Card-on-file payments: How to protect approval rates and reduce compliance burden

Card-on-file is when you store your shopper's payment credentials (with their consent) to reuse for future payments without asking them to re-enter their card details.

Card-on-file payments generally fall into three types:

• Cardholder-initiated transactions (CIT): The shopper actively selects a saved card to complete a purchase, such as a one-click checkout.

• Merchant-initiated transactions (MIT): The business charges the stored card on a schedule the shopper has already agreed to, such as a subscription renewal.

• Unscheduled card-on-file (UCoF): Ad-hoc or variable charges with no fixed schedule or amount, such as a ride-hailing fare or a hotel's late checkout fee.

What’s the difference between card-on-file and tokenization?

Card-on-file is about storing a shopper's payment details for reuse. Tokenization is about how you store them safely, replacing sensitive card data with a non-sensitive token. Storing card data carries PCI DSS obligations, so tokenization is usually paired with card-on-file to meet those requirements, whether you handle it directly or through a payment provider.

A card-on-file relationship moves through four stages, from the moment your shopper first agrees to store their details to the point that agreement ends.

1. Storing the card. A shopper consents to their card being stored, either during a purchase, through a zero-amount verification transaction, or following an in-person payment that's then reused online.

2. Using the card. A cardholder-initiated transaction happens when the shopper actively selects their stored card, and typically needs authentication such as 3D Secure. A merchant-initiated transaction happens on the business's schedule, under the consent already given, and doesn't need the shopper to be present or re-verified.

3. Keeping it current. Cards expire, get lost, or get reissued. Without a way to catch this automatically, the next charge attempt simply fails.

4. Removing the card. When the agreement ends, whether the shopper cancels or the agreed term expires, the stored details need to be removed and can no longer be charged.

Card-on-file shows up differently depending on the type of business behind it. Here are few of the most common examples:

Subscriptions and digital services (MIT)

A shopper authenticates once when they sign up, and every renewal after that runs as a merchant-initiated transaction, without the shopper doing anything. This is where card expiry becomes a real revenue problem. For example, a card can be reissued mid-subscription for reasons that have nothing to do with the shopper wanting to cancel. Without the right infrastructure in place, that renewal fails running the risk of a service interruption.

Mobility and food delivery (UCoF)

A shopper stores their card once inside the app, then gets charged variable amounts such as a metered fare, a tip added after the ride, or a last-minute surcharge. Unscheduled card-on-file is built for exactly this, since there's no fixed schedule or amount to authorise against upfront.

Travel and hospitality (CIT and UCoF)

Card details are captured at the point of booking to secure the reservation, then reused later for anything that wasn't known at booking time like a no-show fee, a late cancellation, or incidental charges settled at checkout. This is a mix of both transaction types in the same customer relationship, which makes reliable card-on-file infrastructure more important than in a single-transaction-type business.

Ecommerce and unified commerce checkout (CIT)

A card stored online, or captured in person at a physical point of sale, can be reused across both channels for a faster return-shopper checkout, without asking the shopper to enter their details twice.

Adyen is a global payments platform used by businesses including Uber, Spotify, and Booking.com, processing payments across online and in-store channels through a single infrastructure. Here's what you can expect if you partner with us:

Reduce PCI scope with tokenization

Storing card data yourself means taking on PCI DSS compliance and the audit burden that comes with it. Adyen replaces the primary account number with a secure token at the point of storage, through both our own tokenization and native integration with the card schemes' tokenization services (Visa's Token Service, Mastercard's Digital Enablement Service, JCB, and American Express). Because raw card data never sits in your environment, your PCI DSS scope shrinks significantly.

Protect authorisation rates with real-time account updates

A stored card is only useful if it keeps authorising. Real-Time Account Updater connects directly with the card networks to catch expired, lost, or reissued cards before they cause a decline, which is what stops routine card reissuance turning into lost subscription revenue. Adyen's Total Cost of Payments report puts this at $1.08 billion saved across the top 100 businesses on the platform over a 12-month period, through account updates alone.

Recover revenue with smart retry logic

For payments that are refused or charged back but still have a real chance of succeeding, such as a temporary insufficient-funds decline, Auto Rescue schedules retries at the times most likely to work, rather than retrying blindly or giving up after a single attempt. And because not every transaction benefits equally from a network token versus the underlying card number, network token optimisation decides which to use on a transaction-by-transaction basis, balancing authorisation rate against scheme cost.

Handle compliance with automated lifecycle tracking

Recurring and one-click card-on-file payments carry their own scheme-level requirements: Transactions need the right indicators to show they're linked back to the original authenticated payment, and cardholder-initiated and merchant-initiated transactions need to be labelled correctly. Adyen tracks this lifecycle automatically, so the right scheme references travel with every transaction without your team needing to manage the detail manually.

If recurring or one-click payments are core to how your business operates, the provider behind your card-on-file setup determines whether renewals keep authorising when a card is reissued, how much PCI compliance burden lands on your team, and whether a declined payment gets a second chance to succeed. Talk to our team about reducing PCI scope and protecting your authorisation rates.