Card on file: rules for storing customer cards

Card on file means you keep a customer's card details, with their permission, so you can charge them later without asking for the card again. The customer might tap "pay with saved card" at your checkout, or you might charge them on a schedule, after a job is done, or when a policy kicks in, like a no-show fee. Visa calls it a stored credential. Done well, it saves everyone time. Done badly, it leaves a business with a spreadsheet full of card numbers, charges customers don't recognize, and chargebacks.

This guide covers the rules for storing a card, the different kinds of charges you can run on it, how to keep stored cards working, and the records that win disputes. Network rules cited are as of October 2026.

What does card on file mean?

It means the card is stored with you or your provider, and a later charge runs on that stored card instead of a card the customer hands over. Visa's message format even has a code for it: point-of-sale entry mode 10 means the merchant initiates the transaction using credentials stored on file. The customer's bank can see that the charge came from a stored card.

Almost every kind of business uses it somewhere:

Who starts the charge: the customer or the merchant?

That's the question that decides how each charge is labeled. A customer-initiated charge happens while the customer is taking part: they click "pay with saved card," or they give you the card and agree to store it. A merchant-initiated charge is one you run later, without the customer taking part, based on what they agreed to earlier.

Merchant-initiated charges come in a few common shapes:

Visa's developer documentation defines the last three. A delayed charge transaction processes a supplemental charge after the original services were rendered and the payment was processed. A no-show transaction charges a penalty according to the merchant's cancellation policy on a guaranteed reservation. A resubmission retries an authorization declined for insufficient funds after the goods or services were delivered. For the incremental row, Visa's best-practices guide for merchants has the merchant add an incremental authorization when spending passes the estimate, and allows one only after an estimated authorization or an earlier incremental.

Installments you run on a stored card leave any missed payment with you. With buy now, pay later, a third-party lender pays you up front and collects the installments instead.

You won't set these labels by hand. Your gateway or virtual terminal does it based on how you run the charge. What you can do is tell your provider exactly how you use stored cards and ask it to confirm each kind of charge is labeled correctly.

What do you need before storing a customer's card?

The customer's consent, given before you store anything. Visa's framework for transactions with stored credentials requires the cardholder's consent before card details are stored for future use, and expects both the first storage and each later charge to be identified in the transaction data. If nothing is due when the card is saved, you run an account verification instead of a charge.

Consent means the customer knows what they're agreeing to. In plain words, they should see:

1. What you'll charge the card for: a plan, balances, fees under a policy, or purchases they start.
2. How much, or how the amount is worked out, and any maximum you won't pass without asking.
3. When charges happen: a date each month, or the event that triggers one.
4. How you'll tell them about a charge, before or after it runs.
5. How to cancel the arrangement or remove the card.

Two extra rules apply in common cases. For debit cards used for recurring payments, the CFPB's Regulation E requires a written authorization signed or similarly authenticated by the consumer, and electronic signatures count. For subscriptions that start with a free trial or an introductory price, Visa's subscription merchant policy requires a reminder at least seven days before the trial or introductory period ends, with a simple way to cancel.

How should you store a card on file?

As a token held by your payment provider, never as a card number in your own systems. And never with the security code.

PCI SSC is direct about the code: it isn't needed for card-on-file or recurring transactions, and storing it for those purposes is prohibited. Collect it once to check the card when it's first saved, then let it go. Our CVV guide covers the rest of that code's rules.

For the card number, a token is the safe stand-in. PCI SSC's tokenization guidelines recommend minimizing the number of system components that touch card numbers, and the networks run their own services too: the Visa Token Service substitutes Visa card numbers with tokens for digital payments. Our guide to payment tokenization explains processor tokens, network tokens, and how either one shrinks your PCI scope.

What not to do:

• A spreadsheet or customer database with full card numbers.
• Card numbers in email, text messages, or the notes field of booking software.
• Paper authorization forms kept in a drawer after the card is entered.
• A "backup" copy of the card number next to the token.

One more thing to ask before you build up a big list: if you ever switch providers, can your stored cards be moved securely, and what does it cost? Processor tokens don't work anywhere else.

How do you keep stored cards from failing?

Use an account updater and retry declines carefully. Cards expire, get reissued after fraud, and get replaced when customers switch banks. How many? Visa's account updater FAQ puts it at 30% a year on average: that share of card accounts at participating issuers changes number or expiration date, or closes. Mastercard's Automatic Billing Updater sends account changes for card-on-file and recurring payments to merchants in the same way.

Run that on a real list. A lawn care company in Portland that bills 800 customers after each visit could see about 240 cards change in a year (800 times 30%), or about 20 a month. Without an updater, every one is a failed charge, a phone call, and a customer who might not pick up.

When a charge does decline, the decline type decides what happens next. Visa doesn't permit reattempting a decline in its issuer will never approve category. Where a retry is allowed, the ceiling is 15 retries in 30 days, per Visa's merchant business news digest. We'd use a fraction of that: one retry after a few days, a message to the customer with a secure link to update the card, and one more try before you pause service. Our guide to the do not honor decline explains the most common code.

How do you win disputes on card-on-file charges?

With records made at the time, not reconstructed later. Here are three claims you'll see on stored-card disputes, and what answers each:

Visa's dispute guide says to cancel a recurring charge immediately when the customer asks and not to bill after a cancellation request. The same guide lists a common cause of "credit not processed" disputes: a guaranteed reservation was canceled, and the customer was charged a no-show fee anyway. Both come down to a cancellation log someone checks before charging.

For fraud claims from returning online customers, Visa's Compelling Evidence 3.0 can flip the dispute. Visa's acquirer FAQ sets the test: two earlier undisputed purchases with your business, made 120 to 365 days before the dispute, sharing at least two of four data elements with it (login ID, delivery address, device ID, IP address), one of them the IP address or device ID. Our guide to Compelling Evidence 3.0 has the details, and Clearo's chargeback management tools help you respond to disputes.

Is it safe to let a business keep your card on file?

Usually, if the business stores it properly, and you can tell a lot from how it asks. A business doing it right shows you the terms before saving the card, tells you which card is stored (brand and last four digits), and never asks you to email or text the number. It shouldn't need the security code again after the first payment, since PCI rules bar keeping it for later charges.

If you're the merchant, those are exactly the signals your customers look for. Put the terms on the screen where the card is entered, send a confirmation that names the card and the arrangement, and make removing the card as easy as adding it. A customer who understood the arrangement has much less reason to dispute a charge they agreed to.

When is card on file not worth it?

When you'd rarely use it. Storing a card brings consent records, updater services, and dispute risk. If you charge a customer once or twice a year, a payment link sent with each invoice does the job with none of that.

It also isn't worth it when you can't store cards properly. If your only option is a spreadsheet or a paper form in a drawer, don't keep cards at all until you have a provider that stores them as tokens. And some customers will simply say no. Have a fallback ready, such as a deposit or payment at the time of service.

Here's how the trade-off looks in practice. A dog boarding kennel in Knoxville loses money on holiday no-shows. It can store cards at booking and charge a one-night fee under a written policy, or take a one-night deposit up front. The deposit is simpler and never needs a later charge, but some owners balk at paying early. The card on file keeps booking easy, but the kennel has to log cancellations and defend the occasional dispute. For peak holiday weeks we'd take the deposit; for ordinary weekends, the card on file.

Card on file checklist

1. Show the terms and get consent before storing any card.
2. If no payment is due at signup, check the card with an account verification.
3. Store cards as tokens with your provider, never as numbers in your systems.
4. Never keep the security code after the first authorization.
5. Ask your provider to confirm each kind of charge is labeled correctly.
6. Get signed or electronic authorization for recurring debit card charges.
7. Turn on account updater services for Visa and Mastercard.
8. Stop retrying hard declines, and limit retries on soft ones.
9. Keep a cancellation log and check it before every charge.
10. Keep consent records, notices, and receipts together for disputes.

Next step

Clearo's virtual terminal includes recurring billing, invoices, and payment links, and our online payments include hosted checkout with fraud screening. If you already store cards, send us a recent statement for a free statement review and we'll look at what those charges cost you, or contact us to talk through how you collect consent and store cards today.