Card-on-File Transaction

A card-on-file transaction is a card payment made with card details that a merchant, or its payment gateway, stored earlier with the cardholder's permission. The customer does not type in the card number or tap the card again. One-click checkout on a shopping site, a ride-hailing app that charges after each trip, and a monthly gym membership are everyday examples.

The card networks call stored details a "stored credential", and card-on-file payments are formally stored credential transactions. They come in two kinds: a customer initiated transaction (CIT), where the cardholder starts the payment, and a merchant initiated transaction (MIT), where the merchant charges under an earlier agreement. Visa introduced its stored credential framework in 2017 and the other networks adopted similar rules, so that issuers can tell these payments apart from ordinary card-not-present sales.

Think of a local café where you run a tab. The first time, you show your card and say "keep it on file". After that, you can order and walk out, and the café charges the card you left with them. You do not get your wallet out again.

Online shops and apps do the same with a saved card. The difference from the café is that the card company wants to know the arrangement exists. So the very first time the card is saved, the shop tells the bank, "this customer has agreed to let us keep their card". Every later charge carries a label saying it comes from a saved card. That label helps the bank recognise the payment as normal rather than as a crook using a stolen card number.

1. Consent. The merchant tells the cardholder it will store the card, what it will be used for, and how to cancel. The networks require this disclosure and a record of the agreement.
2. Initial transaction. The first payment or a zero-amount verification is sent with a flag showing that a credential is being stored. This is the right moment for authentication such as 3-D Secure, because the cardholder is present.
3. Storage. The card number is held in a secure vault, usually replaced by a token so that the merchant's own systems never see the real number. Storing card data brings the merchant or its vault provider under PCI DSS.
4. Subsequent transactions. Later payments are flagged as using a stored credential and, for merchant-initiated ones, carry the network transaction identifier returned with the initial approval, linking them back to the original consent.

Stored cards go stale when they expire, are reissued after a breach, or are replaced with a new number. Two services reduce the resulting declines:

• Account updater services. The networks run services that let a merchant or its acquirer check stored cards and receive new numbers or expiry dates that issuers have supplied.
• Network tokens. With network tokenization, the merchant stores a card network token issued by the network instead of the card number. The network keeps the token linked to the current card automatically, so a reissued card does not break the saved payment, and approval rates are generally higher.

Issuers treat a payment differently once they know a credential is on file. A correctly flagged card-on-file payment is more likely to be approved, since the issuer can see a history of earlier approved payments from the same merchant and card. Mislabelled payments, such as a merchant-initiated charge sent as if the customer were present, can be declined or later disputed, and the networks can fine acquirers for misuse. The flags also matter for data: issuers use them to measure how many of their cards sit in merchant vaults and how those payments perform. Flags also tell the issuer whether to expect authentication: in the European Economic Area, the strong customer authentication rules apply to customer-initiated card-on-file payments but not to genuine merchant-initiated ones that follow an authenticated set-up.

Card-on-file payments make it easy to keep charging, which is also their main risk. Unclear consent, forgotten free trials and difficulty cancelling lead to "I didn't authorize this" chargebacks, which count against a merchant's chargeback ratio. The networks have tightened rules for subscriptions and free trials, including reminders before charges and simple online cancellation. A breach of stored card data is a separate risk: the less real card data a merchant holds, the smaller the damage, which is why tokens have become the default for recurring payments and saved cards alike. Merchants that retry failed card-on-file charges must also follow network limits on payment retries.

• Visa
• PCI Security Standards Council