Card on file

Card on file, sometimes called credential on file or CoF, is the practice of a merchant securely storing a customer's card data and using it for future charges when the customer isn't actively completing a checkout. It's also the name of the industry mandate that governs how merchants and payment providers are allowed to do this.

The mandate exists because card networks need a way to tell transactions the customer actively authorized apart from ones the merchant initiated on its own using data stored from an earlier interaction. Getting that distinction right decides whether a merchant-initiated transaction is treated as compliant and authorized or flagged as a risk.

Key terms to know

A few terms come up constantly in card on file discussions, so it helps to know them first:

• Stored credentials: the card data a merchant keeps on file for future use.

• CIT (customer-initiated transaction): a transaction where the customer is actively present, such as signing up for a subscription or manually reordering.

• MIT (merchant-initiated transaction): a transaction the merchant triggers without the customer present, such as an automatic subscription renewal.

• NTID (Network Transaction ID): an identifier tied to a card's payment history that card networks use to link a merchant-initiated transaction back to the original customer-initiated one.

• TLID (Transaction Link ID): a Mastercard-specific identifier used alongside the NTID to comply with Mastercard's card on file rules.

Why it matters

Card on file compliance isn't optional. It's an industry-wide mandate from the card networks, not a Recurly-specific feature, and getting it wrong can mean more declined transactions and, in some cases, non-compliance fees from the networks. For subscription businesses in particular, most revenue depends on being able to charge a stored card without the customer present at every renewal, which makes proper card on file handling foundational infrastructure rather than a nice-to-have.

Beyond compliance, storing a card properly is what makes fast, low-friction checkout possible. A returning customer who doesn't have to re-enter their card is more likely to complete a purchase or add a subscription, and correctly maintained stored credentials reduce the odds of a routine renewal getting declined for reasons that have nothing to do with the customer's ability to pay.

Recurly captures and manages the network transaction identifiers that card on file compliance depends on, including the NTID at signup and on every subsequent billing information update, plus the Mastercard-specific TLID where it's required. That means merchants don't have to build or maintain this tracking themselves.

How to use

1. Confirm your payment gateway has the relevant card on file capabilities enabled. Recurly has rolled these out gateway by gateway, so support and configuration options can vary by gateway.

2. Understand which of your transactions are customer-initiated versus merchant-initiated. This distinction determines what authentication is required, including whether a transaction is in scope for 3D Secure.

3. Let Recurly capture and maintain the NTID (and TLID, where Mastercard requires it) for each subscription series, from the initial signup through every subsequent renewal or billing information update.

4. If you see a rising decline rate on merchant-initiated renewals, check whether a valid network transaction ID is being sent with the transaction. A missing or stale identifier is a common, fixable cause.

5. Keep stored card data current using tools like Account updater so that a card on file doesn't fail simply because it expired or was reissued.

Benefits and examples

• Let returning customers check out faster and sign up for additional subscriptions without re-entering payment details.

• Keeps merchant-initiated renewals compliant with card network rules, which reduces avoidable declines and compliance fees.

• Supports accurate tracking of a card's transaction history across a subscription's lifecycle, from signup through every renewal.

• Reduces the operational burden of manually managing stored payment credentials across multiple card networks and their differing requirements.

• Gives merchants consistent handling of stored credentials across a wide range of payment gateways, so working with different processors doesn't mean a patchwork of gateway-specific behavior.Recurly has extended card on file support across a wide range of gateways over time, including Adyen, Stripe, Braintree, Worldpay, Chase Orbital, Cybersource, Fiserv Commerce Hub, and PayPal Complete.

Frequently asked questions

What's the difference between card on file and simply saving a customer's card? Card on file describes the broader compliance framework, including how a stored card's transaction history is tracked and reported to card networks. Saving a card is the customer-facing result; card on file compliance is what happens behind the scenes to keep those saved cards usable and compliant.

Is card on file a Recurly feature or an industry requirement? It's an industry-wide mandate from the card networks. Recurly's job is to help merchants stay compliant with it, including managing the identifiers the networks require.

Why would a merchant-initiated renewal get declined even though the card is valid? One common cause is a missing or outdated network transaction ID. Card networks use that ID to verify that a merchant-initiated charge is linked to a legitimate earlier customer-initiated transaction, and its absence can trigger a decline or a compliance flag.

Does card on file replace the need for 3D Secure? No. They address different things. Card on file governs how stored credentials are tracked and used for future charges; 3D Secure is an authentication step for customer-initiated transactions. See 3D Secure (3DS).