Stored Credential

A stored credential is created during a Customer-Initiated Transaction (CIT) where the cardholder explicitly agrees to have their payment details retained for future charges. The credential may be a raw Primary Account Number (PAN), a gateway token, or a network token (preferred, as network tokens update automatically on card reissue). From the cardholder's perspective, stored credentials power one-click checkout, subscriptions, and saved payment methods in their account.

Card scheme rules place specific obligations on merchants using stored credentials. At the point of storage the merchant must obtain explicit cardholder consent, disclose how the credential will be used (recurring, instalment, or on-demand charging), and store a reference to the original authorisation (the Stored Credential Framework transaction identifier). This reference must be included in all subsequent Merchant-Initiated Transactions (MITs) using that credential.

Stored credentials must be maintained securely. PAN storage requires PCI DSS Level 1 compliance. Network tokens (issued by the card scheme via the card scheme's tokenisation service) are the preferred alternative: they replace the PAN with a scheme-issued token that remains valid even if the underlying card is replaced or reissued, and they can be updated automatically via the account updater service without the cardholder needing to re-enter details.

Stored credentials become invalid in several situations: the cardholder cancels the agreement, the underlying card expires and no account updater is in place, the issuer declines the credential and marks it as not to be retried, or the merchant's PCI certification lapses. Merchants must have processes to identify and remove invalid stored credentials and to handle re-authorisation with the cardholder when credentials are invalidated.

Network-tokenised stored credentials update automatically on card reissue, reducing involuntary churn from expired card declines, a significant revenue retention mechanism for subscription businesses. Storing raw PANs requires full PCI DSS compliance; network tokens eliminate PAN storage and the associated compliance overhead. Stored credential agreements must be documented at the CIT stage; missing consent documentation is the primary vulnerability in a cardholder dispute over an MIT charge. Without account updater, stored PANs become invalid when the physical card is replaced; the associated decline rate on subscription renewals can be 5-15% for mature card-on-file portfolios. Invalid or unused stored credentials represent both a compliance risk and a data liability; merchants should implement credential expiry and periodic cardholder re-confirmation processes.