge can appear as a reversal, and its glossary says Stripe “doesn’t withhold any fees for payment reversals”. Stripe’s disputes page says a reversal usually happens within about 2 hours of capture, so it does not help a deposit that goes back days later.)

In our worked example, a shop takes 2,500 two-bike bookings in a season, and 5% of bookings end in a claim. At £100 a bike, charging and refunding the deposit costs about £9,300 in card fees across the season, and holding costs about £210, because the fee falls only on the amounts captured for claims:

The hold column is almost flat because the example claim is capped at the hybrid’s example bills. A shop that captured more often would pay more, but only on the amounts it captured.

What the customer sees, and why it matters

• A hold cuts available money. Stripe’s authorisation holds explainer says a hold on a debit card reduces the available balance, and on a credit card lowers the remaining credit limit. A few hundred pounds of holds on a family’s debit card can stop them paying for lunch.
• Release takes a while to show. Stripe says some banks update available balances instantly and others “take a bit longer”, and that this “reflects bank processing cycles, not business decisions”. The customer’s bank decides. NatWest’s page says a pending UK payment usually takes up to 4 working days to be debited in full and an international one up to 10; it gives no release time for a hold that is never captured; Stripe’s general article says credit card holds are usually clear in three to seven working days and debit holds “occasionally” take several weeks (a marketing explainer, so a weaker source).
• Say so in advance. A sentence on your booking page (“we release the hold on the day you return the bike; your bank decides when it shows as available”) saves arguments.
• Your card policy is a choice. Some operators take credit cards only for the hold. A debit hold works, but some customers will object. Check the card type before you place the hold and decide your rule. We found no source on prepaid cards and holds, so test them.
• Foreign cards. The customer’s bank may add a foreign-exchange fee. Set the hold in the currency the customer sees; we found no source on how a hold is re-rated at capture.
• Cash is a real option. No card fees or delays, but handling and theft risk and no chargeback. You owe it back unless you have a valid claim, so give a numbered receipt with the amount and the return conditions. The consumer-law points in section 7 still apply, and the CMA’s footnote on refunded card holds does not mention cash, so show a cash deposit as prominently as the price.

05How to take card deposits for rentals, step by step

This is the working sequence for a hold at pickup, with the extra step if you want to be able to charge for damage above the hold.

Step 1. Write your rule down

Per class of bike: the amount, whether it is per bike or capped per booking, which cards you accept (credit only, or debit too), what happens on a hire longer than the hold window, and what you may claim for. Everything below follows from it. It also means two staff give the same answer.

Step 2. Tell people before they pay

For online and phone bookings, the Consumer Contracts Regulations 2013 (Schedule 2, paragraph (u)) require you to tell the customer “the existence and the conditions of deposits or other financial guarantees” the consumer has to pay or provide at your request. The EU Directive 2011/83 (Article 6(1)(q)) has the same duty, and its recital 33 says that includes where “an amount is blocked on the consumer’s credit or debit card”. Put the hold on the price page and the booking page, not only in the terms: say the amount, that it is a hold and not a charge, when you release it, and what you may claim for. A late or unclear disclosure of a charge can be a misleading omission under section 227 of the Digital Markets, Competition and Consumers Act 2024, which counts providing information “in a way that is unclear or untimely” as omitting it.

Step 3. Show the exact amount at the moment of consent

In the UK, regulation 78 of the Payment Services Regulations 2017 says the payer’s payment service provider may not block funds “unless the payer has authorised the exact amount of the funds to be blocked”, and must release them without undue delay. Article 75 of the EU’s second Payment Services Directive says the same. Both bind the customer’s bank, not you, but your checkout or counter is where the customer authorises the exact amount, so show it there. A wording that works:

Step 4. Place the hold while the customer is there

The least friction is a counter card reader with chip and PIN or a phone wallet, which Stripe says typically meets authentication requirements through the PIN or the device (Stripe’s SCA guide). Stripe’s UK Terminal page adds that a contactless tap of a physical card might be sent back for chip and PIN, so expect the odd second attempt (Terminal, UK). If you must do it remotely, send a payment link and have the customer complete it while they stand at the counter or on a call. A hold taken online while the customer is present is customer-initiated, so expect a 3-D Secure prompt. That authentication covers the amount held. A European Banking Authority answer (Q&A 2020_5133) says that where the exact amount is not known in advance, if the final amount is higher than the amount the payer was made aware of and agreed to, the bank must apply SCA to the final amount or decline.

A hold that you place yourself later, on a saved card, with the customer absent, is a harder case. Stripe’s definition of a merchant-initiated transaction has three parts, and one covers “collecting payment for goods or services provided”. A hold you place later on a saved card, with the customer absent, does not clearly fit it, and we found no primary statement either way. That is our reading, so place the hold while the customer is present.

Step 5. If you want to claim above the hold, get the agreement now

A hold is capped at what you held. To charge more for damage, you need the customer’s agreement to a later charge on a saved card. On American Express in the US, the merchant one-pager (section 6) requires written permission received after the damage occurs, so an agreement signed at pickup is not enough on that network; for other networks and for UK and EU Amex we did not find the equivalent rule. Stripe’s saved-card guidance says the terms you show must cover the customer’s agreement to you “initiating a payment or a series of payments on their behalf”, the “anticipated timing and frequency of payments”, and “how you determine the payment amount”, and that you must keep a record of the agreement. The card must be authenticated when it is saved or on the first payment. Stripe says exemptions “aren’t guaranteed”, and a bank can still decline an off-session charge and force the customer back online to authenticate. If the card brand changes through an automatic card update, Stripe says you cannot charge it for merchant-initiated payments until you get a new agreement.

Our drafting of a clause for hire (not Stripe’s wording; a lawyer should read it):

Two cautions. The customer can still stop the card payments with their card provider; the Financial Conduct Authority’s consumer page says the card issuer must stop them once asked, and also that the customer remains responsible for money owed under a contract. And a damage charge on a saved card carries no 3-D Secure liability shift: Stripe says there is no liability shift for merchant-initiated transactions.

Step 6. Phones, paper and card numbers

Payments taken over the phone are outside SCA but must be flagged as such (Stripe’s SCA guide), and Stripe’s MOTO explainer says they carry a higher likelihood of chargebacks (a marketing explainer, so a weaker source). The Payment Card Industry Security Standards Council FAQ on storing card verification codes says the card verification code may not be stored after authorisation, and that a customer’s approval for you to keep it has no validity. Our recommendation, not a quoted rule: do not write card numbers or the 3- or 4-digit code on hire forms or in a notebook. Use a reader or a payment link so card data never reaches your paper.

Step 7. Handle a decline calmly

A hold can fail for insufficient funds, a limit, an unsupported card type or a required authentication. Stripe’s decline codes can tell you which, though many declines come back as a generic decline with no reason, and Stripe says not to tell the customer the specific reason for a lost or stolen card. Offer another card, a lower-value bike or a cash deposit if you take cash. For authentication-required declines, the customer has to come back and authenticate.

Step 8. Record the handover

Take dated photos of each bike and its kit at pickup and note existing marks on the hire record, with the customer’s confirmation (a signature or a tap). This is the evidence you will need in section 6, and it is cheap. Put the hold amount on the receipt. If you copy ID, ask whether you need to (section 7) and set a deletion date.

06Releasing the deposit, or claiming against it

On return: check, then decide the same day

Check the bike against the handover photos while the customer is there if you can. Decide the same day whether the hold is released or claimed against. A Visa document on estimated and incremental authorisation and reversal processing says the whole authorised amount must be reversed within 24 hours of the merchant becoming aware that the transaction will not be completed (Visa); it names no region and is marked as confidential to Visa participants rather than merchants, so ask your provider what applies to you, and a hold left to lapse on its own can leave a customer without their money for days for no reason.

If the bike is clean: release it

On Stripe, you cancel the PaymentIntent. A hold that has not been captured cannot be refunded; you cancel it, and Stripe says it can be cancelled at no cost. Message the customer (“we have released your hold; your bank decides when it shows”) and keep the time you released it. That message answers the obvious customer question: where is my money?

If there is damage: claim real, evidenced loss

The most important legal point in this guide is that keeping money is the risky step, not taking it (section 7 sets out the UK reasoning). In practice:

• Claim what you can prove. The CMA’s business guide says a term is unlikely to be fair if it makes customers pay “more than your actual losses”, and more likely to be fair if you “explain clearly and upfront what sanction the customer must pay and when” and “charge a proportionate and appropriate sum”. Keep the repair invoice or the price-list line, the handover and return photos, and the bike’s age and value.
• Do not charge for ordinary wear. On our understanding (not verified in a primary source), a hirer is not expected to pay for fair wear and tear from ordinary use, and your terms and the fairness test decide the rest. Our understanding of general damages law is also that a repair that puts a new part on a worn bike can be challenged as “betterment”, so a bent hanger is an easier claim than a new chain on a worn drivetrain. A lawyer can confirm how that works in your country.
• Lost hire income is a loss you may claim only if it is real and not counted twice. Be able to show the bike was booked, and do not charge the same loss in the repair price and again as lost hire.
• A fixed fee for late return or a lost key must have a reason. Under the UK penalty rule (section 7), a fee triggered by a breach has to protect a legitimate interest, such as having the bike back for the next customer, and not be out of all proportion. Our reading is that a late fee near the daily rate is easier to defend than a multiple of it. Keeping the whole deposit for any damage, however small, is high-risk drafting on our reading.

A worked example, built on example prices and costs: a customer returns a hybrid with a bent hanger and a buckled wheel. Your invoice shows £50 for the hanger and gear adjustment and £110 for the wheel. You capture £160 of the £250 hold and the remaining £90 is released automatically. The card fee falls only on the £160, about £2.60 on a standard UK card (1.5% + 20p). The customer’s pending £250 becomes a £160 charge, and £90 returns when their bank updates.

The mechanics of capturing (Stripe)

• Partial capture releases the rest. Pass the amount to capture; Stripe says a partial capture “automatically releases the remaining amount”. You can only perform one capture on most payments, so you cannot capture £100 now and the other £60 later.
• You cannot freely capture more than you held. Overcapture is narrow: Interchange Plus users only, online cards only, with brand caps (Visa +15% for most categories; Stripe’s table excludes Visa for businesses in the EEA). Under SCA you also generally need to have authenticated at least the amount you capture, Stripe says. Do not plan on it.
• A claim above the hold is a second, separate charge on the saved card if you have the agreement from step 5, or an invoice if not.
• Time limits. American Express’s US merchant one-pager on damages (a 2019 document) says written permission from the cardholder must be received after the damage, the charge must be on the same card, within 90 days of the rental, as a separate charge, and lists bicycle rental among the types covered (Amex, US). We could not read the equivalent Visa and Mastercard rules, so treat 90 days as a ceiling and act in days.

Tell the customer before you take the money

Send the itemised claim, the photos and the invoice, and say when you will capture. Two reasons: it matches the CMA’s advice to explain clearly what the customer must pay and why, and a customer who sees the evidence may be less likely to dispute, though we found no data on this. If the hold is about to expire, capture the amount you can evidence and tell the customer straight away.

Disputes: prevention beats winning

If a customer disputes the charge with their bank, on our reading a damage claim is likely to be filed under a “not as described or defective” category or a “charge amount” category, and a customer who says they never agreed to a later charge will land in an unrecognised or fraud category. The process, from Stripe’s documentation:

• Customers can usually dispute within 120 days of the payment, and for future services the clock starts on the event date.
• You have about 7 to 21 days to respond, depending on the network, and a missed deadline is an automatic loss.
• You get one chance to submit evidence, in a limited file size, with no links, and the decision takes about 60 to 75 days.
• In the UK, Stripe charges £20 when a dispute arrives, which it does not return, and a further £20 if you counter, which you get back if you win.
• Stripe’s win-likelihood table (Radar Plus’s prediction score for disputes where you submitted relevant evidence) puts 60% against its top, five-dot ranking, and says that “even in the most favorable cases, it’s very difficult to overturn a disputed payment”. These are Stripe-wide figures, not hire shops’. We found no dispute statistics for bike hire.
• Useful evidence, per Stripe: the item described accurately before purchase, the signed or accepted terms, large clear images, customer messages, and the relevant part of your terms, not all of them.
• For American Express’s “incorrect liability for vehicle rental” dispute, Stripe lists a signed liability agreement, an itemised repair invoice and the rental agreement as evidence. That reason is for vehicles; we use it only as the nearest analogue for a bike.

Three-D Secure shifts liability for fraud, not for “not as described” disputes, and Stripe says there is no shift for merchant-initiated transactions. So it does not protect a damage charge.

If the customer pushes back outside the card system

• A complaint to the customer’s card provider. In the UK, the Financial Conduct Authority says chargeback is not a statutory right and that consumers normally have 120 days from the expected delivery date, and section 75 of the Consumer Credit Act 1974 can make the card company jointly liable with the supplier for a breach of contract or misrepresentation on a credit card for a single item with a cash price over £100 and up to £30,000; it does not cover debit cards. A £40 hire is outside it. Whether a wrongful deduction from a £150 deposit on a credit card could fit is our reading at best: the limits turn on the cash price the supplier attached to a single item, not on the amount deducted, and we have not seen it tested, so take advice.
• Small claims. In England and Wales the small claims track is the normal track for claims up to £10,000 (court fee of £35 for claims up to £300, £50 to £500, £70 to £1,000, £80 to £1,500 and £115 to £3,000 on the HMCTS civil court fees table (EX50), which was updated on 13 July 2026, so check it again before you issue), and you normally bear your own costs even if you win. In Scotland, simple procedure takes claims of £5,000 or less, and a simple procedure case is a claim made in the sheriff court. Before issuing in England and Wales, the Practice Direction on pre-action conduct expects a letter with concise details of the claim and a reply within 14 days in a straightforward case. We did not research pre-action steps in Scotland, or any of this for Northern Ireland.
• The customer’s own route. A customer who thinks you took too much can do the same to you. This is why the photos and the invoice matter.

07The rules: the UK, the EU and Portugal, and the US

These rules are about how you ask, what you may keep and how you describe it. None of them sets a deposit amount, and none we found sets a deadline for returning a non-housing deposit. This is a reading of the sources we name, not legal advice.

The UK (England and Wales, Scotland and Northern Ireland)

We found the following apply across the UK unless stated; the pages we read do not always print an extent line, so we rely on extent sections where there is one (DMCCA 2024 s.338(1), Consumer Rights Act 2015 s.99(4), the explanatory note to the Consumer Contracts Regulations 2013, the CMA’s unfair terms guidance para 1.1) and on enforcement provisions elsewhere. For the Payment Services Regulations 2017 the only extent wording we found (reg 1(7)) names one England-and-Wales-only exception.

Keeping money: the fairness test and the penalty rule stack. The CMA’s business guide says any prepayments or deposits you keep “must take into account what your business will actually lose”, that making prepayments non-refundable “regardless of why the customer cancels” is unlikely to be fair, and that you may keep a deposit in full if it is “no more than a small percentage of the price” and you make clear when exactly it becomes non-refundable. It gives no percentage. On breach, it says charging more than your actual losses is unlikely to be fair. The CMA updated its main unfair terms guidance on 22 July 2026. We read the first part and found no passage that uses the words deposit or security deposit, though it does say a term letting the trader keep all prepayments when the consumer terminates could be unfair (para 4.5). We could not read the rest, so check the guidance directly. The penalty rule applies to terms triggered by breach (a late fee, a lost-key fee, keeping the deposit for damage), not to a booking deposit that is simply part of the price. The Supreme Court said the real question is whether a term is penal, “not whether it is a pre-estimate of loss” (para 31), and that for a straightforward damages clause Lord Dunedin’s older tests “would usually be perfectly adequate” (para 32). It comes from appeals from England and Wales; paragraph 42 of the joint judgment says that “the law of penalties has been held to be the same in England and Scotland”, and we did not research Northern Ireland. The Consumer Rights Act fairness test applies in all three nations.

The hold is not in the headline price, on our reading. CMA209 footnote 35 is about card holds that are automatically refunded, and gives a hotel example. Applying it to a bike hold is our reading. It does not mention cash or a charge you refund by hand, so show those as prominently as the price.

The 14-day cancellation right and your booking deposit. The right applies only to distance and off-premises contracts, so a walk-in hire has none. For an online booking for a specific date, our reading is that regulation 28(1)(h) very probably removes it, but whether a bicycle is a “vehicle” is not settled in anything we read and the leisure limb is the safer route. You must tell the customer before they are bound that they have no right to cancel (Schedule 2, para (o)). An open-dated voucher has no specific date, so take advice. Even where the right does not apply, your terms on keeping the booking deposit are still tested for fairness.

VAT, if you are registered. HMRC says a deposit “taken as security, for example against the safe return of goods on hire, is not consideration for a supply”, and that if it is forfeited because the customer damaged the goods, it is outside the scope of VAT. Notice 700 paragraph 8.13.1 says VAT is due on deposits that are part payments, and that if you keep a payment for a supply the customer does not take up, “VAT is due on the amount paid”. For example, a £180 hire (VAT-inclusive at 20%) with a 30% booking deposit takes £54 at booking, of which £9 is VAT. If the customer does not turn up and you keep it, VAT is still due on it. We found no HMRC wording on keeping part of a security deposit for a late return, which is closer to a charge for extra hire days, so take advice on late fees.

ID and photos. UK GDPR Article 5 requires that personal data is “limited to what is necessary”, and kept “for no longer than is necessary”. Our reading is that if a card hold secures the bike, a photocopy of a passport is hard to call necessary, and checking ID in person without copying is more defensible. Set a deletion date once the hire is closed and the dispute window has passed. We found no ICO page specifically on copying ID.

No statutory deposit scheme applies. The statutory tenancy deposit schemes cover tenancies only, and differ between England and Wales, Scotland and Northern Ireland. We found no statutory scheme, client-money rule or return deadline for a bike hire deposit, so your terms and your own promise of when you release are what counts.

The EU and Portugal (mainland, national rules only)

At EU level:

• Unfair terms. Directive 93/13/EEC, Article 3(3) and the Annex (paragraph 1) list as terms that “may be regarded as unfair” one that lets the trader keep sums paid when the consumer decides not to conclude or perform the contract, without equivalent compensation for the consumer if the trader is the one cancelling (point (d)) and one requiring a “disproportionately high sum in compensation” (point (e)). The list is indicative, so a non-refundable deposit is a risk, not an illegal term.
• Telling the customer. Directive 2011/83/EU, Article 6(1)(q), requires distance and off-premises contracts to give the existence and conditions of deposits, and recital 33 includes a blocked amount on a card.
• Withdrawal. Article 16(l) removes the 14-day right for leisure services with a specific date or period. We found no official text saying bicycle hire counts as a leisure service, so that is our inference.
• Card holds and surcharging. PSD2 Article 75 lets a bank block funds only with the payer’s consent to the exact amount, and Article 62(4) bans surcharges on consumer cards with regulated interchange. Directive 2011/83 Article 19 caps any other payment-method fee at the trader’s cost, and Article 22 requires express consent to any extra payment.
• Later charges and SCA. European Commission answers published in the European Banking Authority’s Q&A tool, written about hotels, say that where card details are taken as a guarantee at reservation, SCA is needed when the customer gives the mandate for later charges, and that the conditions in the earlier Q&A 2018_4031 must also be met (that Q&A says later payee-initiated transactions are outside SCA only if they need no action by the payer) (Q&A 2019_4792). They are not authoritative interpretations of EU law (only the Court of Justice can give those), and we found nothing on bicycle hire.
• PSD3 and the Payment Services Regulation were agreed in outline in November 2025 and the Council published the final compromise texts in April 2026; in the most recent sources we found (August 2026) formal adoption and publication in the Official Journal were still pending, and we could not confirm the position on the date of this review, so PSD2 and national transpositions apply. We did not read the new text.

In Portugal:

• Penalty clauses in standard terms. Decreto-Lei 446/85 prohibits, depending on the negotiating context, standard-form clauses that set penalties “desproporcionadas aos danos a ressarcir” (article 19(c)), excessive advance payment (22(1)(l)) and guarantees “demasiado elevadas ou excessivamente onerosas em face do valor a assegurar” (22(1)(m)). It applies to consumer contracts through article 20. The hooks are open standards; we found no percentage.
• Extra payments. Lei 24/96, article 9.º-A, requires the consumer’s express agreement to any additional payment.
• Withdrawal. Decreto-Lei 24/2014, article 17(1)(k), mirrors the EU leisure exception for a specific date or period, with the opening words “unless the parties agree otherwise”, so you can give free cancellation voluntarily.
• Cards. Decreto-Lei 91/2018 article 116 allows blocking funds only with consent to the exact amount, and article 101 bans surcharges on consumer cards and caps other fees at direct cost. (The pgdlisboa site numbers these articles one higher in its index than in the article text; we use the article text.)
• Hold duration. We found no Portuguese source that states it.

VAT in Portugal. The tax authority’s binding information (processo 14206, 2019, about a cancelled stay in local accommodation) treated a sum kept on a guest’s cancellation as compensation outside VAT, relying on the Court of Justice’s judgment in C-277/05, and a later binding information (processo 25040, 2023, about a cessão de exploração, a temporary transfer of the running of a restaurant, and advance rent) states the general rule that an advance is taxable when received. We found no Portuguese source on a refundable security caução, so do not assume the UK position applies.

We did not research France, Germany or Spain.

The US (state by state)

• No deposit statute found. We found no federal or state statute on the amount, timing or return of a deposit on a bike or recreation-equipment rental in California, New York, Colorado, Utah, Vermont, Hawaii or Florida. The search was not exhaustive. Deposits are governed indirectly by unfair and deceptive practices law, state total-price laws, card-network rules and liquidated-damages law.
• The FTC. Section 5 of the FTC Act prohibits unfair or deceptive practices; it sets no deposit rule, and on our reading it could reach a misdescribed hold. The FTC’s fee rule (16 CFR Part 464) covers live-event tickets and short-term lodging only, so it does not cover bike rental. Whether it reaches the lodging part of a bundled bike holiday is open.
• Total-price laws. California (Civil Code 1770(a)(29), from 1 July 2024), Minnesota (325D.44, from 1 January 2025), Massachusetts (940 CMR 38) and Colorado (HB25-1090, from 1 January 2026 under the bill’s own text, in force from that date unless a referendum petition was filed under the bill’s referendum clause; the bill history we read ends with the governor’s signature on 21 April 2025 and shows no petition) reach ordinary consumer rentals. None of the texts or attorney general pages we read says whether a refundable security deposit hold counts as part of the advertised price. California’s attorney general treats fees that are contingent on later consumer conduct, such as a fee for returning rented equipment late, as not mandatory; Minnesota’s FAQ lists late fees for equipment rentals as an example of a fee that may not be mandatory if it is reasonably avoidable. Colorado requires disclosure of whether an amount outside the total price is refundable. Our reading is that an automatically released hold is probably not an amount the customer “must pay”, although Colorado’s definition of total price is wider (it includes amounts that “must be paid to purchase, enjoy, or utilize” the item or are “not reasonably avoidable”), and no court or regulator has tested it. A deposit taken as a real charge and refunded later, or a non-refundable “deposit” that is really a fee, carries more risk. Ask a lawyer in your state.
• Surcharging. There is no federal ban. Connecticut, Massachusetts and Maine, among other states, prohibit it, Florida’s statute still prohibits it, Oklahoma and Colorado allow it with a cap of 2% (or less, in the way each state words it), New York allows it only up to the card company’s fee with the total price posted, and California’s statute still bans credit-card surcharges, although in one Ninth Circuit case (Italian Colors v Becerra, 2018) it could not be enforced against the businesses that brought the case, and the attorney general says it will generally apply that ruling to similarly situated merchants. On the Visa and Mastercard documents we read, they allow credit-card surcharges only, never debit or prepaid, with notice and a cap (the cap and other terms may change under the settlement), and a revised card settlement was reported to have received preliminary court approval in June 2026 (we did not read the order). A hold has no fee to pass on, so this matters only when you capture for damage.
• Liquidated damages. UCC 2A-504 lets a lease fix damages at an amount that is reasonable in light of the anticipated harm. California Civil Code 1671 tests a consumer’s liquidated damages more strictly, and a flat forfeiture of the whole deposit regardless of actual damage is the riskiest drafting. Deducting the real repair cost against a published price list is safer. That is our reading.
• Unclaimed property. If you actually charge a deposit and fail to refund it, general unclaimed-property rules may apply after a period (California’s is three years for most property). A card hold that expires uncaptured leaves nothing held. We did not check every state.
• Small claims limits. California $12,500 for an individual and $6,250 for a business; New York City $10,000 and city courts $5,000; Colorado $7,500; Utah $20,000; Vermont $10,000 (limits change, so check the state court’s page). We did not confirm Hawaii or Florida.
• What US operators publish. Of the pages we read: a hold of up to $2,500 a bike depending on the bike’s value; a hold equal to the value of the bike, credit card only; a hold released “once the bike is returned and inspected” with no stated release time; a $200 refundable deposit on a campus semester loan, refunded in up to 21 business days; and many pages with no deposit at all, only a priced waiver or a replacement-price list. Only one gave a refund-processing time.

08What a bike rental deposit system should do, and what RideLoop does

A spreadsheet and a card reader will run your first few weekends. A bike rental deposit system earns its place when you have several staff, several locations, long hires, and a record you may need to show a bank or a court.

What to look for

• A hold, not just a charge. Can the system place a card hold at pickup and cancel or capture it later, and does it show the customer the exact amount first?
• An amount per bike or class, with a sensible way to handle groups, so staff are not typing figures into a terminal.
• Partial capture and a record of it. Can you capture part of a hold for a claim, and attach the invoice and the photos to the booking?
• What happens when a hold expires. Does it tell you, renew it, or leave you to notice? Ask which expiry it assumes and whether it reads the real one from your payment provider.
• A saved-card agreement, with the wording the customer saw and the time they agreed, if you want to charge above a hold.
• Where the money goes. Payments should settle to your own account. Ask what the platform charges on deposits and on refunds, and whether a refund returns that charge.
• A condition record at handover and return, ideally tied to the individual bike.
• ID handling you can limit, with a choice of checking without keeping a copy.
• Roles and a log. Who can capture a hold or issue a refund, and a record of who did.
• A way out. Whether there is a contract or an exit fee, and whether you can export bookings and customers.

Ask for a demo with your own deposit rules and a real test card, not the vendor’s sample data.

What RideLoop does for deposits (our product)

• Security deposits are a hold on the card, released after a clean return or claimed against damage.
• Guests can pay in full or pay a booking deposit, with the balance paid from the guest portal.
• Payments settle to your own Stripe account. RideLoop’s commission is refunded with any refund and is never charged on deposits or tax.
• Each bike is tracked individually, with barcode or QR scanning at pickup and return.
• ID verification is optional, and you can use digital waivers with an audit trail.
• Staff roles and an audit log, CSV export and import, and an API and webhooks.
• No contract and no exit fee.
• Its limits, in plain words. Card holds expire (section 3), and on a long hire the operator renews the hold by hand today: RideLoop does not renew holds automatically. There is no accounting integration today, and scanning at the counter needs an internet connection.

We have not set out how a hold amount is set per class of bike, what a guest sees at each step, or how a partial claim is recorded, so do not assume them; ask in a demo, as you would of any tool. More: RideLoop bookings and deposits, our short deposits guide, a walkthrough, the UK buyer’s guide and ten vendor questions.

09A first-week plan

10Mistakes worth avoiding

• Writing one number into your terms as a fact. “We hold your deposit for 30 days” or “released within 3 days” are promises the bank and the card network decide. Promise your own action: “we release it the day the bike comes back”.
• Charging and refunding a deposit as the default. It costs the fee on every ordinary refund (section 4), and the money takes days to come back.
• Placing the security hold at booking for a hire that starts next month. It will have lapsed before pickup.
• Not telling the customer the exact amount before they confirm.
• Keeping the whole deposit for small damage. On our reading, a flat forfeit regardless of loss is high-risk drafting in the UK and California, and the EU unfair-terms list points the same way.
• Relying on the deposit as a cap, or as cover for a total loss. On a valuable bike, a normal hold does not cover the battery, the frame or theft.
• Photos without dates, or none at handover. You will need them, and you cannot recreate them.
• A card fee on the deposit. Banned on UK consumer cards (with a cost cap for cards issued abroad) and on EU consumer cards with regulated interchange (section 7).
• Writing “sinal” in Portuguese terms without advice.
• Pre-ticking a damage waiver. An optional extra must not be the default (UK regulation 40; EU Article 22).
• Putting card numbers on paper. Use a reader or a link.
• Copying ID because you always have. Ask whether you need to, and set a deletion date.

11Questions about taking deposits for bike hire

Where to go from here

• Set the amounts around your rates: How to Price Bike Rentals: Day Rates, Deposits and Seasonal Pricing.
• Write the terms and the waiver: bike hire waivers.
• Read our earlier short guide to holding rather than charging: security deposits for bike hire.
• Start the shop: How to Start a Bike Rental Business in the UK.
• Choose the software: our UK buyer’s guide to bike rental software.
• See how RideLoop handles bookings and deposits: rideloop.co.uk/bookings.