Unauthorized recurring charges on a tokenized card continue after you lock or replace the card because the charge is authorized against a token (a network token, a merchant card-on-file token, or a device token), not against the visible card number, and the token’s lifecycle is managed separately from the card’s.
Root Cause Diagnosis
Merchants store a token that maps to your card account through the card network (Visa Token Service, Mastercard MDES) or through their payment processor’s vault. Recurring charges are submitted as merchant-initiated transactions (MIT) referencing that token, so no card number, CVV, or cardholder interaction is needed. When the issuer reissues the card, network account-updater services (Visa Account Updater, Mastercard Automatic Billing Updater) and token lifecycle management can carry the token over to the new PAN, so a simple card replacement often fails to stop the charges. The charge stops only when the token is deleted or suspended, the merchant agreement is cancelled, or the issuer blocks the merchant.
Quick Fix
- Open the issuer’s mobile app or call the number on the back of the card, and ask for the specific transaction to be flagged as unauthorized.
- Ask the agent to suspend or delete all tokens linked to the card, and to block the merchant (merchant ID or descriptor) from future authorizations.
- Cancel the subscription directly with the merchant and keep the confirmation.
Reporting the transaction without requesting token deletion usually results in a refund followed by a new charge next cycle.
Step-by-Step Resolution
1. Collect transaction evidence
Gather it from the statement or issuer portal (Accounts → Transactions → Transaction details):
Merchant descriptor: (exact text as shown, e.g. "EXAMPLE*SUB 800-555-0100")
Transaction date(s): YYYY-MM-DD for every charge
Amount(s) and currency:
Card last 4 digits:
Authorization / reference number: (if shown)
First unauthorized charge date:
Search your email for the descriptor and the merchant name. Check spam and trash for receipts.
2. Classify the dispute correctly
The classification determines the dispute reason code and the evidence the issuer asks for.
| Situation | Dispute type | Typical network reason |
|---|---|---|
| You never signed up, no relationship with the merchant | Unauthorized / fraud | Visa 10.4 (card-absent fraud), Mastercard 4837 |
| You signed up, cancelled, and were still charged | Cancelled recurring | Visa 13.2, Mastercard 4841 |
| Free trial converted without clear disclosure | Cancelled recurring or misrepresentation, depending on the issuer | Issuer-specific |
| Amount differs from what was agreed | Incorrect amount | Issuer-specific |
Choosing “fraud” for a subscription you did sign up for can lead to a rejected dispute. State the facts accurately.
3. Check where the token lives
Identify every place the card is stored:
- Apple: Settings → [your name] → Subscriptions, and in Wallet under the card’s details, look for merchant token or recurring payment management (the location varies by iOS version).
- Google: play.google.com → Payments & subscriptions → Subscriptions, and pay.google.com → Payment methods.
- Amazon, PayPal, Shopify, and other wallets or marketplaces: Review Payment methods and Automatic payments in each account.
- Merchant account: Look under Account → Billing or Payment methods and remove the card.
- PayPal-style billing agreements: Cancel under Settings → Payments → Manage automatic payments.
Removing the card from the merchant account is separate from cancelling the subscription. Do both.
4. Contact the issuer and report the transaction
Use the issuer’s secure messaging, fraud line, or dispute form (Card → Dispute a transaction). State the following in one clear message:
I am reporting unauthorized recurring charges on my card ending in XXXX.
Merchant: [descriptor]
Charges: [dates and amounts]
I did not authorize these charges / I cancelled on [date] and was charged afterwards.
Requested actions:
1. Open a dispute and provisional credit for each listed charge.
2. Delete or suspend every network token and merchant card-on-file token
associated with this card account.
3. Block future authorizations from this merchant ID.
4. Issue a replacement card and confirm that account-updater services
(VAU / ABU) will not forward the new credentials to this merchant.
5. Send me the case reference number and the written confirmation.
Record the date, time, agent name, and case number.
5. Request that the card number be replaced and updater services disabled
Ask the issuer to reissue the card with a new PAN (not just a new expiry date or CVV) and to opt the account out of account-updater programs for the disputed merchant, or entirely if the issuer allows it. Opting out of updater programs means legitimate merchants will need your new card details manually.
6. Cancel the subscription with the merchant in writing
Send a cancellation by email or the merchant’s contact form, and keep a copy:
Subject: Cancellation and refund request, account [email/ID]
I am cancelling all subscriptions and recurring billing on this account
effective immediately. I do not authorize any further charges.
I request a refund of the charges dated [dates] totaling [amount].
Please confirm cancellation in writing within 5 business days.
If the merchant cannot be reached, document your attempts. Issuers usually require evidence of a cancellation attempt for “cancelled recurring” disputes, but not for pure fraud.
7. Submit the dispute and supporting documents
Attach the statement pages, screenshots of the merchant account or the lack of one, the cancellation email, and any correspondence. Respond to every issuer request within the stated window (often 10 to 14 days). A missed response can close the case in the merchant’s favor.
8. Track the outcome and watch for repeat charges
Check the account for the next billing cycle. A new charge from a different descriptor (merchants sometimes bill through a different billing entity) means the block did not cover it; report it under the same case and ask for the block to be broadened.
9. Escalate if the issuer rejects the dispute
Request the written reason for the decision, then escalate using the route for your jurisdiction (see below).
Dispute Windows and Escalation by Region
- United States: Under the Fair Credit Billing Act (Regulation Z), send a written billing-error notice within 60 days of the statement date that first showed the charge. The issuer must acknowledge within 30 days and resolve within two billing cycles (no more than 90 days). Escalate to the CFPB (consumerfinance.gov/complaint) and your state attorney general. For debit cards, Regulation E timing applies (report within 2 business days for the lowest liability cap, 60 days overall).
- United Kingdom: Use chargeback (the card scheme rules generally allow up to 120 days) and, for purchases between £100 and £30,000 on a credit card, Section 75 of the Consumer Credit Act 1974. Escalate to the Financial Ombudsman Service after 8 weeks without resolution or after a final response.
- European Economic Area: Under PSD2, notify the issuer without undue delay and no later than 13 months after the debit. The issuer must refund an unauthorized transaction by the end of the next business day, unless it has reasonable grounds to suspect fraud. Escalate to the national financial ombudsman or regulator.
- India: Under RBI guidance, report unauthorized electronic transactions within 3 working days for zero customer liability; limited liability applies for reports made after 3 days. Recurring card payments require a registered e-mandate with additional factor authentication, and you can view and revoke mandates through the issuing bank’s app or net banking. Escalate to the bank’s nodal officer, then the RBI Integrated Ombudsman (cms.rbi.org.in).
- Other regions: Check your card agreement for the notification deadline. Card scheme chargeback rights usually last 120 days from the transaction date.
This guide describes common procedures and is not legal advice. Deadlines and liability rules vary by card type and issuer agreement.
Why This Fails for Some Users
- Dispute filed as “fraud” for a subscription you actually signed up for: The merchant provides the sign-up record and the issuer rejects the claim. Reclassify as cancelled recurring or unrecognized-after-cancellation, with the cancellation proof.
- Card replaced but token not deleted: Network tokens can survive reissuance through lifecycle management. Ask explicitly for token deletion, and verify each wallet (Apple Pay, Google Pay, merchant vaults).
- Charges come from a different billing descriptor: Aggregators and payment facilitators (names starting with
PAYPAL*,SQ*,PAY*,GOOGLE*) mask the real merchant. A merchant block on one descriptor does not stop the other. Block by merchant ID where the issuer supports it, and cancel at the actual service. - Free-trial conversion: The terms were accepted at sign-up, so issuers treat it as authorized. Disputes succeed mainly when disclosure was missing or misleading, or the cancellation was ignored. Preserve screenshots of the sign-up page and trial terms.
- Missed deadline: Disputes outside the 60-day (US statement-based), 120-day (scheme), or 13-month (PSD2) windows may be rejected. File the report immediately, and for older charges ask the issuer for goodwill or merchant-direct refund options.
- Provisional credit reversed: If the merchant wins a representment, the credit is reversed. Respond to the issuer’s rebuttal request with new evidence before the deadline.
- Debit card or prepaid card: Protections differ from credit cards, and funds leave your account immediately. Report within the shortest window and request the provisional credit in writing.
- Corporate or virtual cards: Controlling programs (spend-management tools) may handle disputes through the platform, not the issuing bank. Check the administrator’s dispute process, and delete the virtual card number to stop further billing.
- Account compromise: If a stolen wallet, email, or merchant account created the subscription, change passwords, remove unknown devices from Apple ID / Google Account → Security, enable multi-factor authentication, and file a fraud report in addition to the dispute.
- Merchant outside your jurisdiction: Cross-border merchants are harder to contact directly. The card chargeback path works regardless of merchant location, so rely on the issuer’s process.
- Repeated tokens through autopay aggregators: Utilities, telecom, and bill-pay services can hold a separate token. Check each autopay provider’s payment method list.