It's know as a "pre-authorization hold," and it's perfectly legal.
From
To