Also called: Stored credentials, Unscheduled Card on File (UCoF), UCoF
What Card on File is
Card on File (CoF) is a customer’s payment card credential saved for a later purchase. Your business can store the card details itself or use a payment provider that stores them and returns a token. A token stands in for the card number, so your system can use it for later payments without handling the actual number.
Saving a card does not give you permission to charge it for anything. Get the customer’s consent and explain what you will charge, when or under what conditions, how the card will be used, and how to cancel. State your business contact details and identify the saved card, such as by its last four digits.
A saved card is a payment convenience, not permission to charge beyond the agreement your customer accepted.
How a saved card is charged
A customer-initiated transaction happens when the customer actively makes a purchase, such as selecting a saved card at online checkout. A merchant-initiated transaction happens when your business starts a charge under an earlier agreement. That charge can follow a schedule, as with a monthly subscription, or an event, as with an account top-up or hotel no-show fee.
An unscheduled Card on File charge is event-triggered, not billed on a fixed date. The initial customer transaction establishes the relationship for later merchant-initiated charges. Marking the transaction correctly helps the card issuer understand whether the customer or your business initiated it.
What it means for your costs and risk
CoF does not have one standard fee or rate. Your processing cost comes from the card transaction and the pricing in your processing arrangement, not from a universal Card on File charge. A saved card used for an online purchase is still a card-not-present transaction, and storing a card does not guarantee an approval or prevent a dispute.
Expired cards and replacement card numbers can cause later charges to decline. Account updater services can refresh eligible card details, but customers still need a clear way to update payment information. If a customer cancels or the agreement expires, stop charging that card for the covered purpose and remove the stored credential as required by your process.
Where saved cards go wrong
Storing payment card data puts security obligations on your business. PCI DSS v4.0.1 is the current standard as of 2026. Use tokenization to avoid storing raw card numbers where possible, and never store the card security code, also called CVV or CVC. A provider storing the data for you does not automatically remove your own PCI responsibilities.
Terms that are vague, outdated, or limited to one channel create disputes. If a customer agreed to an online subscription, that agreement does not automatically cover a separate in-person charge. Get renewed consent when you change the agreement, and verify the customer again when they actively initiate a new purchase.
What you can actually change
- Get specific consent. Show the amount or calculation, charge timing or triggering event, cancellation method, and the card being saved before the customer agrees.
- Use tokens. Have your payment system store a token instead of raw card details. Never retain CVV or CVC after authorization.
- Label each charge. Send the correct customer-initiated or merchant-initiated indicator, and distinguish scheduled billing from event-triggered charges.
- Review failed payments. Track declines caused by expired or replaced cards, and give customers a secure way to update their saved payment details.
Frequently asked questions
Is Card on File the same as recurring billing?
No. Card on File describes a stored credential used for future payments. Recurring billing is a schedule of charges, such as a monthly membership. A saved card can also support one-time or event-triggered charges that do not follow a fixed schedule.
Can my business charge a saved card whenever it needs to?
No. Get the customer’s consent for the specific purpose and explain the amount or billing method, timing or triggering event, and cancellation process. If the customer cancels or the agreement expires, do not use the credential for that charge.
Does tokenization mean my business has no PCI responsibilities?
No. A token can reduce your exposure to raw card data, but it does not automatically remove your PCI obligations. PCI DSS v4.0.1 is the current standard as of 2026, and you should confirm which requirements apply to your payment setup.
Will saving a card lower my processing fees?
There is no standard Card on File fee or guaranteed rate reduction. Your costs depend on the transaction and your processing pricing. An online charge using a saved card remains card-not-present, so saving the credential does not make it equivalent to an in-person payment.