Card account updater: how stored cards stay current

A card account updater is a service that tells a business when a customer's stored card has changed. When a bank reissues a card with a new number or expiration date, or closes the account, the updater passes that news to merchants that keep the card on file, so the next charge goes to the right card instead of failing. Visa's version is Visa Account Updater (VAU), and Mastercard's is the Automatic Billing Updater (ABU). Both reach you through your acquirer or payment provider.

The need is bigger than most owners guess. By Visa's count, about 30% of the card accounts at issuers that take part in its updater get a new number or expiration date, or close, in an average year (Visa). This guide explains how each network's updater works, what a merchant needs to use one, where they fall short, and how they fit with network tokens. Network details are as of October 2026. For the rules on storing cards in the first place, start with our guide to card on file.

What does a card account updater do?

It answers one question about every stored card: is this still the right card? Visa's VAU FAQ lists four kinds of update the service passes between participating issuers, acquirers and merchants: new account numbers, new expiration dates, closed-account notices and "contact cardholder" advices. Each one asks something different of you.

The last row is the one people misread. Visa's FAQ gives an example of when it appears: a former joint account holder who, after a divorce, opens a new individual account (Visa). The bank can't simply hand over the new card, because you need to know which person is still paying you.

Mastercard's ABU support page names the changes that leave a stored card out of date: the card expires, it's reissued after loss or theft, or it's replaced in a move to a different card product (Mastercard). Every one of those would otherwise show up as a declined renewal.

How does Visa Account Updater work?

Through your acquirer, either in batches or in real time. The batch flow looks like this:

1. You store cards with your provider, with each customer's permission to charge them later.
2. Your acquirer sends VAU an inquiry about those cards. Visa's acquirer pages limit inquiries to accounts where the merchant has an ongoing customer relationship and the customer has authorized card-on-file payments.
3. VAU checks the cards against the changes issuers have reported and sends any updates back to the acquirer.
4. The acquirer passes the responses to you. Visa's pages expect that within two business days, and they expect you to update the stored cards before you request the next authorization.

A few rules shape how often this happens. For the batch service, an acquirer can enroll only merchants that Visa has individually evaluated and qualified, according to the same acquirer page. Merchants that bill monthly, quarterly or twice a year should send inquiries for all their accounts at least once every 180 calendar days, and annual billers at least once every 365 days. Visa also asks acquirers not to resubmit the same inquiries unless they have reason to believe the account may have changed.

Real Time VAU drops the individual enrollment, though the acquirer has to activate the card ranges that will use it. It's narrower, too: it handles only Visa updates and brand conversions, and only for card-not-present, recurring, merchandise return and Visa Direct transactions. Visa also offers acquirers an API that, compared with the batch file process, cuts the wait for a response from days to seconds, with up to 100 card numbers per call (Visa).

How does Mastercard's ABU work?

The same job, set up a little differently. Issuers report card changes to ABU, and merchants compare their stored cards against those changes through their acquirer. Before you can use it, your acquirer has to register you under the same merchant ID that appears in your authorization messages (Mastercard).

Mastercard's FAQ describes two ways to get updates:

• Pull: you ask about specific accounts when you need to, such as before a billing run.
• Push: you subscribe to accounts, and ABU tells you when an issuer reports a change.

The push model has two housekeeping rules worth knowing. Mastercard says a subscription may be deleted if the account has been expired for more than 13 months with no new update from the issuer, and that removing a merchant from ABU doesn't automatically cancel its account subscriptions (Mastercard). When a customer cancels or removes a stored card, cancel the subscription too.

From the customer's side, the effect is quiet. Mastercard's privacy notice for the service says it can give merchants updated card details without the cardholder taking action. Its product page frames the service around card-on-file and recurring payments.

How do Visa's and Mastercard's updaters differ?

What do you need to use an account updater?

Mostly, a provider that does the work for you. Here's the checklist we'd go through:

1. A provider that takes part. Ask your processor or gateway whether it runs your stored cards through VAU and ABU, or whether enrollment has to be requested.
2. Consent on file. Visa's stored credential framework requires the cardholder's consent before card details are stored for future charges (Visa), and VAU inquiries depend on that authorization.
3. Cards stored as tokens with your provider, never in a spreadsheet, and never with the security code. According to PCI SSC, card-on-file and recurring transactions don't need the code, and keeping it for those purposes is prohibited.
4. The right merchant IDs. ABU registration follows the merchant ID in your authorizations, so a business with several locations or accounts should check each one.
5. A path for updates into your billing records. If your provider stores the cards, it may apply updates for you; if your billing software keeps its own card references, ask how updates reach it.
6. Good timing. A meal-prep service in Boise that bills every Monday should have its cards checked ahead of Monday's run, not after the declines come back.
7. Cleanup. Remove cards, and cancel any ABU subscriptions, when customers leave.

Our guide to recurring billing covers consent wording and retry schedules, and our page for wellness and fitness businesses covers memberships.

What are the limits of card account updaters?

They catch a lot of card changes, not all of them. Plan for these gaps:

• Only issuers that take part. Visa's 30% figure describes card accounts at participating issuers. A bank that doesn't report changes leaves its customers' cards out.
• The issuer has to report the change. Visa's Subscription Manager documentation notes that when a card is reissued but the replacement information is not sent to Visa, the old card information still appears.
• Cardholders can opt out. Visa's overview says issuers also report whether an account is closed or a cardholder has opted out (Visa).
• Some answers still need the customer. A closed account or a contact-cardholder advice means asking for new payment details.
• Real Time VAU covers Visa updates only, so check how your provider handles Mastercard changes alongside it.
• Other card brands aren't covered here. This guide sticks to Visa and Mastercard, so ask your provider how it keeps other stored cards current.
• A new card number won't fix every decline. Insufficient funds or a fraud block is a different problem, and our guides to credit card decline codes and the do not honor response explain how to handle them.

One more limit is about your terms, not the technology. An updated card lets you keep charging under the agreement the customer already made. It doesn't stretch that agreement, and it doesn't replace a working cancellation process.

Account updaters vs network tokens: do you need both?

Often, yes, though your provider makes most of that call. A network token is a stand-in for the card number issued through the card network, and our guide to payment tokenization explains how it works. Visa's card-on-file documentation says merchants that are also token requestors automatically benefit from issuers' lifecycle management changes that update credentials. Visa's acceptance page on credential lifecycle management describes it as keeping tokens fresh, so they need re-provisioning less often when the card number changes.

Most small businesses never request tokens themselves; their gateway does, if it supports them. So ask your provider two questions. Are my stored cards on network tokens? And for any that aren't, do you run them through Visa Account Updater and Mastercard's ABU? Either way, the issuer still has to report the change.

How much does an account updater save?

That depends on how many stored cards you bill and how often, so run your own numbers. A made-up example shows the scale.

A pest control company in Raleigh bills 1,200 customers $120 every quarter, or $144,000 a quarter. If its cards change at Visa's average of 30% a year, about 360 of them will change over a year, roughly 90 a quarter. Without an updater, each one is a failed charge, a phone call, and a customer who may not call back. Say the updater returns new details for 70 of those 90; that share is invented, since the real one depends on which banks take part. That's 70 × $120 = $8,400 a quarter collected on schedule instead of chased, or $33,600 over a year.

Set that against what your provider charges, and ask in writing whether there's a fee per inquiry or per update before you switch it on. Home service companies with service plans, like the one above, are a common fit; our page for home services businesses covers how they take payments.

When isn't it worth it? If you don't keep cards on file, there's nothing to update. And if you charge a handful of customers once or twice a year, a payment link sent with each invoice may be simpler than storing cards at all.

What are the most common account updater mistakes?

Most of them come from treating the updater as a switch you flip once:

1. Checking cards after the billing run instead of before it, so the declines happen first.
2. Charging a card again after a closed-account response.
3. Ignoring contact-cardholder advices and charging the old card anyway.
4. Leaving ABU subscriptions active after a customer cancels.
5. Keeping card numbers in your own software, where provider updates can't reach them.
6. Retrying declines that can't succeed. Visa doesn't let merchants reattempt a decline in its "issuer will never approve" category, so check the decline category before any retry.

A short monthly report fixes most of this: how many cards were updated, how many came back closed or contact-cardholder, and how many charges still failed. If the last number isn't falling, ask your provider why.

Next step

If renewals fail more often than you'd like, look at the numbers before you change anything. Send a recent statement for a free statement review, or contact us to go through your recurring billing with a rep. Clearo's virtual terminal includes recurring billing, invoices and payment links, and our online payments include hosted checkout. If you're still choosing a provider, our list of the best payment gateway for small business compares the options.