Card on file and autopay: storing cards safely and charging them with consent

What are card on file and autopay?

Card on file is a saved payment method. The customer enters their card once, the payment processor stores it, and your system keeps a reference (a token) it can use to charge that card later. Autopay is the rule that decides when the token gets charged: after every visit, on the first of each month, when an invoice is created, or when a deposit is due.

For one-off jobs, a pay link on the invoice is usually enough; cards, bank payments and fees are explained in online payments for contractors. Card on file earns its keep with repeat work. A lawn company with weekly customers, a pool service, a cleaning company or a pet waste business might send hundreds of small invoices a month. Chasing each one by hand is a part-time job. With autopay, the visit is marked done and the money arrives.

Where is the card actually stored?

With the processor, not with you. When a customer enters a card on a payment form provided by your processor, the card number goes straight to the processor. Your CRM gets back a token plus harmless details like the card brand, the last four digits and the expiry date.

This matters because of PCI DSS, the card industry's security standard. Stripe's integration security guide says PCI DSS applies to anyone who stores, processes or transmits card data, and that a business handling raw card data directly may face more than 300 security controls. Using the processor's own payment forms keeps card numbers off your servers and shrinks that burden. The same guide says the brand, last four digits and expiry date are not subject to PCI and can be stored.

Rules of thumb for your team:

• never write card numbers on paper, in notes fields, in texts or in email;
• if a customer reads a card over the phone, type it straight into the processor's form, never into a CRM notes field;
• let customers add or replace cards themselves through a secure page, such as a client portal.

What does the customer have to agree to?

Saving a card and charging it without the customer present needs their agreement up front. Stripe's documentation on saving payment methods says you are responsible for complying with laws and card network rules, that a saved method may only be used for what your terms describe, and that you should collect explicit consent, for example with a checkbox. For charges made while the customer isn't there, it says your terms should cover four things. In plain words:

1. that the customer agrees you may charge them for the specified transactions;
2. when and how often those charges will happen;
3. how each amount is worked out;
4. how cancellation works, if it is a subscription.

For a service business, that might read: "Keep this card on file and bill it when each visit is marked complete, for that visit's price plus any add-ons I approve. I can cancel autopay anytime from my account page or by calling." Put that next to an unchecked box. Then email a copy, and keep a record of when and where the customer agreed.

Are the rules different for bank accounts?

Yes. Recurring debits from a consumer's bank account fall under the Electronic Fund Transfer Act and its rule, Regulation E. Under 12 CFR 1005.10:

• preauthorized transfers from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, and the consumer must get a copy;
• when a recurring transfer will vary in amount from the previous one, the payee or the bank must send written notice of the amount and date at least 10 days before the transfer;
• a consumer can stop a preauthorized transfer by telling their bank at least three business days before it is scheduled.

Service amounts often vary (an extra service this month, a pro-rated first month), so plan how your system sends that notice. Processors that offer bank debits usually build the authorization into their checkout; read their documentation for what they handle and what is left to you. Commercial accounts follow different rules.

When should autopay actually charge?

Match the charge to the promise you made. Common patterns:

A short delay between invoice and charge (say, a day) gives the customer a chance to question something before money moves, and gives your office a chance to catch mistakes. For anything unusual, such as a one-time add-on, a missed visit fee, or a price change, tell the customer before you charge. Our recurring billing guide covers price increases, pauses and failed payments in more depth.

If you add a card surcharge, the card network and state rules in our online payments guide apply. Never apply it to bank, cash or check payments.

What happens when a saved card expires?

Often, nothing you have to deal with. Stripe's card documentation says it works with the card networks to automatically try to update saved card details when a customer gets a replacement card, and that this is widely supported for cards issued in the United States. It also says there is no way to know in advance which cards will update. So you still need a path for the ones that don't: a failed-charge message with a link to replace the card, a retry, and a note on the customer record for the office.

Who keeps the saved cards if you change software?

This is the question to ask before you save a single card. If the processing account is in your company's name (for example, your own Stripe account connected to your CRM), the saved cards live in your account and stay with you when you change CRMs. If the processing account belongs to the software vendor, you may have to ask every autopay customer to enter their card again when you leave. Processors document ways to move saved card data between them; Stripe, for example, describes a card import process from a previous processor. Ask your current vendor in writing what they will release and how. For everything else that has to move, read how to switch CRMs without losing data.

What are the common autopay mistakes?

• Pre-checked consent boxes or terms buried in a long agreement.
• Charging without a receipt. A charge the customer doesn't recognize turns into a dispute.
• Charging before the work is confirmed done when your terms say "after each visit".
• Old cards on inactive customers. Remove or stop using payment methods for customers who have cancelled service.
• No owner for failed charges. Decide who in the office reviews failed and disputed charges each morning, and how fast they act.
• A statement descriptor nobody recognizes. Set the name on the customer's statement to the brand they know.

When is custom autopay worth building?

Most field-service software supports card on file. Custom makes sense when autopay must follow rules specific to your business: charging on visit completion from the route, different terms for different plans, a surcharge on credit cards only, or several companies each with its own processor account. For our own companies, the software we wrote saves cards through each company's own Stripe account and charges them by autopay rules tied to completed work. Our custom CRM service sets this up on an account in your name.

Frequently asked questions