Keeping a customer's card on file is one of the highest-leverage things a service business can do. Repeat maintenance collects itself. A payment plan does not need chasing. The invoice you would have spent three weeks following up gets paid the day the job is done.
It also quietly commits you to a set of obligations that most owners have never been told about — not by their processor, and not by the software that made saving the card a single tap. This guide covers what those obligations actually are, how to satisfy them in about fifteen seconds at the counter, and why the shop that skips them ends up paying for it in chargebacks rather than in support calls.
This is a practical overview, not legal advice. Your processor's merchant agreement and the current card-network rules govern, and both change. If you store cards at any volume, have your processor confirm your specific obligations in writing.
What "on file" actually means
There is an important distinction hiding behind the phrase.
A one-off payment is a card used once. The customer hands it over, you run it, the card details are gone.
A stored credential is a card you keep so you can charge it again later, without the customer being present. That is a different thing to the card networks, and it carries different rules — because the cardholder is not there to approve the second charge, or the fifth.
Almost everyone in field service who says "we keep cards on file" is doing the second one. Most think they are doing something closer to the first.
The four obligations
The card networks converged on a common framework for stored credentials some years ago. The details vary by network and get revised, but the shape is stable and worth knowing:
1. Tell the cardholder you are storing it. Storage is the disclosable event — not the first charge. A customer who learns their card was kept only when money leaves their account has been told at the worst possible moment.
2. Get their agreement, and record it. Not a shrug at the counter. What was agreed, when, and to what — including roughly what you will charge it for and how often. If you cannot produce this later, you cannot win a dispute.
3. Tell them how to cancel. A stored credential the cardholder cannot withdraw is the single biggest driver of chargebacks in this category. More on this below, because it is the part people get wrong.
4. Identify later charges as stored-credential transactions. This is mostly your processor's job, but it depends on you flagging the first transaction correctly when you save the card. Get it wrong and later charges are more likely to be declined — the issuer sees an unexpected card-not-present charge with no history.
The cancellation obligation is the one that bites
Here is the failure mode, and it is extremely common.
A customer wants a card taken off file. They cannot do it themselves, so they have to call you. Maybe they call during business hours and reach someone who handles it. Or maybe they call twice, get voicemail, and give up.
What they do next is call their card issuer instead. That is not a support ticket — it is a dispute, and possibly a chargeback on a charge you already collected and already spent.
Compare the two outcomes honestly:
| Customer can remove the card | Customer cannot | |
|---|---|---|
| What you lose | The automatic collection on that customer | The collection and the disputed amount |
| Your cost | Nothing | Chargeback fee, plus your time responding |
| Your standing with the processor | Unchanged | Dispute ratio moves the wrong way |
| What you find out | That they withdrew it, immediately | At a failed charge, or a retrieval request |
The business instinct is to make cards hard to remove, because a removed card is lost revenue. It is exactly backwards. A customer who can withdraw a card cheaply does so cheaply. A customer who cannot escalates to someone who can force it — and that someone charges you for the privilege and counts it against your account.
Give people the exit. It is the cheaper door.
What to say at the counter
The disclosure does not need to be a document. It needs to be specific, and it needs to happen before you save anything.
Something close to this covers it:
"I can keep this card on file so you don't have to hand it over each visit. I'd use it for your invoices from us — nothing else. You can have it removed any time by [asking us / from your account]. Want me to save it?"
Four things happened in that sentence: you disclosed the storage, scoped what it will be used for, stated the cancellation route, and asked rather than assumed. Then record that they said yes.
What not to do: a pre-ticked box on a form, a card kept "just in case" from a one-off payment, or storage buried in terms nobody reads. All three are storage without agreement, and all three fail at exactly the moment you need them to hold.
Never write the number down
This should go without saying and does not.
Do not keep card numbers in a customer file, a spreadsheet, a notebook by the till, a photo on a phone, or a note in a job record. Do not email one. Do not read one back over a recorded line.
Storing a card properly means your payment processor holds it and gives you back a token — a reference that lets you charge that card and is worthless to anyone who steals it. You never hold the number, so there is nothing to leak. Any system that has you typing a full card number into a field that keeps it is a system to walk away from.
Practical rules that keep you out of trouble
Prefer replacing to removing. When a card expires or is reissued, swapping the stored card keeps every payment plan running. It is the same conversation as removal and it costs you nothing.
Removing a card is not forgiving a debt. If a customer withdraws the card behind a payment plan, the automatic collection stops — what they owe does not change. Say so plainly at the time, to both sides. Most disputes in this area are really disagreements about that sentence.
Know before the due date, not after. If collection on a plan stops, you want to hear about it while there is still time to arrange another method. Finding out at a failed charge costs you a cycle and starts an awkward conversation from behind.
One card, one merchant. A card a customer gave you is yours to charge for your work. It is not portable, not shareable, and not usable for anything you did not describe when you asked.
Re-confirm on material change. If what you are charging for changes shape — a new plan, a materially different amount, a different cadence — ask again. The original agreement covered the original arrangement.
The short version
Storing cards is good business and it is not free. You owe the cardholder four things: tell them, ask them, let them cancel, and never hold the number yourself.
Do those, and cards on file are the cheapest collections mechanism you have. Skip the third one in particular, and you will pay for it — not in lost customers, but in chargebacks from customers who were trying to reach you first.