Card on File
Card on file means a customer's card details are stored by a merchant, with the customer's permission, so future payments can be charged without entering the card again. It is how subscriptions, one-click checkout, and usage-based billing work. The stored details are usually replaced with a token, so the merchant's own systems do not hold the full card number.
Last updated: November 2026
How does card on file work?
The customer enters card details once and agrees that the merchant may keep them. The merchant, or more often its payment processor, stores the details and uses them for later charges. Some of those charges are started by the customer, such as a one-click purchase. Others are started by the merchant on an agreed basis, such as a monthly subscription.
Customer-initiated and merchant-initiated charges
- Customer-initiated: the customer is present and chooses to pay with the saved card, for example at checkout.
- Merchant-initiated: the merchant charges the saved card without the customer taking part, under terms agreed earlier. Recurring payments work this way.
Card on file and tokenization
Storing raw card numbers is a security risk, so most merchants store a token in their place. A token is a stand-in value that only works inside that merchant's payment setup, which makes it of little use to a thief. Card networks issue tokens of their own as well, and these can stay valid when the underlying card is replaced.
Card on file on ad platforms
Ad platforms rely on card on file. The advertiser saves a card, and the platform charges it each time spend reaches a billing threshold or on a set billing date. The weak point is the stored card itself. If it expires, is replaced after fraud, or runs out of available credit, the next charge fails, and a declined ad payment can pause campaigns.
How Opal helps
Opal is a charge card built for agencies, media buyers, and brands that run paid media. It includes unlimited free virtual cards, so each ad platform or client account can keep its own card on file with its own spending limit. Replacing one card does not disturb billing on any other account. See how Opal works for agencies.
Frequently asked questions
With a reputable merchant it is generally safe, because the card number is normally stored as a token by a payment processor. The risk is a merchant with weak security, so it is sensible to save cards only where they are used regularly.
Delete it in the payment settings of the merchant's account, or ask the merchant to remove it. If a subscription is attached, cancel the subscription as well, because removing the card does not always end the agreement to pay.
It is a payment made with card details the merchant already holds, without the customer entering the card again. Subscriptions, usage-based bills, and one-click purchases are all card-on-file transactions.
See what Opal can do for you
Learn how our spend platform can increase the strategic impact of your finance team and future-proof your company
