Saved Payment Methods: How to Store Customer Cards by the Rules

A saved payment method lets a returning customer pay without typing their card again, and lets you charge renewals while they're away. For you as the merchant, it's also a set of obligations: what you tell the customer before saving, where the card number lives, how each later charge is flagged, and what happens when the card changes. This guide covers each one, with the Visa rules and the setup in Stripe, Adyen and Shopify.

What is a saved payment method?

A saved payment method is a card, wallet or bank account that a customer lets you keep so they, or you, can use it again. For cards, the card networks call it a stored credential, or card on file: information, including the card number, kept by a merchant or its agent to process future transactions.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

In practice, you rarely store the number yourself. Your processor keeps it in its vault and gives you a token, and you keep the token with the customer's profile. What you do with that token later decides which rules apply.

Recurring billing has its own layer of rules (renewal notices, retries, cancellation). It's covered in subscription payment processing. This article is about the card itself: saving it, protecting it and keeping it usable.

How saving a card works, step by step

Step 2 is a hard gate. If that first authorization or account verification isn't approved, Visa says you must not store the card.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A declined card saved "just in case" is a card you were never allowed to keep.

What you must tell the customer before you save a card

Visa sets out the agreement in Table 5-20 of its rules. Before you store a card for a future transaction, you need the cardholder's express, informed consent to an agreement that contains:1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

These terms must be clearly displayed when the customer gives consent, and separately from your general terms and conditions. You keep them for the length of the agreement and hand them over if the customer or the issuer asks in writing.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 In Europe, a recurring agreement must also be confirmed to the customer within 2 business days.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Stripe's compliance checklist says the same in plainer words: add terms that state how you'll save and use the payment method, use it only for the purpose stated, collect explicit consent for this specific use, and keep a record of the customer's written agreement.2Stripe Docs, Save a customer's payment method when they use it for a payment

Two Visa rules apply on every screen after that. You can only use a stored credential as agreed with the cardholder. And any payment screen that shows a saved card must display its last four digits, with the Visa brand mark or the word "Visa" next to it.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Selling a subscription or a trial? The terms go further, with renewal reminders and easy cancellation. See negative option billing.

Customer-initiated vs merchant-initiated use of a saved card

The same saved card can be used in two ways, and the networks want to know which. A customer-initiated transaction happens when the customer is in your checkout and picks the saved card. A merchant-initiated transaction happens when you charge it on your own, under the agreement.

Before a customer pays with a saved card, Visa says you must validate who they are, for example with a login and password.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 That's why a guest checkout can't show saved cards: there's no account to log into. Every stored-credential transaction also carries its own point-of-sale code, plus a recurring, installment or unscheduled indicator when it applies, and the authorization can't exceed the amount of that payment.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Your processor fills in those fields. You only tell it which case you're in:

Sources: Stripe2Stripe Docs, Save a customer's payment method when they use it for a payment3Stripe Docs, The Setup Intents API and Adyen.11Adyen Docs, Drop-in tokenization (storePaymentMethodMode)12Adyen Help Center, How can I choose the Recurring Processing Model? Stripe's usage setting matters in Europe: off_session authenticates the card when it's saved so later off-session payments don't need the customer, while on_session postpones authentication until they next check out. A card saved for on-session use can still be charged off-session, but banks are more likely to decline and ask for authentication.3Stripe Docs, The Setup Intents API The authentication rules themselves are in payment authentication.

Where the card lives: PCI DSS and tokenization

Anyone who stores, processes or transmits card data falls under PCI DSS. How much of it applies to you depends on whether raw card numbers ever touch your systems. Stripe puts it bluntly: a business that handles card data directly might have to meet more than 300 security controls, while its low-risk integrations send card details straight to Stripe without passing through your servers.6Stripe Docs, Integration security guide

The security code is the clearest rule. The PCI Security Standards Council says card verification codes can't be kept once the transaction they were collected for is authorized, aren't needed for card-on-file or recurring payments, and that a customer's request or approval to keep them has no validity under PCI DSS. Encryption doesn't change it.14PCI Security Standards Council, FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions? You can still ask for the code again when a returning customer checks out; Stripe offers that as an option on saved cards.2Stripe Docs, Save a customer's payment method when they use it for a payment

What you can keep is the rest: Stripe says the card type, last four digits and expiry date it returns aren't subject to PCI compliance and can sit in your database.6Stripe Docs, Integration security guide That's all your account page needs.

The difference between a token and an encrypted card number is explained in tokenization vs encryption, and what to check in a provider in PCI-compliant payment gateways.

Network tokens: Visa Token Service and Mastercard MDES

A processor token only means something to that processor. A network token is issued by the card network itself and replaces the card number in the payment.

Visa Token Service substitutes Visa card numbers with tokens.15Visa, Visa Token Service Mastercard runs the Mastercard Digital Enablement Service. Mastercard describes the card-on-file flow: when a customer saves a card with an online merchant, the merchant sends a tokenization request; once approved, the token service provider stores the card data and keeps it up to date, even when details like the expiry date change, and the merchant gets a token for future payments. For each card-on-file payment, the merchant obtains a cryptogram from Mastercard.16Mastercard Newsroom, What is tokenization? A primer on card tokenization (March 2024)

You rarely integrate this yourself. Adyen requests network tokens automatically for stored cards when possible, with no extra integration.10Adyen Docs, Tokenization In some countries it's no longer optional: Visa requires a Visa token for stored-credential transactions in a list of CEMEA and Latin America markets, including Saudi Arabia, the UAE, Colombia and Mexico, some already in force and others phased in through July 2026.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

Keeping saved cards valid: account updaters and expiry

Cards expire, get lost, get replaced. Without an update, the next payment on the saved card fails. A card account updater fetches the new details from the network, and processors run it for you:

• Stripe automatically tries to update saved cards when a customer gets a new card. It's widely supported in the US for American Express, Visa, Mastercard and Discover; international support varies, and you can't tell in advance which cards are covered. The payment_method.automatically_updated webhook gives you the new expiry and last four digits, and the card's fingerprint changes if the number changed.5Stripe Docs, How cards work (automatic card updates)
• Adyen runs Account Updater with the card schemes. With the real-time version, the token stays the same; with the batch version, you get a results file and run a zero-value transaction with the new details.10Adyen Docs, Tokenization13Adyen Docs, Manage tokens
• Shopify Payments works with the major networks to update saved cards when customers get new ones, widely in the US with international support varying. On other gateways, Shopify warns customers may need to update their card by hand.18Shopify Help Center, Considerations and payment gateways for subscription products

Not every update is good news. An issuer can report a closed account, or decline to share the new details. Visa's updater answers and the retry limits that go with each decline are detailed in subscription payment processing, and the causes of failed renewals in subscription payment failures.

How to save cards in Stripe, Adyen and Shopify

The three platforms store cards in their own vaults. They differ in who controls the consent screen and how much you can do with the cards later.

Sources: Stripe,2Stripe Docs, Save a customer's payment method when they use it for a payment3Stripe Docs, The Setup Intents API4Stripe API reference, The PaymentMethod object (allow_redisplay)5Stripe Docs, How cards work (automatic card updates) Adyen10Adyen Docs, Tokenization11Adyen Docs, Drop-in tokenization (storePaymentMethodMode)13Adyen Docs, Manage tokens and Shopify.18Shopify Help Center, Considerations and payment gateways for subscription products19Shopify Help Center, Managing customers (edit a customer's subscription payment information)

A few details worth knowing:

• Stripe sets setup_future_usage and allow_redisplay automatically from the checkbox. If you force saving with setup_future_usage, the card is saved even when the customer didn't tick anything, so your terms must say so. Not every payment method can be saved; you can limit saving to cards with payment_method_options[card][setup_future_usage].2Stripe Docs, Save a customer's payment method when they use it for a payment
• Adyen requires a unique shopperReference for each customer, because the token is linked to it. Its Token Groups feature can share tokens across several of your merchant accounts, but it's off by default and enabled by Adyen Support.10Adyen Docs, Tokenization
• Shopify stores customer payment information itself; you can't see full card numbers once entered.18Shopify Help Center, Considerations and payment gateways for subscription products From a customer profile, you can send a "Send link to update card" email or replace the card yourself.19Shopify Help Center, Managing customers (edit a customer's subscription payment information)

Saved cards in wallets: Apple Pay, Link and Shop Pay

Wallets save the card on the customer's side, with a third party. You get a payment, sometimes a reusable credential, but the stored card belongs to the wallet's network, not to you.

Sources: Apple,17Apple Pay for merchants, Merchant tokens (MPANs) Stripe8Stripe Docs, Increase conversion and reduce costs with Link7Stripe Docs, Request a payment data export and Shopify.21Shopify Help Center, Shop Pay18Shopify Help Center, Considerations and payment gateways for subscription products For Apple Pay merchant tokens, Apple asks you to store the token with the original transaction ID and to receive lifecycle notifications through a web service.17Apple Pay for merchants, Merchant tokens (MPANs)

The trade-off between wallets is compared in Apple Pay vs PayPal, and where they fit at checkout in ecommerce checkout optimization.

The save checkbox: getting the customer experience right

The checkbox is where consent and conversion meet. The rules leave little room: consent must be explicit and specific to how the card will be used.2Stripe Docs, Save a customer's payment method when they use it for a payment1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

• Ask at the right moment. On the payment step, next to the card field, in one plain sentence. Adyen's askForConsent and Stripe's payment_method_save both render the checkbox there.11Adyen Docs, Drop-in tokenization (storePaymentMethodMode)2Stripe Docs, Save a customer's payment method when they use it for a payment
• Save without a checkbox only when the purchase needs it. A subscription can't renew without a stored card. Adyen's enabled mode and Stripe's setup_future_usage save the card without a checkbox; the subscription terms the customer accepts must then cover storage.11Adyen Docs, Drop-in tokenization (storePaymentMethodMode)2Stripe Docs, Save a customer's payment method when they use it for a payment
• Keep subscription-only cards out of one-click checkout. Stripe's allow_redisplay: limited marks a card that can only be shown in a specific context, such as one subscription.4Stripe API reference, The PaymentMethod object (allow_redisplay) A customer who agreed to renewals didn't necessarily agree to one-click shopping.
• Ask for a login before showing saved cards. It's a Visa requirement, not just good practice.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• Show the card the Visa way. Last four digits and the brand, on every screen that displays it.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• Let customers delete cards themselves. Stripe's Payment Element can show a remove option for saved methods.2Stripe Docs, Save a customer's payment method when they use it for a payment

How saved cards fit with declines and retries is covered in payment acceptance rate.

Deleting, expiring and moving saved cards

A saved card has an end. Plan for the three ways it gets there.

Deleting. At Stripe, detaching a payment method is permanent: it can no longer be used for payments or re-attached to a customer.9Stripe API reference, Detach a PaymentMethod from a Customer At Adyen, you delete the token with a DELETE /storedPaymentMethods request, and Adyen says you must also delete any remaining shopper details from your own servers.13Adyen Docs, Manage tokens On Shopify, a card the customer deletes from Shop Pay doesn't cancel the subscriptions linked to it; they continue until cancelled separately.18Shopify Help Center, Considerations and payment gateways for subscription products

Moving. Tokens don't travel between processors. Stripe will transfer card data only to another PCI DSS Level 1 processor, which must show its attestation of compliance or Visa registry listing and a PGP key of at least 4096 bits; credentials saved through Link are excluded, and subscriptions and payment history aren't exported.7Stripe Docs, Request a payment data export Adyen can forward stored details to a PCI-compliant third party.10Adyen Docs, Tokenization Shopify distinguishes cases: if cards are vaulted in Shopify, changing your primary gateway may need no migration (Shopify Support confirms it); if subscriptions use a secondary gateway's tokens, the cards must be migrated.20Shopify Help Center, Migrating payment methods to your Shopify account More on the process in token vault migration.

Saved cards across several processors

A card saved in one processor's vault only works through that processor. If that account is reviewed, paused or closed, the customers' saved cards stay behind, and every subscriber has to type their card again somewhere new. A vault that sits above the processors avoids that: the card is stored once, and each payment goes to whichever account you route it to. How that layer works is explained in what payment orchestration is.