Getting a new card number feels like the ultimate kill switch for an unwanted charge. Often it isn't. Two systems - card network "account updater" services and payment tokenization - can keep a subscription billing your brand-new card. Here's exactly how that happens and how to actually stop it.
Replacing your card does not reliably stop a subscription. Card networks run "account updater" services that automatically hand your new card details to merchants you've paid before. To truly stop a charge, you either cancel the subscription at the source, or ask your bank for a "security close" / merchant block - not just a routine card reissue.
When you ask your bank for a new card after an unwanted charge, you assume the old number is dead and any merchant holding it is cut off. For one-off fraud, that's roughly true. For recurring subscriptions, it often isn't - because of a system built specifically to keep subscriptions alive when cards change.
Visa, Mastercard, American Express, and Discover all run "account updater" services. Visa's is called Visa Account Updater (VAU); Mastercard's is the Automatic Billing Updater (ABU). Their entire purpose is to prevent subscriptions from lapsing when a customer's card expires or is reissued. When your bank issues you a new card, these services can automatically share your new card number and expiration date with merchants who have billed you before - without asking you first.
The industry even has a name for what these services prevent: "involuntary churn" - customers lost because a card stopped working rather than because they chose to leave. The system is designed to make sure a reissued card doesn't accidentally cancel your Netflix. The side effect is that it also doesn't cancel the subscription you actually wanted gone.
There's a second mechanism that catches people who pay with Apple Pay, Google Pay, or any "tap to pay" wallet. When you pay through a digital wallet, the merchant never sees your real card number. Instead they receive a token - a stand-in number tied to your card but separate from it.
Because the token is the thing the merchant stores, reissuing the underlying physical card may not break the token. The token can be automatically re-linked to your new card. This is why people report that they "cancelled the card but the charges kept coming" after paying a sketchy merchant through Apple Pay - the token, not the card number, is what's billing them.
Lead with the method that fits your situation - they're ordered from most to least reliable:
1. Cancel at the source first. If you can identify the merchant, cancelling the subscription directly is the cleanest fix - it removes the billing authorization entirely. If you don't recognize the charge, paste the billing descriptor into a charge lookup tool to identify the company, then cancel with them.
2. Ask your bank for a "security close," not a reissue. This is the key distinction most people miss. A routine card replacement keeps your account relationship intact, so account updater services still apply. A security close (sometimes called a "hard close" or "fraud close") shuts the old card number down completely and blocks the automatic billing update. Banks usually reserve this for fraud, so you may need to explicitly say the charges are unauthorized and you want the number fully closed, not updated.
3. Ask to opt out of the account updater and revoke the merchant token. You can ask your bank specifically to opt your new card out of Visa Account Updater / Mastercard ABU, and to remove or revoke the stored token for that merchant. A plain reissue without this step often isn't enough.
4. Place a merchant block or stop-payment. Many banks can block a specific merchant or place a stop on a recurring transaction. Visa even operates a Stop Payment Service that can decline recurring charges from a specific retailer. Ask whether your bank can block the merchant by name.
5. Dispute the charges and escalate. If a charge you never authorized goes through, dispute it as an unauthorized recurring transaction. If your bank stonewalls, escalate - in the US through the CFPB, in Australia through AFCA, in the UK through the Financial Ombudsman Service. A formal complaint usually moves things faster than a call-center request.
A specific version of this catches people constantly: you pay a tiny one-off fee - often around $1 to $2 - to use an online tool like a PDF converter, compressor, or document editor. You never created an account or knowingly agreed to anything ongoing. Days later, the same company attempts a much larger charge, commonly in the $40 to $50 range, and then retries it every few days.
How it works: buried in the checkout fine print, that small payment enrolled you in a recurring subscription. Because you authorized the original transaction, the merchant holds a valid payment credential and can keep billing - which is exactly why a card reissue alone may not stop it, per the tokenization issue above. These operators are frequently based overseas, which makes them hard to pursue directly.
What to do when there's no account to cancel:
Prevention: for any "pay once" online tool, use a disposable or single-use virtual card. Several banks and services (Wise, Revolut, Privacy.com, and some bank apps) let you create a card you can freeze or delete after one use, so a hidden subscription has nothing to bill.
Check whether the charge is tied to your wallet or your card directly. On iPhone, look in Settings → your name → Subscriptions, and at reportaproblem.apple.com. On Android, check the Google Play Store → Payments & subscriptions. If the subscription lives there, cancel it at that level - changing the underlying card won't help, because the wallet will simply re-link the new card to the same merchant.
The most reliable protection is to never give a recurring merchant your real, permanent card number in the first place. Use a virtual or single-use card (services like Privacy.com in the US, or virtual cards from Wise, Revolut, and some banks) for any "one-time" payment or free trial. You can freeze or delete a virtual card instantly, and because it's not your real card number, there's no account updater link to keep it alive. This is the single best defense against the small-charge-then-big-recurring-charge scam pattern.
Not reliably. Card networks run account updater services (Visa Account Updater, Mastercard Automatic Billing Updater) that automatically share your new card number with merchants you've paid before. A routine card reissue often does not stop a recurring charge. To truly stop it, cancel the subscription at the source or ask your bank for a security close that blocks the automatic update.
A security close (also called a hard close or fraud close) completely shuts down your old card number and blocks the card network's automatic billing update, so merchants cannot get your new details. It is different from a routine reissue, which keeps the account relationship active. Banks usually reserve security closes for fraud, so you may need to state the charges are unauthorized.
Two reasons. First, Visa Account Updater or Mastercard ABU may have automatically given the merchant your new card number. Second, if you paid through Apple Pay or Google Pay, the merchant holds a token that can re-link to your new card. Reissuing the physical card does not always break either link.
If there's no subscription listed in your Apple, Google, or PayPal account and you can't identify the merchant, paste the billing descriptor into a charge lookup tool to identify the company, then contact them to cancel. If that fails, ask your bank for a security close and merchant block, and dispute the charges as unauthorized.
This is a common bait-and-switch where a tiny one-off payment secretly enrolls you in a subscription. Email the company stating you authorized a one-time payment only and require all charges to stop, in writing. Tell your bank it is an unauthorized recurring transaction and ask for a merchant block plus an account-updater opt-out, not just a new card. If you paid via PayPal, cancel the billing agreement in PayPal directly. Escalate to your financial ombudsman (AFCA in Australia) if the bank refuses.