Stored Credential

Why Visa calls it a stored credential

Visa uses Stored Credential as its official terminology for payment card details a business or its payment provider saves for future transactions. You will see the phrase in Visa rules and payment setup materials that ask whether a credential is being stored or used again. It describes the same practice as Card on File, the primary term on this page.

The wording draws attention to the credential's later use. A customer can initiate a new purchase, or your business can initiate an agreed later charge. Visa's stored-credential framework distinguishes these transaction situations, so accurate setup and transaction labeling matter when you accept saved cards. The phrase is more common in network and processing terminology than in everyday customer conversations. It names a payment practice rather than a card product, and it does not identify a separate processing fee or standard statement line. The rest of this page explains Card on File, including how consent and later charges work.

What Card on File is

Card on File (CoF) is a customer’s payment card credential saved for a later purchase. Your business can store the card details itself or use a payment provider that stores them and returns a token. A token stands in for the card number, so your system can use it for later payments without handling the actual number.

Saving a card does not give you permission to charge it for anything. Get the customer’s consent and explain what you will charge, when or under what conditions, how the card will be used, and how to cancel. State your business contact details and identify the saved card, such as by its last four digits.

A saved card is a payment convenience, not permission to charge beyond the agreement your customer accepted.

How a saved card is charged

A customer-initiated transaction happens when the customer actively makes a purchase, such as selecting a saved card at online checkout. A merchant-initiated transaction happens when your business starts a charge under an earlier agreement. That charge can follow a schedule, as with a monthly subscription, or an event, as with an account top-up or hotel no-show fee.

An unscheduled Card on File charge is event-triggered, not billed on a fixed date. The initial customer transaction establishes the relationship for later merchant-initiated charges. Marking the transaction correctly helps the card issuer understand whether the customer or your business initiated it.

What it means for your costs and risk

CoF does not have one standard fee or rate. Your processing cost comes from the card transaction and the pricing in your processing arrangement, not from a universal Card on File charge. A saved card used for an online purchase is still a card-not-present transaction, and storing a card does not guarantee an approval or prevent a dispute.

Expired cards and replacement card numbers can cause later charges to decline. Account updater services can refresh eligible card details, but customers still need a clear way to update payment information. If a customer cancels or the agreement expires, stop charging that card for the covered purpose and remove the stored credential as required by your process.

Where saved cards go wrong

Storing payment card data puts security obligations on your business. PCI DSS v4.0.1 is the current standard as of 2026. Use tokenization to avoid storing raw card numbers where possible, and never store the card security code, also called CVV or CVC. A provider storing the data for you does not automatically remove your own PCI responsibilities.

Terms that are vague, outdated, or limited to one channel create disputes. If a customer agreed to an online subscription, that agreement does not automatically cover a separate in-person charge. Get renewed consent when you change the agreement, and verify the customer again when they actively initiate a new purchase.

What you can actually change

1. 01
   Get specific consent. Show the amount or calculation, charge timing or triggering event, cancellation method, and the card being saved before the customer agrees.
2. 02
   Use tokens. Have your payment system store a token instead of raw card details. Never retain CVV or CVC after authorization.
3. 03
   Label each charge. Send the correct customer-initiated or merchant-initiated indicator, and distinguish scheduled billing from event-triggered charges.
4. 04
   Review failed payments. Track declines caused by expired or replaced cards, and give customers a secure way to update their saved payment details.

Frequently asked questions